@tinycloud/operations 0.3.4-beta.5 → 0.4.0-beta.7

package/dist/artifacts.d.cts

@@ -1,34 +1,9 @@
 import { PermissionEntry } from '@tinycloud/sdk-core';
 import { z } from 'zod';
+import { O as OperationSpaceResolver } from './authority-ofwbEqmj.cjs';
+export { e as evaluateAuthority } from './authority-ofwbEqmj.cjs';
 import { T as TinyCloudPosture, O as OperationOperatorType } from './contract-xMIIMtpF.cjs';
 
-/**
- * A capability in the canonical form persisted in a v1 request artifact.
- *
- * The SDK remains the semantic authority for containment. This module only
- * establishes deterministic exact identity for persistence and display.
- */
-type CanonicalPermissionEntry = Readonly<PermissionEntry>;
-interface AuthorityEvaluation {
-    readonly satisfied: boolean;
-    readonly missing: readonly CanonicalPermissionEntry[];
-}
-/**
- * Operation-owned space resolution. The SDK's general capability evaluator
- * intentionally preserves its historical short/full-space compatibility; the
- * operation kernel supplies this narrower resolver when a space identifies a
- * remote owner's resource.
- */
-type OperationSpaceResolver = (space: string) => string;
-/**
- * Evaluates required authority with the SDK's public subset primitive.
- *
- * In particular, this intentionally does not implement matching rules or
- * manufacture wildcards. A wildcard can cover a requirement only when it was
- * already present in the supplied granted authority and the SDK says so.
- */
-declare function evaluateAuthority(granted: readonly PermissionEntry[], required: readonly PermissionEntry[]): AuthorityEvaluation;
-
 /** The shared wire schema for SDK PermissionEntry values, including signed ReCap caveats. */
 declare const PermissionEntrySchema: z.ZodObject<{
     service: z.ZodString;
@@ -306,6 +281,88 @@ declare const DelegationImportArtifactSchema: z.ZodObject<{
     }[] | undefined;
     prompted?: boolean | undefined;
 }>;
+/**
+ * The stored request an imported delegation was checked against, persisted
+ * with the delegation. Its fields are exactly the request artifact's, so
+ * replay accepts every binding import can write.
+ */
+declare const DelegationRequestBindingSchema: z.ZodObject<Pick<{
+    kind: z.ZodLiteral<"tinycloud.auth.request">;
+    version: z.ZodLiteral<1>;
+    requestId: z.ZodString;
+    createdAt: z.ZodString;
+    profile: z.ZodString;
+    posture: z.ZodEnum<["owner-openkey", "delegate-session", "local-owner-key", "unauthenticated"]>;
+    operatorType: z.ZodEnum<["human", "agent"]>;
+    host: z.ZodString;
+    sessionDid: z.ZodString;
+    ownerDid: z.ZodOptional<z.ZodString>;
+    spaceId: z.ZodOptional<z.ZodString>;
+    requestedExpiry: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber]>>;
+    requested: z.ZodArray<z.ZodObject<{
+        service: z.ZodString;
+        space: z.ZodOptional<z.ZodString>;
+        path: z.ZodString;
+        actions: z.ZodArray<z.ZodString, "many">;
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        skipPrefix: z.ZodOptional<z.ZodBoolean>;
+        expiry: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        service: string;
+        path: string;
+        actions: string[];
+        space?: string | undefined;
+        caveats?: Record<string, unknown>[] | undefined;
+        skipPrefix?: boolean | undefined;
+        expiry?: string | undefined;
+        description?: string | undefined;
+    }, {
+        service: string;
+        path: string;
+        actions: string[];
+        space?: string | undefined;
+        caveats?: Record<string, unknown>[] | undefined;
+        skipPrefix?: boolean | undefined;
+        expiry?: string | undefined;
+        description?: string | undefined;
+    }>, "many">;
+    command: z.ZodOptional<z.ZodObject<{
+        argv: z.ZodArray<z.ZodString, "many">;
+        cwd: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        argv: string[];
+        cwd: string;
+    }, {
+        argv: string[];
+        cwd: string;
+    }>>;
+}, "requestId" | "requested">, "strict", z.ZodTypeAny, {
+    requestId: string;
+    requested: {
+        service: string;
+        path: string;
+        actions: string[];
+        space?: string | undefined;
+        caveats?: Record<string, unknown>[] | undefined;
+        skipPrefix?: boolean | undefined;
+        expiry?: string | undefined;
+        description?: string | undefined;
+    }[];
+}, {
+    requestId: string;
+    requested: {
+        service: string;
+        path: string;
+        actions: string[];
+        space?: string | undefined;
+        caveats?: Record<string, unknown>[] | undefined;
+        skipPrefix?: boolean | undefined;
+        expiry?: string | undefined;
+        description?: string | undefined;
+    }[];
+}>;
+type DelegationRequestBinding = z.infer<typeof DelegationRequestBindingSchema>;
 type PermissionRequestArtifact = z.infer<typeof PermissionRequestArtifactSchema>;
 type DelegationImportArtifact = z.infer<typeof DelegationImportArtifactSchema>;
 /** The minimal public node-sdk request shape accepted by the legacy reader. */
@@ -388,4 +445,4 @@ interface PrunePermissionRequestsInput {
 /** Pure retention policy used by the locked persistence operation. */
 declare function prunePermissionRequests(records: readonly PermissionRequestArtifact[], input: PrunePermissionRequestsInput): PermissionRequestArtifact[];
 
