@tinycloud/operations 0.5.0-beta.1 → 0.5.0-beta.3

package/dist/secret-request.js

@@ -0,0 +1,222 @@
+// src/secret-request.ts
+import * as nodeSdk from "@tinycloud/node-sdk";
+var SECRET_MANAGER_ORIGIN = "https://secrets.tinycloud.xyz";
+var SECRET_REQUEST_MAX_NAMES = 10;
+var SECRET_REQUEST_MAX_URL_LENGTH = 8192;
+var OWNER_RE = /^did:pkh:eip155:([1-9][0-9]*):(0x[0-9a-fA-F]{40})$/;
+var NAME_RE = /^[A-Z][A-Z0-9_]*$/;
+var MAX_NAME_LENGTH = 64;
+var SCOPE_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var MAX_SCOPE_LENGTH = 64;
+var RESERVED_SCOPES = ["default", "global", "scoped"];
+var MAX_REQUESTER_LENGTH = 64;
+var CONTROL_OR_FORMAT = /[\p{Cc}\p{Cf}]/u;
+var STATE_RE = /^[A-Za-z0-9._~-]{1,128}$/;
+var MAX_RETURN_TO_LENGTH = 2048;
+var RETURN_TO_ORIGINS = ["https://feed.tinycloud.xyz"];
+var RETURN_TO_PREVIEW = /^https:\/\/[a-z0-9-]+\.tinyfeed\.pages\.dev$/;
+var PKH_SPACE_RE = /^tinycloud:pkh:eip155:([1-9][0-9]*):(0x[0-9a-fA-F]{40}):[^:]+$/;
+var SecretRequestInputError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "SecretRequestInputError";
+    this.code = code;
+  }
+};
+function canonicalSecretRequestOwner(did) {
+  const match = typeof did === "string" ? OWNER_RE.exec(did) : null;
+  if (match === null || !Number.isSafeInteger(Number(match[1]))) throw invalidOwner();
+  const address = match[2];
+  let checksummed;
+  try {
+    checksummed = nodeSdk.canonicalizeAddress(address);
+  } catch {
+    throw invalidOwner();
+  }
+  if (/[A-F]/.test(address.slice(2)) && address !== checksummed) throw invalidOwner();
+  return `did:pkh:eip155:${match[1]}:${checksummed}`;
+}
+function buildSecretRequestUrl(input) {
+  const owner = canonicalSecretRequestOwner(input.owner);
+  const names = validSecretNames(input.names);
+  if (input.scope !== void 0) assertSecretRequestScope(input.scope);
+  const requester = input.requester;
+  if (requester !== void 0 && (typeof requester !== "string" || requester.length === 0 || requester.length > MAX_REQUESTER_LENGTH || CONTROL_OR_FORMAT.test(requester))) {
+    throw new SecretRequestInputError("INVALID_REQUESTER", "The requester label must be 1-64 characters with no control or format characters.");
+  }
+  if (input.returnTo !== void 0 && !isAllowedReturnTo(input.returnTo)) {
+    throw new SecretRequestInputError("INVALID_RETURN_TO", "The return address is not an allowed Secret Manager callback.");
+  }
+  if (input.state !== void 0 && !STATE_RE.test(input.state)) {
+    throw new SecretRequestInputError("INVALID_STATE", "The state must be 1-128 characters of A-Z, a-z, 0-9, '.', '_', '~' or '-'.");
+  }
+  const parameters = [
+    ["owner", owner],
+    ...names.map((name) => ["name", name]),
+    ...input.scope === void 0 ? [] : [["scope", input.scope]],
+    ...input.requester === void 0 ? [] : [["requester", input.requester]],
+    ...input.returnTo === void 0 ? [] : [["return_to", input.returnTo]],
+    ...input.state === void 0 ? [] : [["state", input.state]],
+    ["v", "1"]
+  ];
+  const url = `${SECRET_MANAGER_ORIGIN}/request?${parameters.map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join("&")}`;
+  if (url.length > SECRET_REQUEST_MAX_URL_LENGTH) {
+    throw new SecretRequestInputError("REQUEST_LINK_TOO_LONG", `The request link is longer than ${SECRET_REQUEST_MAX_URL_LENGTH} characters.`);
+  }
+  return { url, owner, names, ...input.scope === void 0 ? {} : { scope: input.scope } };
+}
+function secretSetupFor(link) {
+  return {
+    url: link.url,
+    names: [...link.names],
+    ...link.scope === void 0 ? {} : { scope: link.scope },
+    owner: link.owner,
+    action: "add_secret"
+  };
+}
+function buildSecretManagerUrl(input = {}) {
+  const names = dedupe(input.names ?? []);
+  for (const name of names) assertSecretName(name);
+  if (input.scope !== void 0) assertSecretRequestScope(input.scope);
+  const parameters = [
+    ...names.length === 1 ? [["secret", names[0]]] : [],
+    ...names.length > 1 ? [["secrets", names.join(",")]] : [],
+    ...input.scope === void 0 ? [] : [["scope", input.scope]]
+  ];
+  const query = parameters.map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join("&");
+  return `${SECRET_MANAGER_ORIGIN}/app${query === "" ? "" : `?${query}`}`;
+}
+function resolveSecretsOwner(profile, requestedOwner) {
+  const resolved = profile.local ? ownerOrUndefined(profile.principalDid) : ownerOrUndefined(profile.ownerDid) ?? (profile.posture === "delegate-session" ? ownerOfSpace(profile.space) : void 0) ?? ownerOrUndefined(profile.principalDid);
+  const requested = requestedOwner === void 0 ? void 0 : ownerOrUndefined(requestedOwner);
+  if (resolved !== void 0) {
+    if (requestedOwner !== void 0 && requested !== resolved) {
+      return {
+        ok: false,
+        code: "OWNER_MISMATCH",
+        message: "The requested owner is not the owner of this identity's secrets."
