@tinycloud/node-sdk 2.4.0-beta.1 → 2.4.0-beta.3

package/dist/index.cjs

@@ -17126,6 +17126,7 @@ __export(index_exports, {
   expandPermissionEntries: () => import_sdk_core9.expandPermissionEntries,
   expandPermissionEntry: () => import_sdk_core9.expandPermissionEntry,
   generateRandomReceiverKey: () => import_sdk_core14.generateRandomReceiverKey,
+  grantAuthRequest: () => grantAuthRequest,
   hexDecode: () => import_sdk_core14.hexDecode,
   hexEncode: () => import_sdk_core14.hexEncode,
   isCapabilitySubset: () => import_sdk_core9.isCapabilitySubset,
@@ -21104,7 +21105,23 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (granted.resource !== void 0 || requested.resource !== void 0) {
       return granted.resource !== void 0 && requested.resource !== void 0 && granted.resource === requested.resource && this.pathContains(granted.path, requested.path);
     }
-    return granted.spaceId !== void 0 && requested.spaceId !== void 0 && granted.spaceId === requested.spaceId && this.pathContains(granted.path, requested.path);
+    return granted.spaceId !== void 0 && requested.spaceId !== void 0 && this.spaceIdsEqual(granted.spaceId, requested.spaceId) && this.pathContains(granted.path, requested.path);
+  }
+  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. The embedded
+  // EIP-155 address is case-insensitive, but the CLI canonicalizes it to
+  // lowercase when building a space URI while stored runtime delegations keep
+  // the EIP-55 checksummed form — so a byte-for-byte compare spuriously rejects
+  // an otherwise-valid grant. Lowercase ONLY the `eip155:<chain>:0x<addr>`
+  // segment and leave everything else (crucially the case-sensitive space NAME)
+  // byte-exact. Mirrors the CLI's `normalizeSpaceForCompare` (OPENKEY_SCOPE_MISMATCH fix).
+  spaceIdsEqual(a, b) {
+    return this.normalizeSpaceAddress(a) === this.normalizeSpaceAddress(b);
+  }
+  normalizeSpaceAddress(space) {
+    return space.replace(
+      /(eip155:\d+:)(0x[0-9a-fA-F]{40})/,
+      (_match, prefix, addr) => prefix + addr.toLowerCase()
+    );
   }
   actionContains(grantedAction, requestedAction) {
     if (grantedAction === requestedAction) {
@@ -21708,6 +21725,32 @@ var FileSessionStorage = class {
 var import_sdk_core9 = require("@tinycloud/sdk-core");
 
 // src/delegation.ts
+async function grantAuthRequest(authority, request, options) {
+  if (request.kind !== "tinycloud.auth.request") {
+    throw new Error(
+      `grantAuthRequest expects a tinycloud.auth.request artifact, got "${request.kind}".`
+    );
+  }
+  if (!Array.isArray(request.requested) || request.requested.length === 0) {
+    throw new Error("grantAuthRequest request has no requested capabilities.");
+  }
+  const expiry = options?.expiry ?? request.requestedExpiry;
+  const result = await authority.delegateTo(
+    request.sessionDid,
+    request.requested,
+    expiry !== void 0 ? { expiry } : void 0
+  );
+  return {
+    kind: "tinycloud.auth.delegation",
+    version: 1,
+    requestId: request.requestId,
+    delegationCid: result.delegation.cid,
+    delegation: result.delegation,
+    permissions: request.requested,
+    expiry: result.delegation.expiry.toISOString(),
+    prompted: result.prompted
+  };
+}
 function serializeDelegation(delegation) {
   return JSON.stringify({
     ...delegation,
@@ -21838,6 +21881,7 @@ var import_sdk_core20 = require("@tinycloud/sdk-core");
   expandPermissionEntries,
   expandPermissionEntry,
   generateRandomReceiverKey,
+  grantAuthRequest,
   hexDecode,
   hexEncode,
   isCapabilitySubset,