-export { type ArtifactClock, type BuildPermissionRequestArtifactInput, type CreateOrReusePermissionRequestInput, type DelegationImportArtifact, DelegationImportArtifactSchema, type LegacyPermissionRequestArtifact, type LegacyRequestContext, PermissionEntrySchema, type PermissionRequestArtifact, PermissionRequestArtifactSchema, type PermissionRequestIdentityInput, type PermissionRequestResolution, type PrunePermissionRequestsInput, type RequestIdSource, buildPermissionRequestArtifact, createOrReusePermissionRequest, createPermissionRequestIdentity, evaluateAuthority, findPermissionRequest, isDelegationImportArtifact, isPermissionRequestArtifact, listPermissionRequests, prunePermissionRequests, validateDelegationImportArtifact, validatePermissionRequestArtifact };
+export { type ArtifactClock, type BuildPermissionRequestArtifactInput, type CreateOrReusePermissionRequestInput, type DelegationImportArtifact, DelegationImportArtifactSchema, type DelegationRequestBinding, DelegationRequestBindingSchema, type LegacyPermissionRequestArtifact, type LegacyRequestContext, PermissionEntrySchema, type PermissionRequestArtifact, PermissionRequestArtifactSchema, type PermissionRequestIdentityInput, type PermissionRequestResolution, type PrunePermissionRequestsInput, type RequestIdSource, buildPermissionRequestArtifact, createOrReusePermissionRequest, createPermissionRequestIdentity, findPermissionRequest, isDelegationImportArtifact, isPermissionRequestArtifact, listPermissionRequests, prunePermissionRequests, validateDelegationImportArtifact, validatePermissionRequestArtifact };

package/dist/artifacts.d.ts

@@ -1,34 +1,9 @@
 import { PermissionEntry } from '@tinycloud/sdk-core';
 import { z } from 'zod';
+import { O as OperationSpaceResolver } from './authority-ofwbEqmj.js';
+export { e as evaluateAuthority } from './authority-ofwbEqmj.js';
 import { T as TinyCloudPosture, O as OperationOperatorType } from './contract-xMIIMtpF.js';
 