+      };
+    }
+    return { ok: true, owner: resolved, local: profile.local };
+  }
+  if (requested !== void 0 && !profile.local) return { ok: true, owner: requested, local: false };
+  return {
+    ok: false,
+    code: "OWNER_DID_UNKNOWN",
+    message: "The owner of this identity's secrets is unknown. Pass the owner's did:pkh with --owner."
+  };
+}
+function missingSecretRecovery(input) {
+  if (input.local) {
+    return { kind: "put_locally", hint: `Store it with: ${putCommands(input.names, input.scope)}` };
+  }
+  if (input.owner !== void 0) {
+    try {
+      return {
+        kind: "add_secret",
+        setup: secretSetupFor(buildSecretRequestUrl({
+          owner: input.owner,
+          names: input.names,
+          ...input.scope === void 0 ? {} : { scope: input.scope }
+        }))
+      };
+    } catch {
+    }
+  }
+  return {
+    kind: "not_requestable",
+    hint: `No Secret Manager request link can express this secret. The owner can store it with: ${putCommands(input.names, input.scope)}`
+  };
+}
+function isSafeRequestAccessRecovery(value, deniedNames) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const record = value;
+  const keys = Object.keys(record);
+  if (!keys.every((key) => key === "action" || key === "names" || key === "owner" || key === "scope")) return false;
+  if (record.action !== "request_access") return false;
+  const names = record.names;
+  if (!Array.isArray(names) || names.length === 0 || names.length > SECRET_REQUEST_MAX_NAMES || new Set(names).size !== names.length || !names.every((name) => typeof name === "string" && isValidSecretName(name) && deniedNames.includes(name))) {
+    return false;
+  }
+  if (typeof record.owner !== "string" || ownerOrUndefined(record.owner) !== record.owner) return false;
+  if ("scope" in record && (typeof record.scope !== "string" || !isValidSecretRequestScope(record.scope))) return false;
+  return true;
+}
+function isValidSecretRequestScope(scope) {
+  return scope.length <= MAX_SCOPE_LENGTH && SCOPE_RE.test(scope) && !RESERVED_SCOPES.includes(scope);
+}
+function isValidSecretName(name) {
+  return name.length <= MAX_NAME_LENGTH && NAME_RE.test(name);
+}
+function validSecretNames(names) {
+  for (const name of names) assertSecretName(name);
+  const unique = dedupe(names);
+  if (unique.length === 0) {
+    throw new SecretRequestInputError("INVALID_SECRET_NAME", "At least one secret name is required.");
+  }
+  if (unique.length > SECRET_REQUEST_MAX_NAMES) {
+    throw new SecretRequestInputError("TOO_MANY_SECRET_NAMES", `At most ${SECRET_REQUEST_MAX_NAMES} secret names can be requested at once.`);
+  }
+  return unique;
+}
+function assertSecretName(name) {
+  if (typeof name !== "string" || !isValidSecretName(name)) {
+    throw new SecretRequestInputError("INVALID_SECRET_NAME", "Secret names are 1-64 characters of A-Z, 0-9 and '_', starting with a letter.");
+  }
+}
+function assertSecretRequestScope(scope) {
+  if (typeof scope !== "string" || !isValidSecretRequestScope(scope)) {
+    throw new SecretRequestInputError("INVALID_SECRET_SCOPE", "The scope must be a canonical scope of at most 64 characters, not default, global or scoped.");
+  }
+}
+function isAllowedReturnTo(returnTo) {
+  if (typeof returnTo !== "string" || returnTo.length > MAX_RETURN_TO_LENGTH) return false;
+  let url;
+  try {
+    url = new URL(returnTo);
+  } catch {
+    return false;
+  }
+  if (url.username !== "" || url.password !== "") return false;
+  return RETURN_TO_ORIGINS.includes(url.origin) || RETURN_TO_PREVIEW.test(url.origin);
+}
+function ownerOrUndefined(did) {
+  if (did === void 0) return void 0;
+  try {
