@tinycloud/node-sdk 2.4.0 → 2.5.0-beta.1

package/dist/index.cjs

@@ -17722,7 +17722,7 @@ var NodeUserAuthorization = class {
    * Create the space on the TinyCloud server (host delegation).
    * This registers the user as the owner of the space.
    */
-  async hostSpace(targetSpaceId) {
+  async hostSpace(targetSpaceId, purpose) {
     if (!this._tinyCloudSession || !this._address || !this._chainId) {
       throw new Error("Must be signed in to host space");
     }
@@ -17738,7 +17738,7 @@ var NodeUserAuthorization = class {
       spaceId,
       peerId
     });
-    const signature2 = await this.signMessage(siwe);
+    const signature2 = await this.signMessage(siwe, purpose);
     const headers = this.wasm.siweToDelegationHeaders({ siwe, signature: signature2 });
     const result = await (0, import_sdk_core2.submitHostDelegation)(host, headers);
     return result.success;
@@ -17754,8 +17754,8 @@ var NodeUserAuthorization = class {
    * Create a specific owned space on the server via host delegation.
    * Used by manifest registry setup for the account space.
    */
-  async hostOwnedSpace(spaceId) {
-    return this.hostSpace(spaceId);
+  async hostOwnedSpace(spaceId, purpose) {
+    return this.hostSpace(spaceId, purpose);
   }
   /**
    * Ensure the user's space exists on the TinyCloud server.
@@ -17905,7 +17905,8 @@ var NodeUserAuthorization = class {
       address,
       chainId,
       message: prepared.siwe,
-      type: "siwe"
+      type: "siwe",
+      purpose: "bootstrap-session"
     });
     const session = this.wasm.completeSessionSetup({
       ...prepared,
@@ -17969,7 +17970,8 @@ var NodeUserAuthorization = class {
       address,
       chainId,
       message: prepared.siwe,
-      type: "siwe"
+      type: "siwe",
+      purpose: "sign-in"
     });
     const session = this.wasm.completeSessionSetup({
       ...prepared,
@@ -18057,7 +18059,7 @@ var NodeUserAuthorization = class {
   /**
    * Sign a message with the connected signer.
    */
-  async signMessage(message) {
+  async signMessage(message, purpose) {
     if (!this._address) {
       this._address = (0, import_sdk_core2.canonicalizeAddress)(await this.signer.getAddress());
     }
@@ -18068,7 +18070,8 @@ var NodeUserAuthorization = class {
       address: this._address,
       chainId: this._chainId,
       message,
-      type: "message"
+      type: "message",
+      ...purpose ? { purpose } : {}
     });
   }
   /**
@@ -18540,12 +18543,12 @@ function displayActionUrn(action) {
 function secretActionName(action) {
   return action;
 }
-function secretPermissionEntries(name, options, action, encryptionNetworkId) {
+function secretPermissionEntries(name, options, action, space, encryptionNetworkId) {
   const entries = [];
   const path = action === "list" ? (0, import_sdk_core6.resolveSecretListPrefix)(options) : (0, import_sdk_core6.resolveSecretPath)(name, options).permissionPaths.vault;
   entries.push({
     service: "tinycloud.kv",
-    space: SECRETS_SPACE,
+    space,
     path,
     actions: [secretActionName(action)],
     skipPrefix: true
@@ -18560,11 +18563,23 @@ function secretPermissionEntries(name, options, action, encryptionNetworkId) {
   }
   return entries;
 }
+function normalizeSpace(space, resolveSpace) {
+  if (!space) return void 0;
+  if (space.startsWith("tinycloud:")) return space;
+  return resolveSpace?.(space) ?? space;
+}
+function spaceMatches(granted, requested, resolveSpace) {
+  if (!granted || !requested) return false;
+  return normalizeSpace(granted, resolveSpace) === normalizeSpace(requested, resolveSpace);
+}
 var NodeSecretsService = class {
   constructor(config) {
     this.config = config;
     this.shouldRestoreUnlock = false;
   }
+  get space() {
+    return this.config.space ?? SECRETS_SPACE;
+  }
   get vault() {
     return this.service.vault;
   }
@@ -18617,6 +18632,7 @@ var NodeSecretsService = class {
         name,
         options,
         action,
+        this.space,
