@tinycloud/operations 0.7.0-beta.34 → 0.7.0-beta.35

package/dist/mcp-authority.cjs

@@ -0,0 +1,486 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/contract.ts
+var DELEGATION_CID_PATTERN;
+var init_contract = __esm({
+  "src/contract.ts"() {
+    "use strict";
+    DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
+  }
+});
+
+// src/errors.ts
+var init_errors = __esm({
+  "src/errors.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli-name.ts
+var import_node_path, CLI_NAME;
+var init_cli_name = __esm({
+  "src/cli-name.ts"() {
+    "use strict";
+    import_node_path = require("path");
+    CLI_NAME = (0, import_node_path.basename)(process.argv[1] ?? "") === "tinycloud" ? "tinycloud" : "tc";
+  }
+});
+
+// src/revoked-grant.ts
+var import_sdk_services, REVOKED_GRANT_MESSAGE;
+var init_revoked_grant = __esm({
+  "src/revoked-grant.ts"() {
+    "use strict";
+    import_sdk_services = require("@tinycloud/sdk-services");
+    init_cli_name();
+    REVOKED_GRANT_MESSAGE = `This grant was revoked. Ask the owner for a new grant (\`${CLI_NAME} auth request ...\`).`;
+  }
+});
+
+// src/kv-failure.ts
+function nodeRevocationOf(error) {
+  if (typeof error !== "object" || error === null || !("service" in error) || error.service !== "kv" || !("code" in error) || error.code !== "AUTH_UNAUTHORIZED" && error.code !== "AUTH_DELEGATION_REVOKED" && error.code !== "AUTH_DELEGATION_ANCESTOR_REVOKED" || !("message" in error) || typeof error.message !== "string" || !("meta" in error) || typeof error.meta !== "object" || error.meta === null || !("status" in error.meta) || error.meta.status !== 401 || (0, import_sdk_services2.authorizationVerdictOf)(error) !== "unauthenticated") return void 0;
+  const { code, message } = error;
+  const separator = ": 401 - ";
+  const start = message.indexOf(separator);
+  if (start < 0) return void 0;
+  const body = message.slice(start + separator.length);
+  const match = NODE_REVOCATION_BODY.exec(body);
+  if (match === null || match[0] !== body) return void 0;
+  if (match[1] !== void 0 && code !== "AUTH_DELEGATION_ANCESTOR_REVOKED") {
+    const revokedCid = match[2];
+    return DELEGATION_CID.test(revokedCid) ? { reason: "delegation_revoked", revokedCid } : void 0;
+  }
+  if (match[3] !== void 0 && code !== "AUTH_DELEGATION_REVOKED") {
+    const ancestorCid = match[4];
+    const revokedCid = match[5];
+    return DELEGATION_CID.test(ancestorCid) && DELEGATION_CID.test(revokedCid) ? { reason: "delegation_ancestor_revoked", revokedCid, ancestorCid } : void 0;
+  }
+  return void 0;
+}
+var import_sdk_services2, DELEGATION_CID, NODE_REVOCATION_BODY;
+var init_kv_failure = __esm({
+  "src/kv-failure.ts"() {
+    "use strict";
+    import_sdk_services2 = require("@tinycloud/sdk-services");
+    init_contract();
+    init_errors();
+    init_revoked_grant();
+    DELEGATION_CID = new RegExp(DELEGATION_CID_PATTERN);
+    NODE_REVOCATION_BODY = /^(?:Invalid invocation: )?delegation-(?:(revoked): ([A-Za-z0-9]+)|(ancestor-revoked): ancestor=([A-Za-z0-9]+) invoked=([A-Za-z0-9]+))$/;
+  }
+});
+
+// ../sdk-core/src/policy/errors.ts
+var SignedObjectProfileError, SignedObjectCanonicalizationError;
+var init_errors2 = __esm({
+  "../sdk-core/src/policy/errors.ts"() {
+    "use strict";
+    SignedObjectProfileError = class extends Error {
+      constructor(code, message) {
+        super(message);
+        this.name = "SignedObjectProfileError";
+        this.code = code;
+      }
+    };
+    SignedObjectCanonicalizationError = class extends SignedObjectProfileError {
+      constructor(message) {
+        super("canonicalization-mismatch", message);
+        this.name = "SignedObjectCanonicalizationError";
+      }
+    };
+  }
+});
+
+// ../sdk-core/src/policy/jcs.ts
+function jcsCanonicalize(input) {
+  return serialize(normalizeJson(input, "$"));
+}
+function normalizeJson(input, path = "$") {
+  if (input === null) {
+    return null;
+  }
+  switch (typeof input) {
+    case "boolean":
+      return input;
+    case "number":
+      if (!Number.isFinite(input)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path} must be a finite JSON number`
+        );
+      }
+      return input;
+    case "string":
+      assertUnicodeScalarString(input, path);
+      return input;
+    case "object":
+      return normalizeJsonObjectOrArray(input, path);
+    case "bigint":
+    case "function":
+    case "symbol":
+    case "undefined":
+    default:
+      throw new SignedObjectCanonicalizationError(
+        `${path} is not a JSON value`
+      );
+  }
+}
+function serialize(value) {
+  if (value === null) {
+    return "null";
+  }
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "number": {
+      const encoded = JSON.stringify(value);
+      if (encoded === void 0) {
+        throw new SignedObjectCanonicalizationError(
+          "number could not be serialized as JSON"
