@tinycloud/node-sdk 2.6.4-beta.0 → 2.7.0-beta.2

package/dist/index.cjs

@@ -18697,6 +18697,22 @@ var ROOT_DELEGATION_ACTIONS = [
   import_sdk_core7.DUCKDB.ALL
 ];
 var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core7.EXPIRY.SESSION_MS;
+function decodeAuthorizationBytes(authorization) {
+  const encoded = authorization.replace(/^Bearer /i, "");
+  const match = /^([A-Za-z0-9_-]+)(={1,2})?$/.exec(encoded);
+  const unpadded = match?.[1];
+  const paddingLength = match?.[2]?.length ?? 0;
+  const remainder = unpadded === void 0 ? 1 : unpadded.length % 4;
+  const expectedPaddingLength = remainder === 2 ? 2 : remainder === 3 ? 1 : 0;
+  if (unpadded === void 0 || remainder === 1 || paddingLength !== 0 && paddingLength !== expectedPaddingLength) {
+    throw new Error("Delegation Authorization is not canonical base64url DAG-CBOR");
+  }
+  const decoded = Uint8Array.from(Buffer.from(unpadded, "base64url"));
+  if (Buffer.from(decoded).toString("base64url") !== unpadded) {
+    throw new Error("Delegation Authorization is not canonical base64url DAG-CBOR");
+  }
+  return decoded;
+}
 function isOpenKeyAutoSignStrategy(strategy) {
   return strategy?.openKeyAutoSign === true;
 }
@@ -18921,6 +18937,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       fetch: globalThis.fetch.bind(globalThis),
       keyProvider: this._keyProvider,
       registry: this._capabilityRegistry,
+      createDelegationWasm: (params) => this.createDelegationWrapper(params),
+      computeCid: (data, codec) => {
+        if (!this.wasmBindings.computeCid) throw new Error("computeCid is unavailable");
+        return this.wasmBindings.computeCid(data, codec);
+      },
       // delegationManager: undefined - not needed for receive()
       createKVService: (config2) => {
         const prefix = config2.pathPrefix?.replace(/\/$/, "");
@@ -20391,6 +20412,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       hosts: [this.config.host],
       session: serviceSession,
       invoke: this.invokeWithRuntimePermissions,
+      invokeAny: this.invokeAnyWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis)
     });
     this._spaceService = new import_sdk_core7.SpaceService({
@@ -20498,7 +20520,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegationCid: params.session.delegationCid,
       jwk: params.session.jwk,
       spaceId: params.session.spaceId,
-      verificationMethod: params.session.verificationMethod
+      // Session storage carries the verification method as a DID URL
+      // (`did:key:...#key-id`). The Rust UCAN builder expects the principal
+      // DID here and rejects the fragment as an invalid audience DID.
+      verificationMethod: params.session.verificationMethod.split("#", 1)[0]
     };
     const result = this.wasmBindings.createDelegation(
       wasmSession,
@@ -20525,56 +20550,69 @@ var _TinyCloudNode = class _TinyCloudNode {
    * with expiry longer than the current session.