+    return canonicalSecretRequestOwner(did);
+  } catch {
+    return void 0;
+  }
+}
+function ownerOfSpace(space) {
+  const match = space === void 0 ? null : PKH_SPACE_RE.exec(space);
+  if (match === null) return void 0;
+  return ownerOrUndefined(`did:pkh:eip155:${match[1]}:${match[2].toLowerCase()}`);
+}
+function putCommands(names, scope) {
+  return dedupe(names).map((name) => `tc secrets put ${name}${scope === void 0 ? "" : ` --scope ${scope}`} --stdin`).join("; ");
+}
+function dedupe(names) {
+  return [...new Set(names)];
+}
+function invalidOwner() {
+  return new SecretRequestInputError("INVALID_OWNER", "The owner must be a did:pkh:eip155 account with a valid EIP-55 address.");
+}
+export {
+  SECRET_MANAGER_ORIGIN,
+  SECRET_REQUEST_MAX_NAMES,
+  SECRET_REQUEST_MAX_URL_LENGTH,
+  SecretRequestInputError,
+  buildSecretManagerUrl,
+  buildSecretRequestUrl,
+  canonicalSecretRequestOwner,
+  isSafeRequestAccessRecovery,
+  isValidSecretName,
+  isValidSecretRequestScope,
+  missingSecretRecovery,
+  ownerOfSpace,
+  resolveSecretsOwner,
+  secretSetupFor,
+  validSecretNames
+};
+//# sourceMappingURL=secret-request.js.map

package/dist/secret-request.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secret-request.ts"],"sourcesContent":["// Namespace-shaped so modules that bundle this one stay compatible with\n// lightweight node-sdk test doubles.\nimport * as nodeSdk from \"@tinycloud/node-sdk\";\n\nimport type { TinyCloudPosture } from \"./contract.js\";\n\n/**\n * The one builder for Secret Manager links (TC-832 \"Link\"). Every\n * missing-secret path produces its `/request` link here, and `/app` links come\n * only from {@link buildSecretManagerUrl}. No parameter ever carries a value.\n */\nexport const SECRET_MANAGER_ORIGIN = \"https://secrets.tinycloud.xyz\";\nexport const SECRET_REQUEST_MAX_NAMES = 10;\nexport const SECRET_REQUEST_MAX_URL_LENGTH = 8192;\n\nconst OWNER_RE = /^did:pkh:eip155:([1-9][0-9]*):(0x[0-9a-fA-F]{40})$/;\nconst NAME_RE = /^[A-Z][A-Z0-9_]*$/;\nconst MAX_NAME_LENGTH = 64;\nconst SCOPE_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;\nconst MAX_SCOPE_LENGTH = 64;\nconst RESERVED_SCOPES: readonly string[] = [\"default\", \"global\", \"scoped\"];\nconst MAX_REQUESTER_LENGTH = 64;\nconst CONTROL_OR_FORMAT = /[\\p{Cc}\\p{Cf}]/u;\nconst STATE_RE = /^[A-Za-z0-9._~-]{1,128}$/;\nconst MAX_RETURN_TO_LENGTH = 2048;\nconst RETURN_TO_ORIGINS: readonly string[] = [\"https://feed.tinycloud.xyz\"];\nconst RETURN_TO_PREVIEW = /^https:\\/\\/[a-z0-9-]+\\.tinyfeed\\.pages\\.dev$/;\nconst PKH_SPACE_RE = /^tinycloud:pkh:eip155:([1-9][0-9]*):(0x[0-9a-fA-F]{40}):[^:]+$/;\n\nexport type SecretRequestInputErrorCode =\n  | \"INVALID_SECRET_NAME\"\n  | \"TOO_MANY_SECRET_NAMES\"\n  | \"INVALID_SECRET_SCOPE\"\n  | \"INVALID_OWNER\"\n  | \"INVALID_REQUESTER\"\n  | \"INVALID_RETURN_TO\"\n  | \"INVALID_STATE\"\n  | \"REQUEST_LINK_TOO_LONG\";\n\nexport class SecretRequestInputError extends Error {\n  readonly code: SecretRequestInputErrorCode;\n\n  constructor(code: SecretRequestInputErrorCode, message: string) {\n    super(message);\n    this.name = \"SecretRequestInputError\";\n    this.code = code;\n  }\n}\n\n/**\n * TC-832 owner rule: `did:pkh:eip155:<chain>:<address>` with a safe-integer\n * chain and a lowercase `0x`. An address with any uppercase letter must\n * already be its EIP-55 form. Returns the DID with the EIP-55 address.\n */\nexport function canonicalSecretRequestOwner(did: string): string {\n  const match = typeof did === \"string\" ? OWNER_RE.exec(did) : null;\n  if (match === null || !Number.isSafeInteger(Number(match[1]))) throw invalidOwner();\n  const address = match[2]!;\n  let checksummed: string;\n  try {\n    checksummed = nodeSdk.canonicalizeAddress(address);\n  } catch {\n    throw invalidOwner();\n  }\n  if (/[A-F]/.test(address.slice(2)) && address !