         action === "get" ? this.config.getEncryptionNetworkId?.() : void 0
       );
     } catch (error) {
@@ -18666,7 +18682,7 @@ var NodeSecretsService = class {
       (entry) => manifests.some((candidate) => {
         const resolved = (0, import_sdk_core6.resolveManifest)(candidate);
         return resolved.resources.some(
-          (resource) => resource.service === entry.service && resource.space === entry.space && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
+          (resource) => resource.service === entry.service && spaceMatches(resource.space, entry.space, this.config.resolveSpace) && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
         );
       })
     );
@@ -18683,6 +18699,15 @@ var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core7.EXPIRY.SESSION_MS;
 function isOpenKeyAutoSignStrategy(strategy) {
   return strategy?.openKeyAutoSign === true;
 }
+function isInteractiveSigner(config) {
+  if (config.privateKey) {
+    return false;
+  }
+  if (isOpenKeyAutoSignStrategy(config.signStrategy)) {
+    return false;
+  }
+  return config.signer !== void 0;
+}
 function didPrincipalMatches2(actual, expected) {
   try {
     return (0, import_sdk_core7.principalDidEquals)(actual, expected);
@@ -18690,6 +18715,20 @@ function didPrincipalMatches2(actual, expected) {
     return actual === expected;
   }
 }
+function sharingActionsToAbilities(path, actions) {
+  var _a;
+  const abilities = {};
+  for (const action of actions) {
+    const slash = action.indexOf("/");
+    if (slash === -1) return void 0;
+    const shortService = import_sdk_core7.SERVICE_LONG_TO_SHORT[action.slice(0, slash)];
+    if (shortService === void 0) return void 0;
+    abilities[shortService] ?? (abilities[shortService] = {});
+    (_a = abilities[shortService])[path] ?? (_a[path] = []);
+    abilities[shortService][path].push(action);
+  }
+  return Object.keys(abilities).length > 0 ? abilities : void 0;
+}
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
@@ -18802,7 +18841,24 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.auth = null;
     this.tc = null;
     this._chainId = 1;
+    this._baseSecrets = /* @__PURE__ */ new Map();
+    this._secrets = /* @__PURE__ */ new Map();
     this.runtimePermissionGrants = [];
+    /**
+     * True when the last signIn() detected an interactive signer and skipped
+     * client-side bootstrap. Apps can read this to know whether bootstrap was
+     * deferred to the server (OpenKey) or requires a separate user action.
+     */
+    this._bootstrapSkipped = false;
+    /**
+     * Outcome of the last signIn()'s account-bootstrap attempt. `skipped` is
+     * true when bootstrap did not complete (interactive signer, auto-sign
+     * denied, or a bootstrap step failed); `reason` carries the cause so apps
+     * can surface a "finish account setup" call-to-action.
+     */
+    this._bootstrapStatus = {
+      skipped: false
+    };
     this.invokeWithRuntimePermissions = (session, service, path, action, facts) => {
       return this.wasmBindings.invoke(
         this.selectInvocationSession(session, service, path, action),
@@ -18895,6 +18951,15 @@ var _TinyCloudNode = class _TinyCloudNode {
   static registerNodeDefaults(defaults) {
     _TinyCloudNode.nodeDefaults = defaults;
   }
+  /** Whether the last signIn() skipped client-side bootstrap because the
+   * signer is interactive (browser wallet / EIP-1193 provider). */
+  get bootstrapSkipped() {
+    return this._bootstrapSkipped;
+  }
+  /** Outcome of the last signIn()'s account-bootstrap attempt. */
+  get bootstrapStatus() {
+    return this._bootstrapStatus;
+  }
   get nodeFeatures() {
     return this.auth?.nodeFeatures ?? [];
   }
@@ -19064,6 +19129,13 @@ var _TinyCloudNode = class _TinyCloudNode {
   get session() {
     return this.auth?.tinyCloudSession;
   }
+  /**
+   * Get the currently active session in the shape callers can persist and later
+   * pass back to {@link restoreSession}.