    * @internal
    */
-  async createRootDelegationForSharing(params) {
-    if (!this.signer) {
-      return void 0;
+  async createOwnerDelegation(params) {
+    if (!params.delegateDid.startsWith("did:key:") || params.actions.length === 0 || params.path.length === 0) {
+      throw new Error("Owner delegation requires an external did:key audience and bounded capabilities");
     }
+    const now = /* @__PURE__ */ new Date();
+    if (params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > import_sdk_core7.EXPIRY.MAX_MS) {
+      throw new Error("Owner delegation expiry must be explicit, future, and within EXPIRY.MAX_MS");
+    }
+    if (!this.signer) throw new Error("Owner wallet signer is required");
     const session = this.currentTinyCloudSession();
-    if (!session) {
-      return void 0;
+    if (!session) throw new Error("Owner session is required");
+    const abilities = sharingActionsToAbilities(params.path, [...params.actions]);
+    if (!abilities) throw new Error("Owner delegation capabilities are unsupported");
+    const host = this.config.host;
+    const prepared = this.wasmBindings.prepareSession({
+      abilities,
+      address: this.wasmBindings.ensureEip55(session.address),
+      chainId: session.chainId,
+      domain: this.siweDomain,
+      issuedAt: now.toISOString(),
+      expirationTime: params.expiresAt.toISOString(),
+      spaceId: params.spaceId,
+      delegateUri: params.delegateDid
+    });
+    const signature2 = await this.signer.signMessage(prepared.siwe);
+    const delegationSession = this.wasmBindings.completeSessionSetup({ ...prepared, signature: signature2 });
+    const activation = await (0, import_sdk_core7.activateSessionWithHost)(host, delegationSession.delegationHeader);
+    if (!activation.success) {
+      throw new Error(`Owner delegation import failed: ${activation.status} ${activation.error ?? ""}`.trim());
     }
-    try {
-      const host = this.config.host;
-      const now = /* @__PURE__ */ new Date();
-      const abilities = sharingActionsToAbilities(params.path, params.actions);
-      if (!abilities) {
-        return void 0;
-      }
-      const prepared = this.wasmBindings.prepareSession({
-        abilities,
-        address: this.wasmBindings.ensureEip55(session.address),
-        chainId: session.chainId,
-        domain: this.siweDomain,
-        issuedAt: now.toISOString(),
-        expirationTime: params.requestedExpiry.toISOString(),
-        spaceId: params.spaceId,
-        delegateUri: params.shareKeyDID
-      });
-      const signature2 = await this.signer.signMessage(prepared.siwe);
-      const delegationSession = this.wasmBindings.completeSessionSetup({
-        ...prepared,
-        signature: signature2
-      });
-      const activateResult = await (0, import_sdk_core7.activateSessionWithHost)(
-        host,
-        delegationSession.delegationHeader
-      );
-      if (!activateResult.success) {
-        return void 0;
+    const delegation = {
+      cid: delegationSession.delegationCid,
+      delegateDID: params.delegateDid,
+      delegatorDID: (0, import_sdk_core7.pkhDid)(session.address, session.chainId),
+      spaceId: params.spaceId,
+      path: params.path,
+      actions: [...params.actions],
+      expiry: params.expiresAt,
+      isRevoked: false,
+      allowSubDelegation: true,
+      createdAt: now,
+      authHeader: delegationSession.delegationHeader.Authorization
+    };
+    return {
+      delegation,
+      signedDagCbor: decodeAuthorizationBytes(delegationSession.delegationHeader.Authorization),
+      delegationCid: delegationSession.delegationCid,
+      nodeReceipt: {
+        commitEventCid: activation.commitEventCid,
+        activated: activation.activated ?? [],
+        skipped: activation.skipped ?? []
       }
-      return {
-        cid: delegationSession.delegationCid,
-        delegateDID: params.shareKeyDID,
-        delegatorDID: (0, import_sdk_core7.pkhDid)(session.address, session.chainId),
+    };
+  }
+  async createRootDelegationForSharing(params) {
+    try {
+      return (await this.createOwnerDelegation({
+        delegateDid: params.shareKeyDID,
         spaceId: params.spaceId,
         path: params.path,
         actions: params.actions,
-        expiry: params.requestedExpiry,
-        isRevoked: false,
-        allowSubDelegation: true,
-        createdAt: now,
-        authHeader: delegationSession.delegationHeader.Authorization
-      };
+        expiresAt: params.requestedExpiry
+      })).delegation;
     } catch {
       return void 0;
     }
@@ -21342,6 +21380,20 @@ var _TinyCloudNode = class _TinyCloudNode {
   async revokeDelegation(cid) {
     return this.delegationManager.revoke(cid);
   }
+  /** Read node-confirmed lifecycle state for one delegation. */
+  async getDelegationStatus(cid) {
+    return this.delegationManager.status(cid);
+  }
+  /** Compute the canonical CID of a compact delegation authorization. */
+  computeDelegationCid(authorization) {
+    if (!authorization || !this.wasmBindings.computeCid) {
+      throw new Error("Delegation CID computation is unavailable");
+    }
+    return this.wasmBindings.computeCid(
+      new TextEncoder().encode(authorization),
+      0x55n
+    );
+  }
   /**
    * List all delegations for the current session's space.
    *