== checksummed) throw invalidOwner();\n  return `did:pkh:eip155:${match[1]}:${checksummed}`;\n}\n\nexport interface SecretRequestLinkInput {\n  readonly owner: string;\n  readonly names: readonly string[];\n  readonly scope?: string;\n  readonly requester?: string;\n  readonly returnTo?: string;\n  readonly state?: string;\n}\n\nexport interface SecretRequestLink {\n  readonly url: string;\n  readonly owner: string;\n  readonly names: string[];\n  readonly scope?: string;\n}\n\n/** Builds the canonical `/request` link, or throws {@link SecretRequestInputError}. */\nexport function buildSecretRequestUrl(input: SecretRequestLinkInput): SecretRequestLink {\n  const owner = canonicalSecretRequestOwner(input.owner);\n  const names = validSecretNames(input.names);\n  if (input.scope !== undefined) assertSecretRequestScope(input.scope);\n  const requester = input.requester;\n  if (\n    requester !== undefined &&\n    (typeof requester !== \"string\" || requester.length === 0 || requester.length > MAX_REQUESTER_LENGTH ||\n      CONTROL_OR_FORMAT.test(requester))\n  ) {\n    throw new SecretRequestInputError(\"INVALID_REQUESTER\", \"The requester label must be 1-64 characters with no control or format characters.\");\n  }\n  if (input.returnTo !== undefined && !isAllowedReturnTo(input.returnTo)) {\n    throw new SecretRequestInputError(\"INVALID_RETURN_TO\", \"The return address is not an allowed Secret Manager callback.\");\n  }\n  if (input.state !== undefined && !STATE_RE.test(input.state)) {\n    throw new SecretRequestInputError(\"INVALID_STATE\", \"The state must be 1-128 characters of A-Z, a-z, 0-9, '.', '_', '~' or '-'.\");\n  }\n\n  const parameters: [string, string][] = [\n    [\"owner\", owner],\n    ...names.map((name): [string, string] => [\"name\", name]),\n    ...(input.scope === undefined ? [] : [[\"scope\", input.scope] as [string, string]]),\n    ...(input.requester === undefined ? [] : [[\"requester\", input.requester] as [string, string]]),\n    ...(input.returnTo === undefined ? [] : [[\"return_to\", input.returnTo] as [string, string]]),\n    ...(input.state === undefined ? [] : [[\"state\", input.state] as [string, string]]),\n    [\"v\", \"1\"],\n  ];\n  const url = `${SECRET_MANAGER_ORIGIN}/request?${parameters\n    .map(([key, value]) => `${key}=${encodeURIComponent(value)}`)\n    .join(\"&\")}`;\n  if (url.length > SECRET_REQUEST_MAX_URL_LENGTH) {\n    throw new SecretRequestInputError(\"REQUEST_LINK_TOO_LONG\", `The request link is longer than ${SECRET_REQUEST_MAX_URL_LENGTH} characters.`);\n  }\n  return { url, owner, names, ...(input.scope === undefined ? {} : { scope: input.scope }) };\n}\n\n/** The value-free setup a missing secret reports: exactly these keys. */\nexport interface SecretSetup {\n  readonly url: string;\n  readonly names: string[];\n  readonly scope?: string;\n  readonly owner: string;\n  readonly action: \"add_secret\";\n}\n\nexport function secretSetupFor(link: SecretRequestLink): SecretSetup {\n  return {\n    url: link.url,\n    names: [...link.names],\n    ...(link.scope === undefined ? {} : { scope: link.scope }),\n    owner: link.owner,\n    action: \"add_secret\",\n  };\n}\n\n/**\n * The full manager (`/app`), the only path that replaces an existing value:\n * bare, `?secret=N`, or `?secrets=A,B`, plus `&scope=`. Names follow the link\n * name rule without the request cap.