-/**
- * A capability in the canonical form persisted in a v1 request artifact.
- *
- * The SDK remains the semantic authority for containment. This module only
- * establishes deterministic exact identity for persistence and display.
- */
-type CanonicalPermissionEntry = Readonly<PermissionEntry>;
-interface AuthorityEvaluation {
-    readonly satisfied: boolean;
-    readonly missing: readonly CanonicalPermissionEntry[];
-}
-/**
- * Operation-owned space resolution. The SDK's general capability evaluator
- * intentionally preserves its historical short/full-space compatibility; the
- * operation kernel supplies this narrower resolver when a space identifies a
- * remote owner's resource.
- */
-type OperationSpaceResolver = (space: string) => string;
-/**
- * Evaluates required authority with the SDK's public subset primitive.
- *
- * In particular, this intentionally does not implement matching rules or
- * manufacture wildcards. A wildcard can cover a requirement only when it was
- * already present in the supplied granted authority and the SDK says so.
- */
-declare function evaluateAuthority(granted: readonly PermissionEntry[], required: readonly PermissionEntry[]): AuthorityEvaluation;
-
 /** The shared wire schema for SDK PermissionEntry values, including signed ReCap caveats. */
 declare const PermissionEntrySchema: z.ZodObject<{
     service: z.ZodString;
@@ -306,6 +281,88 @@ declare const DelegationImportArtifactSchema: z.ZodObject<{
     }[] | undefined;
     prompted?: boolean | undefined;
 }>;
+/**
+ * The stored request an imported delegation was checked against, persisted
+ * with the delegation. Its fields are exactly the request artifact's, so
+ * replay accepts every binding import can write.
+ */
+declare const DelegationRequestBindingSchema: z.ZodObject<Pick<{
+    kind: z.ZodLiteral<"tinycloud.auth.request">;
+    version: z.ZodLiteral<1>;
+    requestId: z.ZodString;
+    createdAt: z.ZodString;
+    profile: z.ZodString;
+    posture: z.ZodEnum<["owner-openkey", "delegate-session", "local-owner-key", "unauthenticated"]>;
+    operatorType: z.ZodEnum<["human", "agent"]>;
+    host: z.ZodString;
+    sessionDid: z.ZodString;
+    ownerDid: z.ZodOptional<z.ZodString>;
+    spaceId: z.ZodOptional<z.ZodString>;
+    requestedExpiry: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber]>>;
+    requested: z.ZodArray<z.ZodObject<{
+        service: z.ZodString;
+        space: z.ZodOptional<z.ZodString>;
+        path: z.ZodString;
+        actions: z.ZodArray<z.ZodString, "many">;
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        skipPrefix: z.ZodOptional<z.ZodBoolean>;
+        expiry: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        service: string;
+        path: string;
+        actions: string[];
+        space?: string | undefined;
+        caveats?: Record<string, unknown>[] | undefined;
+        skipPrefix?: boolean | undefined;
+        expiry?: string | undefined;
+        description?: string | undefined;
+    }, {
+        service: string;
+        path: string;
+        actions: string[];
+        space?: string | undefined;
+        caveats?: Record<string, unknown>[] | undefined;
+        skipPrefix?: boolean | undefined;
+        expiry?: string | undefined;
+        description?: string | undefined;
+    }>, "many">;
+    command: z.ZodOptional<z.ZodObject<{
+        argv: z.ZodArray<z.ZodString, "many">;
+        cwd: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        argv: string[];
+        cwd: string;
+    }, {
+        argv: string[];
+        cwd: string;
+    }>>;
+}, "requestId" | "requested">, "strict", z.ZodTypeAny, {
+    requestId: string;
+    requested: {
+        service: string;
+        path: string;
+        actions: string[];
+        space?: string | undefined;
+        caveats?: Record<string, unknown>[] | undefined;
+        skipPrefix?: boolean | undefined;
+        expiry?: string | undefined;
+        description?: string | undefined;
+    }[];
+}, {
+    requestId: string;
+    requested: {
+        service: string;
+        path: string;
+        actions: string[];
+        space?: string | undefined;
+        caveats?: Record<string, unknown>[] | undefined;
+        skipPrefix?: boolean | undefined;
+        expiry?: string | undefined;
+        description?: string | undefined;
+    }[];
+}>;
+type DelegationRequestBinding = z.infer<typeof DelegationRequestBindingSchema>;
 type PermissionRequestArtifact = z.infer<typeof PermissionRequestArtifactSchema>;
 type DelegationImportArtifact = z.infer<typeof DelegationImportArtifactSchema>;
 /** The minimal public node-sdk request shape accepted by the legacy reader. */
@@ -388,4 +445,4 @@ interface PrunePermissionRequestsInput {
 /** Pure retention policy used by the locked persistence operation. */
 declare function prunePermissionRequests(records: readonly PermissionRequestArtifact[], input: PrunePermissionRequestsInput): PermissionRequestArtifact[];
 
