@tinycloud/operations 0.7.0-beta.33 → 0.7.0-beta.35

package/dist/mcp-authority.js

@@ -0,0 +1,470 @@
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+
+// src/contract.ts
+var DELEGATION_CID_PATTERN;
+var init_contract = __esm({
+  "src/contract.ts"() {
+    "use strict";
+    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
+  }
+});
+
+// src/errors.ts
+var init_errors = __esm({
+  "src/errors.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli-name.ts
+import { basename } from "path";
+var CLI_NAME;
+var init_cli_name = __esm({
+  "src/cli-name.ts"() {
+    "use strict";
+    CLI_NAME = basename(process.argv[1] ?? "") === "tinycloud" ? "tinycloud" : "tc";
+  }
+});
+
+// src/revoked-grant.ts
+import { authorizationVerdictOf } from "@tinycloud/sdk-services";
+var REVOKED_GRANT_MESSAGE;
+var init_revoked_grant = __esm({
+  "src/revoked-grant.ts"() {
+    "use strict";
+    init_cli_name();
+    REVOKED_GRANT_MESSAGE = `This grant was revoked. Ask the owner for a new grant (\`${CLI_NAME} auth request ...\`).`;
+  }
+});
+
+// src/kv-failure.ts
+import { authorizationVerdictOf as authorizationVerdictOf2, validatedCapabilityOf } from "@tinycloud/sdk-services";
+function nodeRevocationOf(error) {
+  if (typeof error !== "object" || error === null || !("service" in error) || error.service !== "kv" || !("code" in error) || error.code !== "AUTH_UNAUTHORIZED" && error.code !== "AUTH_DELEGATION_REVOKED" && error.code !== "AUTH_DELEGATION_ANCESTOR_REVOKED" || !("message" in error) || typeof error.message !== "string" || !("meta" in error) || typeof error.meta !== "object" || error.meta === null || !("status" in error.meta) || error.meta.status !== 401 || authorizationVerdictOf2(error) !== "unauthenticated") return void 0;
+  const { code, message } = error;
+  const separator = ": 401 - ";
+  const start = message.indexOf(separator);
+  if (start < 0) return void 0;
+  const body = message.slice(start + separator.length);
+  const match = NODE_REVOCATION_BODY.exec(body);
+  if (match === null || match[0] !== body) return void 0;
+  if (match[1] !== void 0 && code !== "AUTH_DELEGATION_ANCESTOR_REVOKED") {
+    const revokedCid = match[2];
+    return DELEGATION_CID.test(revokedCid) ? { reason: "delegation_revoked", revokedCid } : void 0;
+  }
+  if (match[3] !== void 0 && code !== "AUTH_DELEGATION_REVOKED") {
+    const ancestorCid = match[4];
+    const revokedCid = match[5];
+    return DELEGATION_CID.test(ancestorCid) && DELEGATION_CID.test(revokedCid) ? { reason: "delegation_ancestor_revoked", revokedCid, ancestorCid } : void 0;
+  }
+  return void 0;
+}
+var DELEGATION_CID, NODE_REVOCATION_BODY;
+var init_kv_failure = __esm({
+  "src/kv-failure.ts"() {
+    "use strict";
+    init_contract();
+    init_errors();
+    init_revoked_grant();
+    DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
+    NODE_REVOCATION_BODY = /^(?:Invalid invocation: )?delegation-(?:(revoked): ([A-Za-z0-9]+)|(ancestor-revoked): ancestor=([A-Za-z0-9]+) invoked=([A-Za-z0-9]+))$/;
+  }
+});
+
+// ../sdk-core/src/policy/errors.ts
+var SignedObjectProfileError, SignedObjectCanonicalizationError;
+var init_errors2 = __esm({
+  "../sdk-core/src/policy/errors.ts"() {
+    "use strict";
+    SignedObjectProfileError = class extends Error {
+      constructor(code, message) {
+        super(message);
+        this.name = "SignedObjectProfileError";
+        this.code = code;
+      }
+    };
+    SignedObjectCanonicalizationError = class extends SignedObjectProfileError {
+      constructor(message) {
+        super("canonicalization-mismatch", message);
+        this.name = "SignedObjectCanonicalizationError";
+      }
+    };
+  }
+});
+
+// ../sdk-core/src/policy/jcs.ts
+function jcsCanonicalize(input) {
+  return serialize(normalizeJson(input, "$"));
+}
+function normalizeJson(input, path = "$") {
+  if (input === null) {
+    return null;
+  }
+  switch (typeof input) {
+    case "boolean":
+      return input;
+    case "number":