+        );
+      }
+      return encoded;
+    }
+    case "string":
+      return JSON.stringify(value);
+    case "object":
+      if (Array.isArray(value)) {
+        return `[${value.map((item) => serialize(item)).join(",")}]`;
+      }
+      return serializeObject(value);
+    default:
+      throw new SignedObjectCanonicalizationError(
+        `unsupported JSON value type ${typeof value}`
+      );
+  }
+}
+function normalizeJsonObjectOrArray(input, path) {
+  assertNoSymbolKeys(input, path);
+  if (Array.isArray(input)) {
+    for (const key of Object.getOwnPropertyNames(input)) {
+      if (key === "length") {
+        continue;
+      }
+      if (!isArrayIndexKey(key, input.length)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}.${key} is not allowed on a JSON array`
+        );
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(input, key);
+      if (descriptor?.enumerable !== true) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}[${key}] must be an enumerable JSON array item`
+        );
+      }
+      if (!("value" in descriptor)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}[${key}] must be a JSON data property`
+        );
+      }
+    }
+    const output2 = [];
+    for (let index = 0; index < input.length; index++) {
+      if (!objectHasOwn(input, index)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}[${index}] must not be a sparse array hole`
+        );
+      }
+      output2.push(normalizeJson(input[index], `${path}[${index}]`));
+    }
+    return output2;
+  }
+  const proto = Object.getPrototypeOf(input);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new SignedObjectCanonicalizationError(
+      `${path} must be a plain JSON object`
+    );
+  }
+  const output = /* @__PURE__ */ Object.create(null);
+  for (const key of Object.getOwnPropertyNames(input)) {
+    assertUnicodeScalarString(key, `${path} key`);
+    if (key === "__proto__" || key === "constructor") {
+      throw new SignedObjectCanonicalizationError(
+        `${path}.${key} is not allowed`
+      );
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(input, key);
+    if (descriptor?.enumerable !== true) {
+      throw new SignedObjectCanonicalizationError(
+        `${path}.${key} must be an enumerable JSON object property`
+      );
+    }
+    if (!("value" in descriptor)) {
+      throw new SignedObjectCanonicalizationError(
+        `${path}.${key} must be a JSON data property`
+      );
+    }
+    const value = descriptor.value;
+    output[key] = normalizeJson(value, `${path}.${key}`);
+  }
+  return output;
+}
+function assertNoSymbolKeys(input, path) {
+  if (Object.getOwnPropertySymbols(input).length > 0) {
+    throw new SignedObjectCanonicalizationError(
+      `${path} must not have symbol properties`
+    );
+  }
+}
+function isArrayIndexKey(key, length) {
+  if (!/^(0|[1-9]\d*)$/.test(key)) {
+    return false;
+  }
+  const index = Number(key);
+  return Number.isSafeInteger(index) && index >= 0 && index < length;
+}
+function serializeObject(value) {
+  const keys = Object.keys(value).sort(compareUtf16CodeUnits);
+  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);
+  return `{${parts.join(",")}}`;
+}
+function compareUtf16CodeUnits(a, b) {
+  const max = Math.min(a.length, b.length);
+  for (let index = 0; index < max; index++) {
+    const leftCodeUnit = a.charCodeAt(index);
+    const rightCodeUnit = b.charCodeAt(index);
+    if (leftCodeUnit !== rightCodeUnit) {
+      return leftCodeUnit - rightCodeUnit;
+    }
+  }
+  return a.length - b.length;
+}
+function assertUnicodeScalarString(value, path) {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (Number.isNaN(next) || next < 56320 || next > 57343) {
+        throw new SignedObjectCanonicalizationError(
+          `${path} contains a lone high surrogate`
+        );
+      }
+      index++;
+      continue;
+    }
+    if (code >= 56320 && code <= 57343) {
+      throw new SignedObjectCanonicalizationError(
+        `${path} contains a lone low surrogate`
+      );
+    }
+  }
+}
+var objectHasOwn;
+var init_jcs = __esm({
+  "../sdk-core/src/policy/jcs.ts"() {
+    "use strict";
+    init_errors2();
+    objectHasOwn = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
+      Object.prototype.hasOwnProperty
+    );
+  }
+});
+
+// src/authority.ts
+var init_authority = __esm({
+  "src/authority.ts"() {
+    "use strict";
+  }
+});
+
+// src/state.ts
+function processWideContext(key) {
+  var _a4;
+  const registry = globalThis;
+  return registry[_a4 = Symbol.for(key)] ?? (registry[_a4] = new import_node_async_hooks.AsyncLocalStorage());
+}
+var import_node_crypto, import_node_async_hooks, import_node_fs, import_promises, import_node_net, import_node_os, import_node_path2, invocationStateRoot, heldProfileLocks, pinnedProfiles, pinnedHomes, _a, canonicalHomes, _a2, processInstanceId, _a3, relinquishedTurns;