\n */\nexport function buildSecretManagerUrl(input: { readonly names?: readonly string[]; readonly scope?: string } = {}): string {\n  const names = dedupe(input.names ?? []);\n  for (const name of names) assertSecretName(name);\n  if (input.scope !== undefined) assertSecretRequestScope(input.scope);\n  const parameters: [string, string][] = [\n    ...(names.length === 1 ? [[\"secret\", names[0]!] as [string, string]] : []),\n    ...(names.length > 1 ? [[\"secrets\", names.join(\",\")] as [string, string]] : []),\n    ...(input.scope === undefined ? [] : [[\"scope\", input.scope] as [string, string]]),\n  ];\n  const query = parameters.map(([key, value]) => `${key}=${encodeURIComponent(value)}`).join(\"&\");\n  return `${SECRET_MANAGER_ORIGIN}/app${query === \"\" ? \"\" : `?${query}`}`;\n}\n\nexport type SecretsOwnerResolution =\n  | { readonly ok: true; readonly owner: string; readonly local: boolean }\n  | { readonly ok: false; readonly code: \"OWNER_DID_UNKNOWN\" | \"OWNER_MISMATCH\"; readonly message: string };\n\n/**\n * The owner whose secrets an identity reads, first match wins: a local key's\n * own account, the recorded owner, a delegate session's space owner, a pkh\n * principal, then the requested owner. A requested owner that disagrees with a\n * resolved one is `OWNER_MISMATCH`.\n */\nexport function resolveSecretsOwner(\n  profile: {\n    readonly local: boolean;\n    readonly posture: TinyCloudPosture;\n    readonly ownerDid?: string;\n    readonly principalDid?: string;\n    readonly space?: string;\n  },\n  requestedOwner?: string,\n): SecretsOwnerResolution {\n  const resolved = profile.local\n    ? ownerOrUndefined(profile.principalDid)\n    : ownerOrUndefined(profile.ownerDid) ??\n      (profile.posture === \"delegate-session\" ? ownerOfSpace(profile.space) : undefined) ??\n      ownerOrUndefined(profile.principalDid);\n  const requested = requestedOwner === undefined ? undefined : ownerOrUndefined(requestedOwner);\n\n  if (resolved !== undefined) {\n    if (requestedOwner !== undefined && requested !== resolved) {\n      return {\n        ok: false,\n        code: \"OWNER_MISMATCH\",\n        message: \"The requested owner is not the owner of this identity's secrets.\",\n      };\n    }\n    return { ok: true, owner: resolved, local: profile.local };\n  }\n  if (requested !== undefined && !profile.local) return { ok: true, owner: requested, local: false };\n  return {\n    ok: false,\n    code: \"OWNER_DID_UNKNOWN\",\n    message: \"The owner of this identity's secrets is unknown. Pass the owner's did:pkh with --owner.\",\n  };\n}\n\nexport type MissingSecretRecovery =\n  | { readonly kind: \"add_secret\"; readonly setup: SecretSetup }\n  | { readonly kind: \"put_locally\"; readonly hint: string }\n  | { readonly kind: \"not_requestable\"; readonly hint: string };\n\n/**\n * How a caller gets missing secrets: a local identity stores them itself; any\n * other identity gets a `/request` link when one can express the request.\n * Never throws.\n */\nexport function missingSecretRecovery(input: {\n  readonly owner: string | undefined;\n  readonly local: boolean;\n  readonly names: readonly string[];\n  readonly scope?: string;\n}): MissingSecretRecovery {\n  if (input.local) {\n    return { kind: \"put_locally\", hint: `Store it with: ${putCommands(input.names, input.scope)}` };\n  }\n  if (input.owner !== undefined) {\n    try {\n      return {\n        kind: \"add_secret\",\n        setup: secretSetupFor(buildSecretRequestUrl({\n          owner: input.owner,\n          names: input.names,\n          ...(input.scope === undefined ? {} : { scope: input.scope }),\n        })),\n      };\n    } catch {\n      // A legacy name or scope, or an unusable owner, cannot be requested.