+      if (!Number.isFinite(input)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path} must be a finite JSON number`
+        );
+      }
+      return input;
+    case "string":
+      assertUnicodeScalarString(input, path);
+      return input;
+    case "object":
+      return normalizeJsonObjectOrArray(input, path);
+    case "bigint":
+    case "function":
+    case "symbol":
+    case "undefined":
+    default:
+      throw new SignedObjectCanonicalizationError(
+        `${path} is not a JSON value`
+      );
+  }
+}
+function serialize(value) {
+  if (value === null) {
+    return "null";
+  }
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "number": {
+      const encoded = JSON.stringify(value);
+      if (encoded === void 0) {
+        throw new SignedObjectCanonicalizationError(
+          "number could not be serialized as JSON"
+        );
+      }
+      return encoded;
+    }
+    case "string":
+      return JSON.stringify(value);
+    case "object":
+      if (Array.isArray(value)) {
+        return `[${value.map((item) => serialize(item)).join(",")}]`;
+      }
+      return serializeObject(value);
+    default:
+      throw new SignedObjectCanonicalizationError(
+        `unsupported JSON value type ${typeof value}`
+      );
+  }
+}
+function normalizeJsonObjectOrArray(input, path) {
+  assertNoSymbolKeys(input, path);
+  if (Array.isArray(input)) {
+    for (const key of Object.getOwnPropertyNames(input)) {
+      if (key === "length") {
+        continue;
+      }
+      if (!isArrayIndexKey(key, input.length)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}.${key} is not allowed on a JSON array`
+        );
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(input, key);
+      if (descriptor?.enumerable !== true) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}[${key}] must be an enumerable JSON array item`
+        );
+      }
+      if (!("value" in descriptor)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}[${key}] must be a JSON data property`
+        );
+      }
+    }
+    const output2 = [];
+    for (let index = 0; index < input.length; index++) {
+      if (!objectHasOwn(input, index)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}[${index}] must not be a sparse array hole`
+        );
+      }
+      output2.push(normalizeJson(input[index], `${path}[${index}]`));
+    }
+    return output2;
+  }
+  const proto = Object.getPrototypeOf(input);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new SignedObjectCanonicalizationError(
+      `${path} must be a plain JSON object`
+    );
+  }
+  const output = /* @__PURE__ */ Object.create(null);
+  for (const key of Object.getOwnPropertyNames(input)) {
+    assertUnicodeScalarString(key, `${path} key`);
+    if (key === "__proto__" || key === "constructor") {
+      throw new SignedObjectCanonicalizationError(
+        `${path}.${key} is not allowed`
+      );
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(input, key);
+    if (descriptor?.enumerable !== true) {
+      throw new SignedObjectCanonicalizationError(
+        `${path}.${key} must be an enumerable JSON object property`
+      );
+    }
+    if (!("value" in descriptor)) {
+      throw new SignedObjectCanonicalizationError(
+        `${path}.${key} must be a JSON data property`
+      );
+    }
+    const value = descriptor.value;
+    output[key] = normalizeJson(value, `${path}.${key}`);
+  }
+  return output;
+}
+function assertNoSymbolKeys(input, path) {
+  if (Object.getOwnPropertySymbols(input).length > 0) {
+    throw new SignedObjectCanonicalizationError(
+      `${path} must not have symbol properties`
+    );
+  }
+}
+function isArrayIndexKey(key, length) {
+  if (!/^(0|[1-9]\d*)$/.test(key)) {
+    return false;
+  }
+  const index = Number(key);
+  return Number.isSafeInteger(index) && index >= 0 && index < length;
+}
+function serializeObject(value) {
+  const keys = Object.keys(value).sort(compareUtf16CodeUnits);
