@tinycloud/node-sdk 2.3.1-beta.0 → 2.4.0-beta.2

package/dist/{core-D2hPECHW.d.cts → core-BucTrpWH.d.cts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, PermissionEntry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, ResolvedDelegate, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, ResolvedDelegate, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction } from '@tinycloud/sdk-services';
 
@@ -540,6 +540,69 @@ interface PortableDelegation extends Omit<Delegation, "isRevoked"> {
      */
     resources?: DelegatedResource[];
 }
+/**
+ * The transport shape `tc auth request --emit` produces and that an owner
+ * grants to its requester. Only the fields the grant logic needs are declared;
+ * the CLI artifact carries more (posture, captured command, ...) and remains a
+ * structural superset of this interface.
+ */
+interface AuthRequestArtifact {
+    kind: "tinycloud.auth.request";
+    version: 1;
+    requestId: string;
+    /** The requester's session DID — the audience the grant is issued to. */
+    sessionDid: string;
+    /** The capabilities the requester is asking the owner to delegate. */
+    requested: PermissionEntry[];
+    /** Optional lifetime override carried from the request. */
+    requestedExpiry?: string | number;
+}
+/**
+ * The transport shape returned by {@link grantAuthRequest} (and written by
+ * `tc auth grant`). `tc auth import` accepts this artifact directly.
+ */
+interface AuthDelegationArtifact {
+    kind: "tinycloud.auth.delegation";
+    version: 1;
+    requestId: string;
+    delegationCid: string;
+    delegation: PortableDelegation;
+    permissions: PermissionEntry[];
+    expiry: string;
+    /** Whether issuing the delegation triggered a wallet prompt. */
+    prompted: boolean;
+}
+/**
+ * Minimal owner-side capability {@link grantAuthRequest} needs: the signed
+ * `delegateTo` primitive. `TinyCloudNode` satisfies this directly; web/SDK
+ * contexts can supply any object that exposes the same method.
+ */
+interface DelegationAuthority {
+    delegateTo(did: string, permissions: PermissionEntry[], options?: {
+        expiry?: string | number;
+        forceWalletSign?: boolean;
+    }): Promise<{
+        delegation: PortableDelegation;
+        prompted: boolean;
+    }>;
+}
+/**
+ * Turn a delegation REQUEST into a signed GRANT.
+ *
+ * Lifts the body of `tc auth grant` into the SDK so the request→grant
+ * handshake is callable programmatically (future SDK/web owner tooling and the
+ * KV delegation inbox), with the CLI verb reduced to a thin wrapper. The owner
+ * `authority` (a `TinyCloudNode`) signs a delegation scoped to exactly the
+ * requested caps, audienced to the requester's `sessionDid`, honoring the
+ * request's expiry. The returned artifact round-trips through `tc auth import`.
+ *
+ * Authorization is enforced cryptographically by `delegateTo`: caps that are
+ * not derivable from the owner's own session capability chain are rejected
+ * (it throws), so this never widens authority the owner doesn't hold.
+ */
+declare function grantAuthRequest(authority: DelegationAuthority, request: AuthRequestArtifact, options?: {
+    expiry?: string | number;
+}): Promise<AuthDelegationArtifact>;
 /**
  * Serialize a PortableDelegation for transport (e.g., over network).
  */
@@ -914,6 +977,27 @@ declare class TinyCloudNode {
     private ownedSpaceId;
     private writeManifestRegistryRecords;
     private ensureOwnedSpaceHosted;
+    /**
+     * Host one of this user's owned spaces by name (e.g. `"applications"`).
+     *
+     * Resolves the name to the owned space URI
+     * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`) and registers it on the
+     * server via the host-SIWE delegation flow, so subsequent KV/SQL writes to
+     * that space succeed instead of returning `404 - Space not found`. The
+     * caller is the root authority of their own owned spaces, so no additional
+     * delegation is required.
+     *
+     * Unlike {@link ensureOwnedSpaceHosted}, this always submits the host
+     * delegation rather than inferring hosting from session activation: a space
+     * the current session has never referenced is reported neither as
+     * `activated` nor `skipped`, so activation-based detection would wrongly
+     * skip the host. The host SIWE is idempotent server-side, so re-hosting an
+     * existing space is a safe no-op. Must be called after {@link signIn}.
+     *
+     * @param name - The owned space name (e.g. `"applications"`).
+     * @returns The hosted space URI.
+     */
+    hostOwnedSpace(name: string): Promise<string>;
     /**
      * Restore a previously established session from stored delegation data.
      *
@@ -1648,4 +1732,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { type DelegateToOptions as D, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type PortableDelegation as P, type RestorableSession as R, type SignStrategy as S, TinyCloudNode as T, WasmKeyProvider as W, type DelegateToResult as a, DelegatedAccess as b, NodeUserAuthorization as c, type NodeUserAuthorizationConfig as d, type RuntimePermissionGrantOptions as e, type TinyCloudNodeConfig as f, type WasmKeyProviderConfig as g, createWasmKeyProvider as h, defaultSignStrategy as i, deserializeDelegation as j, serializeDelegation as s };
+export { type AuthDelegationArtifact as A, type DelegateToOptions as D, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type PortableDelegation as P, type RestorableSession as R, type SignStrategy as S, TinyCloudNode as T, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimePermissionGrantOptions as g, type TinyCloudNodeConfig as h, type WasmKeyProviderConfig as i, createWasmKeyProvider as j, defaultSignStrategy as k, deserializeDelegation as l, grantAuthRequest as m, serializeDelegation as s };