+   */
+  get restorableSession() {
+    return this.currentTinyCloudSession();
+  }
   /**
    * Sign in and create a new session.
    * This creates the user's space if it doesn't exist.
@@ -19086,8 +19158,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._hooks = void 0;
     this._vault = void 0;
     this._encryption = void 0;
-    this._baseSecrets = void 0;
-    this._secrets = void 0;
+    this._baseSecrets.clear();
+    this._secrets.clear();
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
@@ -19111,17 +19183,38 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this.wasmBindings.makeSpaceId(this._address, this._chainId, name);
   }
   async bootstrapAccountIfNeeded() {
+    this._bootstrapSkipped = false;
+    this._bootstrapStatus = { skipped: false };
     if (this.config.autoBootstrapAccount === false) {
       return false;
     }
     if (!this.auth || !this._address) {
       return false;
     }
+    if (isInteractiveSigner(this.config)) {
+      console.debug(
+        "[TinyCloudNode] bootstrap skipped: interactive signer detected. Server-side bootstrap (OpenKey) is expected to have provisioned the account."
+      );
+      this._bootstrapSkipped = true;
+      this._bootstrapStatus = { skipped: true, reason: "interactive-signer" };
+      return false;
+    }
     const steps = (0, import_sdk_core7.bootstrapSteps)(this._address, this._chainId);
     if (!await this.isFreshBootstrapAccount(steps)) {
       return false;
     }
-    await this.runAccountBootstrap(steps);
+    try {
+      await this.runAccountBootstrap(steps);
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      this._bootstrapSkipped = true;
+      this._bootstrapStatus = { skipped: true, reason };
+      this.notificationHandler.warning(
+        `Account bootstrap did not complete: ${reason}`
+      );
+      console.warn(`[TinyCloudNode] account bootstrap failed: ${reason}`);
+      return false;
+    }
     return true;
   }
   async isFreshBootstrapAccount(steps) {
@@ -19173,16 +19266,23 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (rawAbilities) {
         rawAbilitiesBySpace.set(step.space, rawAbilities);
       }
-      const session = await auth.createBootstrapSession({
-        spaceId: step.spaceId,
-        capabilityRequest: step.request ?? import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS[step.space],
-        rawAbilities
-      });
+      let session;
+      try {
+        session = await auth.createBootstrapSession({
+          spaceId: step.spaceId,
+          capabilityRequest: step.request ?? import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS[step.space],
+          rawAbilities
+        });
+      } catch (err) {
+        throw new Error(
+          `Account bootstrap aborted: signature rejected for space "${step.space}". Cause: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
       sessions.set(step.space, session);
     }
     for (const step of steps) {
       if (step.kind !== "host") continue;
-      const hosted = await auth.hostOwnedSpace(step.spaceId);
+      const hosted = await auth.hostOwnedSpace(step.spaceId, "bootstrap-host");
       if (!hosted) {
         throw new Error(`Failed to host bootstrap space: ${step.spaceId}`);
       }
@@ -19573,8 +19673,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._hooks = void 0;
     this._vault = void 0;
     this._encryption = void 0;
-    this._baseSecrets = void 0;
-    this._secrets = void 0;
+    this._baseSecrets.clear();
+    this._secrets.clear();
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
@@ -19864,6 +19964,20 @@ var _TinyCloudNode = class _TinyCloudNode {
   getDefaultEncryptionNetworkId(name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
     return `urn:tinycloud:encryption:${this.did}:${name}`;
   }
+  getEncryptionNetworkIdForSpace(spaceId, name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
+    const ownerDid = this.ownerDidFromSpaceId(spaceId) ?? this.did;
+    return `urn:tinycloud:encryption:${ownerDid}:${name}`;
+  }
+  ownerDidFromSpaceId(spaceId) {
+    if (!spaceId.startsWith("tinycloud:")) return void 0;
+    const body = spaceId.slice("tinycloud:".length);