\n    }\n  }\n  return {\n    kind: \"not_requestable\",\n    hint: `No Secret Manager request link can express this secret. The owner can store it with: ${putCommands(input.names, input.scope)}`,\n  };\n}\n\n/**\n * The strict policy for a consent denial's `request_access` recovery: exact\n * keys, denied names only, a canonical owner and a valid scope. Any deviation\n * rejects the whole value.\n */\nexport function isSafeRequestAccessRecovery(\n  value: unknown,\n  deniedNames: readonly string[],\n): value is { action: \"request_access\"; names: string[]; owner: string; scope?: string } {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return false;\n  const record = value as Record<string, unknown>;\n  const keys = Object.keys(record);\n  if (!keys.every((key) => key === \"action\" || key === \"names\" || key === \"owner\" || key === \"scope\")) return false;\n  if (record.action !== \"request_access\") return false;\n  const names = record.names;\n  if (\n    !Array.isArray(names) || names.length === 0 || names.length > SECRET_REQUEST_MAX_NAMES ||\n    new Set(names).size !== names.length ||\n    !names.every((name) => typeof name === \"string\" && isValidSecretName(name) && deniedNames.includes(name))\n  ) {\n    return false;\n  }\n  if (typeof record.owner !== \"string\" || ownerOrUndefined(record.owner) !== record.owner) return false;\n  if (\"scope\" in record && (typeof record.scope !== \"string\" || !isValidSecretRequestScope(record.scope))) return false;\n  return true;\n}\n\n/** TC-832 scope rule: canonical grammar, at most 64, not reserved. Never canonicalizes. */\nexport function isValidSecretRequestScope(scope: string): boolean {\n  return scope.length <= MAX_SCOPE_LENGTH && SCOPE_RE.test(scope) && !RESERVED_SCOPES.includes(scope);\n}\n\n/** TC-832 name rule: `^[A-Z][A-Z0-9_]*$`, at most 64, no trimming. */\nexport function isValidSecretName(name: string): boolean {\n  return name.length <= MAX_NAME_LENGTH && NAME_RE.test(name);\n}\n\n/** Validated, de-duplicated (order kept) names, 1-10 of them. */\nexport function validSecretNames(names: readonly string[]): string[] {\n  for (const name of names) assertSecretName(name);\n  const unique = dedupe(names);\n  if (unique.length === 0) {\n    throw new SecretRequestInputError(\"INVALID_SECRET_NAME\", \"At least one secret name is required.\");\n  }\n  if (unique.length > SECRET_REQUEST_MAX_NAMES) {\n    throw new SecretRequestInputError(\"TOO_MANY_SECRET_NAMES\", `At most ${SECRET_REQUEST_MAX_NAMES} secret names can be requested at once.`);\n  }\n  return unique;\n}\n\nfunction assertSecretName(name: string): void {\n  if (typeof name !== \"string\" || !isValidSecretName(name)) {\n    throw new SecretRequestInputError(\"INVALID_SECRET_NAME\", \"Secret names are 1-64 characters of A-Z, 0-9 and '_', starting with a letter.\");\n  }\n}\n\nfunction assertSecretRequestScope(scope: string): void {\n  if (typeof scope !== \"string\" || !isValidSecretRequestScope(scope)) {\n    throw new SecretRequestInputError(\"INVALID_SECRET_SCOPE\", \"The scope must be a canonical scope of at most 64 characters, not default, global or scoped.\");\n  }\n}\n\nfunction isAllowedReturnTo(returnTo: string): boolean {\n  if (typeof returnTo !== \"string\" || returnTo.length > MAX_RETURN_TO_LENGTH) return false;\n  let url: URL;\n  try {\n    url = new URL(returnTo);\n  } catch {\n    return false;\n  }\n  if (url.username !== \"\" || url.password !