@tinycloud/node-sdk 2.6.4-beta.0 → 2.7.0-beta.2

package/dist/{core-BVk0VwGe.d.cts → core-BfqzTbfY.d.cts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -757,6 +757,26 @@ declare class DelegatedAccess {
  * ```
  */
 
+interface CreateOwnerDelegationParams {
+    readonly delegateDid: string;
+    readonly spaceId: string;
+    readonly path: string;
+    readonly actions: readonly string[];
+    readonly expiresAt: Date;
+}
+interface OwnerDelegationReceipt {
+    readonly delegation: Delegation;
+    /** Exact signed DAG-CBOR bytes submitted in the Authorization header. */
+    readonly signedDagCbor: Uint8Array;
+    /** Locally derived by the node WASM implementation; this is delegation identity. */
+    readonly delegationCid: string;
+    readonly nodeReceipt: {
+        /** Raw /delegate response CID: a commit-event id, not delegation identity. */
+        readonly commitEventCid?: string;
+        readonly activated: readonly string[];
+        readonly skipped: readonly string[];
+    };
+}
 /**
  * Configuration for TinyCloudNode.
  * All fields are optional - TinyCloudNode can work with zero configuration.
@@ -1351,6 +1371,7 @@ declare class TinyCloudNode {
      * with expiry longer than the current session.
      * @internal
      */
+    createOwnerDelegation(params: CreateOwnerDelegationParams): Promise<OwnerDelegationReceipt>;
     private createRootDelegationForSharing;
     /**
      * Track a received delegation in the capability registry.
@@ -1627,6 +1648,10 @@ declare class TinyCloudNode {
      * @returns Result indicating success or failure
      */
     revokeDelegation(cid: string): Promise<DelegationResult<void>>;
+    /** Read node-confirmed lifecycle state for one delegation. */
+    getDelegationStatus(cid: string): Promise<DelegationResult<DelegationStatus>>;
+    /** Compute the canonical CID of a compact delegation authorization. */
+    computeDelegationCid(authorization: string): string;
     /**
      * List all delegations for the current session's space.
      *
@@ -1956,4 +1981,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { type AuthDelegationArtifact as A, type DelegateToOptions as D, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type PortableDelegation as P, type RestorableSession as R, type SignStrategy as S, TinyCloudNode as T, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimePermissionGrantOptions as g, type TinyCloudNodeConfig as h, type WasmKeyProviderConfig as i, createWasmKeyProvider as j, defaultSignStrategy as k, deserializeDelegation as l, grantAuthRequest as m, serializeDelegation as s };
+export { type AuthDelegationArtifact as A, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SignStrategy as S, TinyCloudNode as T, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimePermissionGrantOptions as g, type TinyCloudNodeConfig as h, type WasmKeyProviderConfig as i, createWasmKeyProvider as j, defaultSignStrategy as k, deserializeDelegation as l, grantAuthRequest as m, serializeDelegation as s };

package/dist/{core-BVk0VwGe.d.ts → core-BfqzTbfY.d.ts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -757,6 +757,26 @@ declare class DelegatedAccess {
  * ```
  */
 
+interface CreateOwnerDelegationParams {
+    readonly delegateDid: string;
+    readonly spaceId: string;
+    readonly path: string;
+    readonly actions: readonly string[];
+    readonly expiresAt: Date;
+}
+interface OwnerDelegationReceipt {
+    readonly delegation: Delegation;
+    /** Exact signed DAG-CBOR bytes submitted in the Authorization header. */
+    readonly signedDagCbor: Uint8Array;
+    /** Locally derived by the node WASM implementation; this is delegation identity. */
+    readonly delegationCid: string;
+    readonly nodeReceipt: {
+        /** Raw /delegate response CID: a commit-event id, not delegation identity. */
+        readonly commitEventCid?: string;
+        readonly activated: readonly string[];
+        readonly skipped: readonly string[];
+    };
+}
 /**
  * Configuration for TinyCloudNode.
  * All fields are optional - TinyCloudNode can work with zero configuration.
@@ -1351,6 +1371,7 @@ declare class TinyCloudNode {
      * with expiry longer than the current session.
      * @internal
      */
+    createOwnerDelegation(params: CreateOwnerDelegationParams): Promise<OwnerDelegationReceipt>;
     private createRootDelegationForSharing;
     /**
      * Track a received delegation in the capability registry.
@@ -1627,6 +1648,10 @@ declare class TinyCloudNode {
      * @returns Result indicating success or failure
      */
     revokeDelegation(cid: string): Promise<DelegationResult<void>>;
+    /** Read node-confirmed lifecycle state for one delegation. */
+    getDelegationStatus(cid: string): Promise<DelegationResult<DelegationStatus>>;
+    /** Compute the canonical CID of a compact delegation authorization. */
+    computeDelegationCid(authorization: string): string;
     /**
      * List all delegations for the current session's space.