package/dist/{core-D2hPECHW.d.ts → core-BucTrpWH.d.ts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, PermissionEntry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, ResolvedDelegate, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, ResolvedDelegate, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction } from '@tinycloud/sdk-services';
 
@@ -540,6 +540,69 @@ interface PortableDelegation extends Omit<Delegation, "isRevoked"> {
      */
     resources?: DelegatedResource[];
 }
+/**
+ * The transport shape `tc auth request --emit` produces and that an owner
+ * grants to its requester. Only the fields the grant logic needs are declared;
+ * the CLI artifact carries more (posture, captured command, ...) and remains a
+ * structural superset of this interface.
+ */
+interface AuthRequestArtifact {
+    kind: "tinycloud.auth.request";
+    version: 1;
+    requestId: string;
+    /** The requester's session DID — the audience the grant is issued to. */
+    sessionDid: string;
+    /** The capabilities the requester is asking the owner to delegate. */
+    requested: PermissionEntry[];
+    /** Optional lifetime override carried from the request. */
+    requestedExpiry?: string | number;
+}
+/**
+ * The transport shape returned by {@link grantAuthRequest} (and written by
+ * `tc auth grant`). `tc auth import` accepts this artifact directly.
+ */
+interface AuthDelegationArtifact {
+    kind: "tinycloud.auth.delegation";
+    version: 1;
+    requestId: string;
+    delegationCid: string;
+    delegation: PortableDelegation;
+    permissions: PermissionEntry[];
+    expiry: string;
+    /** Whether issuing the delegation triggered a wallet prompt. */
+    prompted: boolean;
+}
+/**
+ * Minimal owner-side capability {@link grantAuthRequest} needs: the signed
+ * `delegateTo` primitive. `TinyCloudNode` satisfies this directly; web/SDK
+ * contexts can supply any object that exposes the same method.
+ */
+interface DelegationAuthority {
+    delegateTo(did: string, permissions: PermissionEntry[], options?: {
+        expiry?: string | number;
+        forceWalletSign?: boolean;
+    }): Promise<{
+        delegation: PortableDelegation;
+        prompted: boolean;
+    }>;
+}
+/**
+ * Turn a delegation REQUEST into a signed GRANT.
+ *
+ * Lifts the body of `tc auth grant` into the SDK so the request→grant
+ * handshake is callable programmatically (future SDK/web owner tooling and the
+ * KV delegation inbox), with the CLI verb reduced to a thin wrapper. The owner
+ * `authority` (a `TinyCloudNode`) signs a delegation scoped to exactly the
+ * requested caps, audienced to the requester's `sessionDid`, honoring the
+ * request's expiry. The returned artifact round-trips through `tc auth import`.
+ *
+ * Authorization is enforced cryptographically by `delegateTo`: caps that are
+ * not derivable from the owner's own session capability chain are rejected
+ * (it throws), so this never widens authority the owner doesn't hold.
+ */
+declare function grantAuthRequest(authority: DelegationAuthority, request: AuthRequestArtifact, options?: {
+    expiry?: string | number;
+}): Promise<AuthDelegationArtifact>;
 /**
  * Serialize a PortableDelegation for transport (e.g., over network).
  */
@@ -914,6 +977,27 @@ declare class TinyCloudNode {
     private ownedSpaceId;
     private writeManifestRegistryRecords;
     private ensureOwnedSpaceHosted;
+    /**
+     * Host one of this user's owned spaces by name (e.g. `"applications"`).
+     *
+     * Resolves the name to the owned space URI
+     * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`) and registers it on the
+     * server via the host-SIWE delegation flow, so subsequent KV/SQL writes to
+     * that space succeed instead of returning `404 - Space not found`. The
+     * caller is the root authority of their own owned spaces, so no additional
+     * delegation is required.
+     *
+     * Unlike {@link ensureOwnedSpaceHosted}, this always submits the host
+     * delegation rather than inferring hosting from session activation: a space
+     * the current session has never referenced is reported neither as
+     * `activated` nor `skipped`, so activation-based detection would wrongly
+     * skip the host. The host SIWE is idempotent server-side, so re-hosting an
+     * existing space is a safe no-op. Must be called after {@link signIn}.
+     *
+     * @param name - The owned space name (e.g. `"applications"`).
+     * @returns The hosted space URI.
+     */
+    hostOwnedSpace(name: string): Promise<string>;
     /**
      * Restore a previously established session from stored delegation data.
      *
@@ -1648,4 +1732,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { type DelegateToOptions as D, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type PortableDelegation as P, type RestorableSession as R, type SignStrategy as S, TinyCloudNode as T, WasmKeyProvider as W, type DelegateToResult as a, DelegatedAccess as b, NodeUserAuthorization as c, type NodeUserAuthorizationConfig as d, type RuntimePermissionGrantOptions as e, type TinyCloudNodeConfig as f, type WasmKeyProviderConfig as g, createWasmKeyProvider as h, defaultSignStrategy as i, deserializeDelegation as j, serializeDelegation as s };
+export { type AuthDelegationArtifact as A, type DelegateToOptions as D, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type PortableDelegation as P, type RestorableSession as R, type SignStrategy as S, TinyCloudNode as T, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimePermissionGrantOptions as g, type TinyCloudNodeConfig as h, type WasmKeyProviderConfig as i, createWasmKeyProvider as j, defaultSignStrategy as k, deserializeDelegation as l, grantAuthRequest as m, serializeDelegation as s };