== \"\") return false;\n  return RETURN_TO_ORIGINS.includes(url.origin) || RETURN_TO_PREVIEW.test(url.origin);\n}\n\nfunction ownerOrUndefined(did: string | undefined): string | undefined {\n  if (did === undefined) return undefined;\n  try {\n    return canonicalSecretRequestOwner(did);\n  } catch {\n    return undefined;\n  }\n}\n\n/** The canonical owner DID of a `tinycloud:pkh:eip155:…` space, or `undefined` for any other space. */\nexport function ownerOfSpace(space: string | undefined): string | undefined {\n  const match = space === undefined ? null : PKH_SPACE_RE.exec(space);\n  if (match === null) return undefined;\n  // Space URIs carry the address in any case; the owner is its EIP-55 form.\n  return ownerOrUndefined(`did:pkh:eip155:${match[1]}:${match[2]!.toLowerCase()}`);\n}\n\nfunction putCommands(names: readonly string[], scope: string | undefined): string {\n  return dedupe(names)\n    .map((name) => `tc secrets put ${name}${scope === undefined ? \"\" : ` --scope ${scope}`} --stdin`)\n    .join(\"; \");\n}\n\nfunction dedupe(names: readonly string[]): string[] {\n  return [...new Set(names)];\n}\n\nfunction invalidOwner(): SecretRequestInputError {\n  return new SecretRequestInputError(\"INVALID_OWNER\", \"The owner must be a did:pkh:eip155 account with a valid EIP-55 address.\");\n}\n"],"mappings":";AAEA,YAAY,aAAa;AASlB,IAAM,wBAAwB;AAC9B,IAAM,2BAA2B;AACjC,IAAM,gCAAgC;AAE7C,IAAM,WAAW;AACjB,IAAM,UAAU;AAChB,IAAM,kBAAkB;AACxB,IAAM,WAAW;AACjB,IAAM,mBAAmB;AACzB,IAAM,kBAAqC,CAAC,WAAW,UAAU,QAAQ;AACzE,IAAM,uBAAuB;AAC7B,IAAM,oBAAoB;AAC1B,IAAM,WAAW;AACjB,IAAM,uBAAuB;AAC7B,IAAM,oBAAuC,CAAC,4BAA4B;AAC1E,IAAM,oBAAoB;AAC1B,IAAM,eAAe;AAYd,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAGjD,YAAY,MAAmC,SAAiB;AAC9D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,4BAA4B,KAAqB;AAC/D,QAAM,QAAQ,OAAO,QAAQ,WAAW,SAAS,KAAK,GAAG,IAAI;AAC7D,MAAI,UAAU,QAAQ,CAAC,OAAO,cAAc,OAAO,MAAM,CAAC,CAAC,CAAC,EAAG,OAAM,aAAa;AAClF,QAAM,UAAU,MAAM,CAAC;AACvB,MAAI;AACJ,MAAI;AACF,kBAAsB,4BAAoB,OAAO;AAAA,EACnD,QAAQ;AACN,UAAM,aAAa;AAAA,EACrB;AACA,MAAI,QAAQ,KAAK,QAAQ,MAAM,CAAC,CAAC,KAAK,YAAY,YAAa,OAAM,aAAa;AAClF,SAAO,kBAAkB,MAAM,CAAC,CAAC,IAAI,WAAW;AAClD;AAmBO,SAAS,sBAAsB,OAAkD;AACtF,QAAM,QAAQ,4BAA4B,MAAM,KAAK;AACrD,QAAM,QAAQ,iBAAiB,MAAM,KAAK;AAC1C,MAAI,MAAM,UAAU,OAAW,0BAAyB,MAAM,KAAK;AACnE,QAAM,YAAY,MAAM;AACxB,MACE,cAAc,WACb,OAAO,cAAc,YAAY,UAAU,WAAW,KAAK,UAAU,SAAS,wBAC7E,kBAAkB,KAAK,SAAS,IAClC;AACA,UAAM,IAAI,wBAAwB,qBAAqB,mFAAmF;AAAA,EAC5I;AACA,MAAI,MAAM,aAAa,UAAa,CAAC,kBAAkB,MAAM,QAAQ,GAAG;AACtE,UAAM,IAAI,wBAAwB,qBAAqB,+DAA+D;AAAA,EACxH;AACA,MAAI,MAAM,UAAU,UAAa,CAAC,SAAS,KAAK,MAAM,KAAK,GAAG;AAC5D,UAAM,IAAI,wBAAwB,iBAAiB,4EAA4E;AAAA,EACjI;AAEA,QAAM,aAAiC;AAAA,IACrC,CAAC,SAAS,KAAK;AAAA,IACf,GAAG,MAAM,IAAI,CAAC,SAA2B,CAAC,QAAQ,IAAI,CAAC;AAAA,IACvD,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,CAAC,CAAC,SAAS,MAAM,KAAK,CAAqB;AAAA,IAChF,GAAI,MAAM,cAAc,SAAY,CAAC,IAAI,CAAC,CAAC,aAAa,MAAM,SAAS,CAAqB;AAAA,IAC5F,GAAI,MAAM,aAAa,SAAY,CAAC,IAAI,CAAC,CAAC,aAAa,MAAM,QAAQ,CAAqB;AAAA,IAC1F,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,CAAC,CAAC,SAAS,MAAM,KAAK,CAAqB;AAAA,IAChF,CAAC,KAAK,GAAG;AAAA,EACX;AACA,QAAM,MAAM,GAAG,qBAAqB,YAAY,WAC7C,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,GAAG,IAAI,mBAAmB,KAAK,CAAC,EAAE,EAC3D,KAAK,GAAG,CAAC;AACZ,MAAI,IAAI,SAAS,+BAA+B;AAC9C,UAAM,IAAI,wBAAwB,yBAAyB,mCAAmC,6BAA6B,cAAc;AAAA,EAC3I;AACA,SAAO,EAAE,KAAK,OAAO,OAAO,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM,EAAG;AAC3F;AAWO,SAAS,eAAe,MAAsC;AACnE,SAAO;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,CAAC,GAAG,KAAK,KAAK;AAAA,IACrB,GAAI,KAAK,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM;AAAA,IACxD,OAAO,KAAK;AAAA,IACZ,QAAQ;AAAA,EACV;AACF;AAOO,SAAS,sBAAsB,QAAyE,CAAC,GAAW;AACzH,QAAM,QAAQ,OAAO,MAAM,SAAS,CAAC,CAAC;AACtC,aAAW,QAAQ,MAAO,kBAAiB,IAAI;AAC/C,MAAI,MAAM,UAAU,OAAW,0BAAyB,MAAM,KAAK;AACnE,QAAM,aAAiC;AAAA,IACrC,GAAI,MAAM,WAAW,IAAI,CAAC,CAAC,UAAU,MAAM,CAAC,CAAE,CAAqB,IAAI,CAAC;AAAA,IACxE,GAAI,MAAM,SAAS,IAAI,CAAC,CAAC,WAAW,MAAM,KAAK,GAAG,CAAC,CAAqB,IAAI,CAAC;AAAA,IAC7E,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,CAAC,CAAC,SAAS,MAAM,KAAK,CAAqB;AAAA,EAClF;AACA,QAAM,QAAQ,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,GAAG,IAAI,mBAAmB,KAAK,CAAC,EAAE,EAAE,KAAK,GAAG;AAC9F,SAAO,GAAG,qBAAqB,OAAO,UAAU,KAAK,KAAK,IAAI,KAAK,EAAE;AACvE;AAYO,SAAS,oBACd,SAOA,gBACwB;AACxB,QAAM,WAAW,QAAQ,QACrB,iBAAiB,QAAQ,YAAY,IACrC,iBAAiB,QAAQ,QAAQ,MAChC,QAAQ,YAAY,qBAAqB,aAAa,QAAQ,KAAK,IAAI,WACxE,iBAAiB,QAAQ,YAAY;AACzC,QAAM,YAAY,mBAAmB,SAAY,SAAY,iBAAiB,cAAc;AAE5F,MAAI,aAAa,QAAW;AAC1B,QAAI,mBAAmB,UAAa,cAAc,UAAU;AAC1D,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,EAAE,IAAI,MAAM,OAAO,UAAU,OAAO,QAAQ,MAAM;AAAA,EAC3D;AACA,MAAI,cAAc,UAAa,CAAC,QAAQ,MAAO,QAAO,EAAE,IAAI,MAAM,OAAO,WAAW,OAAO,MAAM;AACjG,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AAYO,SAAS,sBAAsB,OAKZ;AACxB,MAAI,MAAM,OAAO;AACf,WAAO,EAAE,MAAM,eAAe,MAAM,kBAAkB,YAAY,MAAM,OAAO,MAAM,KAAK,CAAC,GAAG;AAAA,EAChG;AACA,MAAI,MAAM,UAAU,QAAW;AAC7B,QAAI;AACF,aAAO;AAAA,QACL,MAAM;AAAA,QACN,OAAO,eAAe,sBAAsB;AAAA,UAC1C,OAAO,MAAM;AAAA,UACb,OAAO,MAAM;AAAA,UACb,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,QAC5D,CAAC,CAAC;AAAA,MACJ;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,wFAAwF,YAAY,MAAM,OAAO,MAAM,KAAK,CAAC;AAAA,EACrI;AACF;AAOO,SAAS,4BACd,OACA,aACuF;AACvF,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,MAAI,CAAC,KAAK,MAAM,CAAC,QAAQ,QAAQ,YAAY,QAAQ,WAAW,QAAQ,WAAW,QAAQ,OAAO,EAAG,QAAO;AAC5G,MAAI,OAAO,WAAW,iBAAkB,QAAO;AAC/C,QAAM,QAAQ,OAAO;AACrB,MACE,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,KAAK,MAAM,SAAS,4BAC9D,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,UAC9B,CAAC,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,YAAY,kBAAkB,IAAI,KAAK,YAAY,SAAS,IAAI,CAAC,GACxG;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,OAAO,UAAU,YAAY,iBAAiB,OAAO,KAAK,MAAM,OAAO,MAAO,QAAO;AAChG,MAAI,WAAW,WAAW,OAAO,OAAO,UAAU,YAAY,CAAC,0BAA0B,OAAO,KAAK,GAAI,QAAO;AAChH,SAAO;AACT;AAGO,SAAS,0BAA0B,OAAwB;AAChE,SAAO,MAAM,UAAU,oBAAoB,SAAS,KAAK,KAAK,KAAK,CAAC,gBAAgB,SAAS,KAAK;AACpG;AAGO,SAAS,kBAAkB,MAAuB;AACvD,SAAO,KAAK,UAAU,mBAAmB,QAAQ,KAAK,IAAI;AAC5D;AAGO,SAAS,iBAAiB,OAAoC;AACnE,aAAW,QAAQ,MAAO,kBAAiB,IAAI;AAC/C,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,wBAAwB,uBAAuB,uCAAuC;AAAA,EAClG;AACA,MAAI,OAAO,SAAS,0BAA0B;AAC5C,UAAM,IAAI,wBAAwB,yBAAyB,WAAW,wBAAwB,yCAAyC;AAAA,EACzI;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAoB;AAC5C,MAAI,OAAO,SAAS,YAAY,CAAC,kBAAkB,IAAI,GAAG;AACxD,UAAM,IAAI,wBAAwB,uBAAuB,+EAA+E;AAAA,EAC1I;AACF;AAEA,SAAS,yBAAyB,OAAqB;AACrD,MAAI,OAAO,UAAU,YAAY,CAAC,0BAA0B,KAAK,GAAG;AAClE,UAAM,IAAI,wBAAwB,wBAAwB,8FAA8F;AAAA,EAC1J;AACF;AAEA,SAAS,kBAAkB,UAA2B;AACpD,MAAI,OAAO,aAAa,YAAY,SAAS,SAAS,qBAAsB,QAAO;AACnF,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,QAAQ;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,MAAM,IAAI,aAAa,GAAI,QAAO;AACvD,SAAO,kBAAkB,SAAS,IAAI,MAAM,KAAK,kBAAkB,KAAK,IAAI,MAAM;AACpF;AAEA,SAAS,iBAAiB,KAA6C;AACrE,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI;AACF,WAAO,4BAA4B,GAAG;AAAA,EACxC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,aAAa,OAA+C;AAC1E,QAAM,QAAQ,UAAU,SAAY,OAAO,aAAa,KAAK,KAAK;AAClE,MAAI,UAAU,KAAM,QAAO;AAE3B,SAAO,iBAAiB,kBAAkB,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,EAAG,YAAY,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,OAA0B,OAAmC;AAChF,SAAO,OAAO,KAAK,EAChB,IAAI,CAAC,SAAS,kBAAkB,IAAI,GAAG,UAAU,SAAY,KAAK,YAAY,KAAK,EAAE,UAAU,EAC/F,KAAK,IAAI;AACd;AAEA,SAAS,OAAO,OAAoC;AAClD,SAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC;AAC3B;AAEA,SAAS,eAAwC;AAC/C,SAAO,IAAI,wBAAwB,iBAAiB,yEAAyE;AAC/H;","names":[]}