      *
@@ -1956,4 +1981,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { type AuthDelegationArtifact as A, type DelegateToOptions as D, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type PortableDelegation as P, type RestorableSession as R, type SignStrategy as S, TinyCloudNode as T, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimePermissionGrantOptions as g, type TinyCloudNodeConfig as h, type WasmKeyProviderConfig as i, createWasmKeyProvider as j, defaultSignStrategy as k, deserializeDelegation as l, grantAuthRequest as m, serializeDelegation as s };
+export { type AuthDelegationArtifact as A, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SignStrategy as S, TinyCloudNode as T, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimePermissionGrantOptions as g, type TinyCloudNodeConfig as h, type WasmKeyProviderConfig as i, createWasmKeyProvider as j, defaultSignStrategy as k, deserializeDelegation as l, grantAuthRequest as m, serializeDelegation as s };

package/dist/core.cjs

@@ -1680,6 +1680,22 @@ var ROOT_DELEGATION_ACTIONS = [
   import_sdk_core8.DUCKDB.ALL
 ];
 var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core8.EXPIRY.SESSION_MS;
+function decodeAuthorizationBytes(authorization) {
+  const encoded = authorization.replace(/^Bearer /i, "");
+  const match = /^([A-Za-z0-9_-]+)(={1,2})?$/.exec(encoded);
+  const unpadded = match?.[1];
+  const paddingLength = match?.[2]?.length ?? 0;
+  const remainder = unpadded === void 0 ? 1 : unpadded.length % 4;
+  const expectedPaddingLength = remainder === 2 ? 2 : remainder === 3 ? 1 : 0;
+  if (unpadded === void 0 || remainder === 1 || paddingLength !== 0 && paddingLength !== expectedPaddingLength) {
+    throw new Error("Delegation Authorization is not canonical base64url DAG-CBOR");
+  }
+  const decoded = Uint8Array.from(Buffer.from(unpadded, "base64url"));
+  if (Buffer.from(decoded).toString("base64url") !== unpadded) {
+    throw new Error("Delegation Authorization is not canonical base64url DAG-CBOR");
+  }
+  return decoded;
+}
 function isOpenKeyAutoSignStrategy(strategy) {
   return strategy?.openKeyAutoSign === true;
 }
@@ -1904,6 +1920,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       fetch: globalThis.fetch.bind(globalThis),
       keyProvider: this._keyProvider,
       registry: this._capabilityRegistry,
+      createDelegationWasm: (params) => this.createDelegationWrapper(params),
+      computeCid: (data, codec) => {
+        if (!this.wasmBindings.computeCid) throw new Error("computeCid is unavailable");
+        return this.wasmBindings.computeCid(data, codec);
+      },
       // delegationManager: undefined - not needed for receive()
       createKVService: (config2) => {
         const prefix = config2.pathPrefix?.replace(/\/$/, "");
@@ -3374,6 +3395,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       hosts: [this.config.host],
       session: serviceSession,
       invoke: this.invokeWithRuntimePermissions,
+      invokeAny: this.invokeAnyWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis)
     });
     this._spaceService = new import_sdk_core8.SpaceService({
@@ -3481,7 +3503,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegationCid: params.session.delegationCid,
       jwk: params.session.jwk,
       spaceId: params.session.spaceId,
-      verificationMethod: params.session.verificationMethod
+      // Session storage carries the verification method as a DID URL
+      // (`did:key:...#key-id`). The Rust UCAN builder expects the principal
+      // DID here and rejects the fragment as an invalid audience DID.
+      verificationMethod: params.session.verificationMethod.split("#", 1)[0]
     };
     const result = this.wasmBindings.createDelegation(
       wasmSession,
@@ -3508,56 +3533,69 @@ var _TinyCloudNode = class _TinyCloudNode {
    * with expiry longer than the current session.