package/dist/core.cjs

@@ -1971,6 +1971,52 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
   }
+  /**
+   * Host one of this user's owned spaces by name (e.g. `"applications"`).
+   *
+   * Resolves the name to the owned space URI
+   * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`) and registers it on the
+   * server via the host-SIWE delegation flow, so subsequent KV/SQL writes to
+   * that space succeed instead of returning `404 - Space not found`. The
+   * caller is the root authority of their own owned spaces, so no additional
+   * delegation is required.
+   *
+   * Unlike {@link ensureOwnedSpaceHosted}, this always submits the host
+   * delegation rather than inferring hosting from session activation: a space
+   * the current session has never referenced is reported neither as
+   * `activated` nor `skipped`, so activation-based detection would wrongly
+   * skip the host. The host SIWE is idempotent server-side, so re-hosting an
+   * existing space is a safe no-op. Must be called after {@link signIn}.
+   *
+   * @param name - The owned space name (e.g. `"applications"`).
+   * @returns The hosted space URI.
+   */
+  async hostOwnedSpace(name) {
+    if (!this.auth || !this.auth.tinyCloudSession) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    const spaceId = this.ownedSpaceId(name);
+    const host = this.hosts[0] ?? this.config.host;
+    if (!host) {
+      throw new Error("Owned space hosting requires a TinyCloud host");
+    }
+    const hosted = await this.auth.hostOwnedSpace(
+      spaceId
+    );
+    if (!hosted) {
+      throw new Error(`Failed to host owned space: ${spaceId}`);
+    }
+    const activation = await (0, import_sdk_core6.activateSessionWithHost)(
+      host,
+      this.auth.tinyCloudSession.delegationHeader
+    );
+    if (!activation.success || activation.skipped?.includes(spaceId)) {
+      throw new Error(
+        `Failed to activate session for owned space ${spaceId}: ${activation.error ?? "space was skipped"}`
+      );
+    }
+    return spaceId;
+  }
   /**
    * Restore a previously established session from stored delegation data.
    *