+    const lastSeparator = body.lastIndexOf(":");
+    if (lastSeparator <= 0) return void 0;
+    const owner = body.slice(0, lastSeparator);
+    if (owner.startsWith("did:")) return owner;
+    if (!owner.includes(":")) return void 0;
+    return `did:${owner}`;
+  }
   requireServiceSession() {
     const session = this._serviceContext?.session;
     if (!session) {
@@ -20051,7 +20165,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       spaceId,
       crypto: vaultCrypto,
       encryption: {
-        networkId: this.getDefaultEncryptionNetworkId(),
+        networkId: this.getEncryptionNetworkIdForSpace(spaceId),
         service: this.getEncryptionService(),
         decryptCapabilityProof: () => ({
           proofs: [this.requireServiceSession().delegationCid]
@@ -20182,6 +20296,9 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
         return vaultService;
       },
+      createSecretsService: (spaceId) => {
+        return this.secretsForSpace(spaceId);
+      },
       // Enable space.delegations.create() via SIWE-based delegation
       createDelegation: async (params) => {
         try {
@@ -20304,11 +20421,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     try {
       const host = this.config.host;
       const now = /* @__PURE__ */ new Date();
-      const abilities = {
-        kv: {
-          [params.path]: params.actions
-        }
-      };
+      const abilities = sharingActionsToAbilities(params.path, params.actions);
+      if (!abilities) {
+        return void 0;
+      }
       const prepared = this.wasmBindings.prepareSession({
         abilities,
         address: this.wasmBindings.ensureEip55(session.address),
@@ -20564,27 +20680,49 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._spaceService) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    if (!this._secrets) {
-      this._secrets = new NodeSecretsService({
-        getService: () => this.getBaseSecrets(),
+    return this.secretsForSpace("secrets");
+  }
+  /**
+   * App-facing secrets API backed by the requested space's vault.
+   */
+  secretsForSpace(spaceId) {
+    if (!this._spaceService) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    const resolvedSpace = spaceId.startsWith("tinycloud:") ? spaceId : this.ownedSpaceId(spaceId);
+    let secrets = this._secrets.get(resolvedSpace);
+    if (!secrets) {
+      secrets = new NodeSecretsService({
+        getService: () => this.getBaseSecrets(resolvedSpace),
+        space: resolvedSpace,
         getManifest: () => this.manifest,
         hasPermissions: (permissions) => this.hasRuntimePermissions(permissions),
         grantPermissions: (additional) => this.grantRuntimePermissions(additional),
         canEscalate: () => this.signer !== void 0 && this.tc !== void 0,
-        getEncryptionNetworkId: () => this.getDefaultEncryptionNetworkId(),
+        getEncryptionNetworkId: () => this.getEncryptionNetworkIdForSpace(resolvedSpace),
+        resolveSpace: (space) => space.startsWith("tinycloud:") ? space : this.ownedSpaceId(space),
         getUnlockSigner: () => this.signer ?? void 0
       });
+      this._secrets.set(resolvedSpace, secrets);
     }
-    return this._secrets;
+    return secrets;
   }
-  getBaseSecrets() {
+  getBaseSecrets(spaceId) {
     if (!this._spaceService) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    if (!this._baseSecrets) {
-      this._baseSecrets = new import_sdk_core7.SecretsService(() => this.space("secrets").vault);
+    const resolvedSpace = spaceId.startsWith("tinycloud:") ? spaceId : this.ownedSpaceId(spaceId);
+    let secrets = this._baseSecrets.get(resolvedSpace);
+    if (!secrets) {
+      const kvService = this.createSpaceScopedKVService(resolvedSpace);
+      const vaultService = this.createVaultService(resolvedSpace, kvService);
+      if (this._serviceContext) {
+        vaultService.initialize(this._serviceContext);
+      }
+      secrets = new import_sdk_core7.SecretsService(() => vaultService);
+      this._baseSecrets.set(resolvedSpace, secrets);
     }
-    return this._baseSecrets;
+    return secrets;
   }
   /**
    * Hooks write stream subscription API.