-export { type ArtifactClock, type BuildPermissionRequestArtifactInput, type CreateOrReusePermissionRequestInput, type DelegationImportArtifact, DelegationImportArtifactSchema, type LegacyPermissionRequestArtifact, type LegacyRequestContext, PermissionEntrySchema, type PermissionRequestArtifact, PermissionRequestArtifactSchema, type PermissionRequestIdentityInput, type PermissionRequestResolution, type PrunePermissionRequestsInput, type RequestIdSource, buildPermissionRequestArtifact, createOrReusePermissionRequest, createPermissionRequestIdentity, evaluateAuthority, findPermissionRequest, isDelegationImportArtifact, isPermissionRequestArtifact, listPermissionRequests, prunePermissionRequests, validateDelegationImportArtifact, validatePermissionRequestArtifact };
+export { type ArtifactClock, type BuildPermissionRequestArtifactInput, type CreateOrReusePermissionRequestInput, type DelegationImportArtifact, DelegationImportArtifactSchema, type DelegationRequestBinding, DelegationRequestBindingSchema, type LegacyPermissionRequestArtifact, type LegacyRequestContext, PermissionEntrySchema, type PermissionRequestArtifact, PermissionRequestArtifactSchema, type PermissionRequestIdentityInput, type PermissionRequestResolution, type PrunePermissionRequestsInput, type RequestIdSource, buildPermissionRequestArtifact, createOrReusePermissionRequest, createPermissionRequestIdentity, findPermissionRequest, isDelegationImportArtifact, isPermissionRequestArtifact, listPermissionRequests, prunePermissionRequests, validateDelegationImportArtifact, validatePermissionRequestArtifact };

package/dist/artifacts.js

@@ -6945,8 +6945,13 @@ var TEST_LOCK_CLAIM_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_CLAIM_BARRIER_DIR";
 var TEST_LOCK_CLAIMED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_CLAIMED_BARRIER_DIR";
 var TEST_LOCK_FENCED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_FENCED_BARRIER_DIR";
 var TEST_LOCK_VERIFIED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_VERIFIED_BARRIER_DIR";
-var invocationStateRoot = new AsyncLocalStorage();
-var heldProfileLocks = new AsyncLocalStorage();
+function processWideContext(key) {
+  var _a;
+  const registry = globalThis;
+  return registry[_a = Symbol.for(key)] ?? (registry[_a] = new AsyncLocalStorage());
+}
+var invocationStateRoot = processWideContext("tinycloud.operations.invocationStateRoot.v1");
+var heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v1");
 var ProfileLockTimeoutError = class extends Error {
   constructor(profile, timeoutMs) {
     super(`Timed out waiting for the profile lock for "${profile}" after ${timeoutMs}ms.`);
@@ -7310,6 +7315,7 @@ var DelegationImportArtifactSchema = z2.object({
   expiry: z2.string().datetime({ offset: true }).optional(),
   prompted: z2.boolean().optional()
 }).strict();
+var DelegationRequestBindingSchema = PermissionRequestArtifactSchema.pick({ requestId: true, requested: true }).strict();
 function validatePermissionRequestArtifact(value) {
   return PermissionRequestArtifactSchema.parse(value);
 }
@@ -7522,6 +7528,7 @@ function defaultRequestId(now) {
 }
 export {
   DelegationImportArtifactSchema,
+  DelegationRequestBindingSchema,
   PermissionEntrySchema,
   PermissionRequestArtifactSchema,
   buildPermissionRequestArtifact,