+  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);
+  return `{${parts.join(",")}}`;
+}
+function compareUtf16CodeUnits(a, b) {
+  const max = Math.min(a.length, b.length);
+  for (let index = 0; index < max; index++) {
+    const leftCodeUnit = a.charCodeAt(index);
+    const rightCodeUnit = b.charCodeAt(index);
+    if (leftCodeUnit !== rightCodeUnit) {
+      return leftCodeUnit - rightCodeUnit;
+    }
+  }
+  return a.length - b.length;
+}
+function assertUnicodeScalarString(value, path) {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (Number.isNaN(next) || next < 56320 || next > 57343) {
+        throw new SignedObjectCanonicalizationError(
+          `${path} contains a lone high surrogate`
+        );
+      }
+      index++;
+      continue;
+    }
+    if (code >= 56320 && code <= 57343) {
+      throw new SignedObjectCanonicalizationError(
+        `${path} contains a lone low surrogate`
+      );
+    }
+  }
+}
+var objectHasOwn;
+var init_jcs = __esm({
+  "../sdk-core/src/policy/jcs.ts"() {
+    "use strict";
+    init_errors2();
+    objectHasOwn = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
+      Object.prototype.hasOwnProperty
+    );
+  }
+});
+
+// src/authority.ts
+var init_authority = __esm({
+  "src/authority.ts"() {
+    "use strict";
+  }
+});
+
+// src/state.ts
+import { randomUUID } from "crypto";
+import { AsyncLocalStorage } from "async_hooks";
+import { constants as fsConstants, fstatSync, readFileSync, readlinkSync } from "fs";
+import {
+  chmod,
+  link,
+  mkdir,
+  lstat,
+  open,
+  readFile,
+  readdir,
+  realpath,
+  rename,
+  rmdir,
+  rm,
+  stat,
+  unlink,
+  writeFile
+} from "fs/promises";
+import { connect, createServer } from "net";
+import { homedir } from "os";
+import { basename as basename2, dirname, isAbsolute, join, relative, resolve } from "path";
+function processWideContext(key) {
+  var _a4;
+  const registry = globalThis;
+  return registry[_a4 = Symbol.for(key)] ?? (registry[_a4] = new AsyncLocalStorage());
+}
+var invocationStateRoot, heldProfileLocks, pinnedProfiles, pinnedHomes, _a, canonicalHomes, _a2, processInstanceId, _a3, relinquishedTurns;
+var init_state = __esm({
+  "src/state.ts"() {
+    "use strict";
+    invocationStateRoot = processWideContext("tinycloud.operations.invocationStateRoot.v1");
+    heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v2");
+    pinnedProfiles = processWideContext("tinycloud.operations.pinnedProfiles.v2");
+    pinnedHomes = processWideContext("tinycloud.operations.pinnedHomes.v2");
+    canonicalHomes = globalThis[_a = /* @__PURE__ */ Symbol.for("tinycloud.operations.canonicalHomes.v1")] ?? (globalThis[_a] = /* @__PURE__ */ new Map());
+    processInstanceId = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.profileLockInstance.v1")] ?? (globalThis[_a2] = randomUUID());
+    relinquishedTurns = globalThis[_a3 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a3] = /* @__PURE__ */ new Set());
+  }
+});
+
+// src/artifacts.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { z } from "zod";
+var THIRTY_DAYS_MS, PermissionEntrySchema, CommandSchema, LegacyPermissionRequestArtifactSchema, PortableDelegationSchema, PermissionRequestArtifactSchema, DelegationImportArtifactSchema, DelegationRequestBindingSchema;
+var init_artifacts = __esm({
+  "src/artifacts.ts"() {
+    "use strict";
+    init_authority();
+    init_state();
+    init_authority();
+    THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
+    PermissionEntrySchema = z.object({
+      service: z.string().min(1),
+      space: z.string().min(1).optional(),
+      path: z.string(),
+      actions: z.array(z.string().min(1)).min(1),
+      caveats: z.array(z.record(z.unknown())).optional(),
+      skipPrefix: z.boolean().optional(),
+      expiry: z.string().min(1).optional(),
+      description: z.string().optional()
+    }).strict();
+    CommandSchema = z.object({
+      argv: z.array(z.string()).min(1),