    * @internal
    */
-  async createRootDelegationForSharing(params) {
-    if (!this.signer) {
-      return void 0;
+  async createOwnerDelegation(params) {
+    if (!params.delegateDid.startsWith("did:key:") || params.actions.length === 0 || params.path.length === 0) {
+      throw new Error("Owner delegation requires an external did:key audience and bounded capabilities");
     }
+    const now = /* @__PURE__ */ new Date();
+    if (params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > import_sdk_core8.EXPIRY.MAX_MS) {
+      throw new Error("Owner delegation expiry must be explicit, future, and within EXPIRY.MAX_MS");
+    }
+    if (!this.signer) throw new Error("Owner wallet signer is required");
     const session = this.currentTinyCloudSession();
-    if (!session) {
-      return void 0;
+    if (!session) throw new Error("Owner session is required");
+    const abilities = sharingActionsToAbilities(params.path, [...params.actions]);
+    if (!abilities) throw new Error("Owner delegation capabilities are unsupported");
+    const host = this.config.host;
+    const prepared = this.wasmBindings.prepareSession({
+      abilities,
+      address: this.wasmBindings.ensureEip55(session.address),
+      chainId: session.chainId,
+      domain: this.siweDomain,
+      issuedAt: now.toISOString(),
+      expirationTime: params.expiresAt.toISOString(),
+      spaceId: params.spaceId,
+      delegateUri: params.delegateDid
+    });
+    const signature = await this.signer.signMessage(prepared.siwe);
+    const delegationSession = this.wasmBindings.completeSessionSetup({ ...prepared, signature });
+    const activation = await (0, import_sdk_core8.activateSessionWithHost)(host, delegationSession.delegationHeader);
+    if (!activation.success) {
+      throw new Error(`Owner delegation import failed: ${activation.status} ${activation.error ?? ""}`.trim());
     }
-    try {
-      const host = this.config.host;
-      const now = /* @__PURE__ */ new Date();
-      const abilities = sharingActionsToAbilities(params.path, params.actions);
-      if (!abilities) {
-        return void 0;
-      }
-      const prepared = this.wasmBindings.prepareSession({
-        abilities,
-        address: this.wasmBindings.ensureEip55(session.address),
-        chainId: session.chainId,
-        domain: this.siweDomain,
-        issuedAt: now.toISOString(),
-        expirationTime: params.requestedExpiry.toISOString(),
-        spaceId: params.spaceId,
-        delegateUri: params.shareKeyDID
-      });
-      const signature = await this.signer.signMessage(prepared.siwe);
-      const delegationSession = this.wasmBindings.completeSessionSetup({
-        ...prepared,
-        signature
-      });
-      const activateResult = await (0, import_sdk_core8.activateSessionWithHost)(
-        host,
-        delegationSession.delegationHeader
-      );
-      if (!activateResult.success) {
-        return void 0;
+    const delegation = {
+      cid: delegationSession.delegationCid,
+      delegateDID: params.delegateDid,
+      delegatorDID: (0, import_sdk_core8.pkhDid)(session.address, session.chainId),
+      spaceId: params.spaceId,
+      path: params.path,
+      actions: [...params.actions],
+      expiry: params.expiresAt,
+      isRevoked: false,
+      allowSubDelegation: true,
+      createdAt: now,
+      authHeader: delegationSession.delegationHeader.Authorization
+    };
+    return {
+      delegation,
+      signedDagCbor: decodeAuthorizationBytes(delegationSession.delegationHeader.Authorization),
+      delegationCid: delegationSession.delegationCid,
+      nodeReceipt: {
+        commitEventCid: activation.commitEventCid,
+        activated: activation.activated ?? [],
+        skipped: activation.skipped ?? []
       }
-      return {
-        cid: delegationSession.delegationCid,
-        delegateDID: params.shareKeyDID,
-        delegatorDID: (0, import_sdk_core8.pkhDid)(session.address, session.chainId),
+    };
+  }
+  async createRootDelegationForSharing(params) {
+    try {
+      return (await this.createOwnerDelegation({
+        delegateDid: params.shareKeyDID,
         spaceId: params.spaceId,
         path: params.path,
         actions: params.actions,
-        expiry: params.requestedExpiry,
-        isRevoked: false,
-        allowSubDelegation: true,
-        createdAt: now,
-        authHeader: delegationSession.delegationHeader.Authorization
-      };
+        expiresAt: params.requestedExpiry
+      })).delegation;
     } catch {
       return void 0;
     }
@@ -4325,6 +4363,20 @@ var _TinyCloudNode = class _TinyCloudNode {
   async revokeDelegation(cid) {
     return this.delegationManager.revoke(cid);
   }
+  /** Read node-confirmed lifecycle state for one delegation. */
+  async getDelegationStatus(cid) {
+    return this.delegationManager.status(cid);
+  }
+  /** Compute the canonical CID of a compact delegation authorization. */
+  computeDelegationCid(authorization) {
+    if (!authorization || !this.wasmBindings.computeCid) {
+      throw new Error("Delegation CID computation is unavailable");
+    }
+    return this.wasmBindings.computeCid(
+      new TextEncoder().encode(authorization),
+      0x55n
+    );
+  }
   /**
    * List all delegations for the current session's space.
    *