+      cwd: z.string().min(1)
+    }).strict();
+    LegacyPermissionRequestArtifactSchema = z.object({
+      kind: z.literal("tinycloud.auth.request"),
+      version: z.literal(1),
+      requestId: z.string(),
+      sessionDid: z.string().min(1),
+      requested: z.array(PermissionEntrySchema),
+      requestedExpiry: z.union([z.string(), z.number().finite()]).optional()
+    }).strict();
+    PortableDelegationSchema = z.lazy(() => z.object({
+      cid: z.string().min(1),
+      spaceId: z.string().min(1),
+      path: z.string(),
+      actions: z.array(z.string().min(1)).min(1),
+      delegateDID: z.string().min(1),
+      ownerAddress: z.string().min(1),
+      chainId: z.number().int().positive(),
+      expiry: z.union([z.string().datetime({ offset: true }), z.date()]),
+      delegationHeader: z.object({ Authorization: z.string().min(1) }).strict(),
+      host: z.string().min(1).optional(),
+      disableSubDelegation: z.boolean().optional(),
+      publicDelegation: PortableDelegationSchema.optional(),
+      resources: z.array(PermissionEntrySchema).optional()
+    }).passthrough());
+    PermissionRequestArtifactSchema = z.object({
+      kind: z.literal("tinycloud.auth.request"),
+      version: z.literal(1),
+      requestId: z.string().min(1),
+      createdAt: z.string().datetime({ offset: true }),
+      profile: z.string().min(1),
+      posture: z.enum(["owner-openkey", "delegate-session", "local-owner-key", "unauthenticated"]),
+      operatorType: z.enum(["human", "agent"]),
+      host: z.string().min(1),
+      sessionDid: z.string().min(1),
+      ownerDid: z.string().min(1).optional(),
+      spaceId: z.string().min(1).optional(),
+      requestedExpiry: z.union([z.string().min(1), z.number().finite()]).optional(),
+      requested: z.array(PermissionEntrySchema),
+      command: CommandSchema.optional()
+    }).strict();
+    DelegationImportArtifactSchema = z.object({
+      kind: z.literal("tinycloud.auth.delegation"),
+      version: z.literal(1),
+      requestId: z.string().min(1),
+      delegationCid: z.string().min(1).optional(),
+      delegation: PortableDelegationSchema,
+      // This field is presentation metadata only. A later import operation obtains
+      // effective permissions from validated, installed delegation authority.
+      permissions: z.array(PermissionEntrySchema).optional(),
+      expiry: z.string().datetime({ offset: true }).optional(),
+      prompted: z.boolean().optional()
+    }).strict();
+    DelegationRequestBindingSchema = PermissionRequestArtifactSchema.pick({ requestId: true, requested: true }).strict();
+  }
+});
+
+// src/recovery.ts
+var init_recovery = __esm({
+  "src/recovery.ts"() {
+    "use strict";
+    init_cli_name();
+  }
+});
+
+// src/secrets.ts
+import * as nodeSdk from "@tinycloud/node-sdk";
+var init_secrets = __esm({
+  "src/secrets.ts"() {
+    "use strict";
+    init_errors();
+  }
+});
+
+// src/mcp-authority.ts
+init_kv_failure();
+
+// src/invoke.ts
+init_cli_name();
+init_jcs();
+init_errors();
+init_authority();
+init_artifacts();
+import { createHash } from "crypto";
+import { isAbsolute as isAbsolute2 } from "path";
+import {
+  makePkhSpaceId as makePkhSpaceId2,
+  parsePkhDid as parsePkhDid2,
+  parseSpaceUri as parseSpaceUri2
+} from "@tinycloud/node-sdk";
+
+// src/redaction.ts
+init_contract();
+init_recovery();
+import { RUNTIME_DELEGATION_REJECTIONS } from "@tinycloud/node-sdk";
+var DELEGATION_CID2 = new RegExp(DELEGATION_CID_PATTERN);
+
+// src/invoke.ts
+init_state();
+init_secrets();
+function operationRetryDescriptor(operation, input, requiresCallerInput = false) {
+  return {
+    operationId: operation.operationId,
+    operationVersion: operation.operationVersion,
+    inputDigest: createHash("sha256").update(jcsCanonicalize(input), "utf8").digest("hex"),
+    requiresCallerInput
+  };
+}
+export {
+  nodeRevocationOf,
+  operationRetryDescriptor
+};
+//# sourceMappingURL=mcp-authority.js.map