+var init_state = __esm({
+  "src/state.ts"() {
+    "use strict";
+    import_node_crypto = require("crypto");
+    import_node_async_hooks = require("async_hooks");
+    import_node_fs = require("fs");
+    import_promises = require("fs/promises");
+    import_node_net = require("net");
+    import_node_os = require("os");
+    import_node_path2 = require("path");
+    invocationStateRoot = processWideContext("tinycloud.operations.invocationStateRoot.v1");
+    heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v2");
+    pinnedProfiles = processWideContext("tinycloud.operations.pinnedProfiles.v2");
+    pinnedHomes = processWideContext("tinycloud.operations.pinnedHomes.v2");
+    canonicalHomes = globalThis[_a = /* @__PURE__ */ Symbol.for("tinycloud.operations.canonicalHomes.v1")] ?? (globalThis[_a] = /* @__PURE__ */ new Map());
+    processInstanceId = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.profileLockInstance.v1")] ?? (globalThis[_a2] = (0, import_node_crypto.randomUUID)());
+    relinquishedTurns = globalThis[_a3 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a3] = /* @__PURE__ */ new Set());
+  }
+});
+
+// src/artifacts.ts
+var import_node_crypto2, import_zod, THIRTY_DAYS_MS, PermissionEntrySchema, CommandSchema, LegacyPermissionRequestArtifactSchema, PortableDelegationSchema, PermissionRequestArtifactSchema, DelegationImportArtifactSchema, DelegationRequestBindingSchema;
+var init_artifacts = __esm({
+  "src/artifacts.ts"() {
+    "use strict";
+    import_node_crypto2 = require("crypto");
+    import_zod = require("zod");
+    init_authority();
+    init_state();
+    init_authority();
+    THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
+    PermissionEntrySchema = import_zod.z.object({
+      service: import_zod.z.string().min(1),
+      space: import_zod.z.string().min(1).optional(),
+      path: import_zod.z.string(),
+      actions: import_zod.z.array(import_zod.z.string().min(1)).min(1),
+      caveats: import_zod.z.array(import_zod.z.record(import_zod.z.unknown())).optional(),
+      skipPrefix: import_zod.z.boolean().optional(),
+      expiry: import_zod.z.string().min(1).optional(),
+      description: import_zod.z.string().optional()
+    }).strict();
+    CommandSchema = import_zod.z.object({
+      argv: import_zod.z.array(import_zod.z.string()).min(1),
+      cwd: import_zod.z.string().min(1)
+    }).strict();
+    LegacyPermissionRequestArtifactSchema = import_zod.z.object({
+      kind: import_zod.z.literal("tinycloud.auth.request"),
+      version: import_zod.z.literal(1),
+      requestId: import_zod.z.string(),
+      sessionDid: import_zod.z.string().min(1),
+      requested: import_zod.z.array(PermissionEntrySchema),
+      requestedExpiry: import_zod.z.union([import_zod.z.string(), import_zod.z.number().finite()]).optional()
+    }).strict();
+    PortableDelegationSchema = import_zod.z.lazy(() => import_zod.z.object({
+      cid: import_zod.z.string().min(1),
+      spaceId: import_zod.z.string().min(1),
+      path: import_zod.z.string(),
+      actions: import_zod.z.array(import_zod.z.string().min(1)).min(1),
+      delegateDID: import_zod.z.string().min(1),
+      ownerAddress: import_zod.z.string().min(1),
+      chainId: import_zod.z.number().int().positive(),
+      expiry: import_zod.z.union([import_zod.z.string().datetime({ offset: true }), import_zod.z.date()]),
+      delegationHeader: import_zod.z.object({ Authorization: import_zod.z.string().min(1) }).strict(),
+      host: import_zod.z.string().min(1).optional(),
+      disableSubDelegation: import_zod.z.boolean().optional(),
+      publicDelegation: PortableDelegationSchema.optional(),
+      resources: import_zod.z.array(PermissionEntrySchema).optional()
+    }).passthrough());
+    PermissionRequestArtifactSchema = import_zod.z.object({
+      kind: import_zod.z.literal("tinycloud.auth.request"),
+      version: import_zod.z.literal(1),
+      requestId: import_zod.z.string().min(1),
+      createdAt: import_zod.z.string().datetime({ offset: true }),
+      profile: import_zod.z.string().min(1),
+      posture: import_zod.z.enum(["owner-openkey", "delegate-session", "local-owner-key", "unauthenticated"]),
+      operatorType: import_zod.z.enum(["human", "agent"]),
+      host: import_zod.z.string().min(1),
+      sessionDid: import_zod.z.string().min(1),
+      ownerDid: import_zod.z.string().min(1).optional(),
+      spaceId: import_zod.z.string().min(1).optional(),
+      requestedExpiry: import_zod.z.union([import_zod.z.string().min(1), import_zod.z.number().finite()]).optional(),
+      requested: import_zod.z.array(PermissionEntrySchema),
+      command: CommandSchema.optional()
+    }).strict();
+    DelegationImportArtifactSchema = import_zod.z.object({
+      kind: import_zod.z.literal("tinycloud.auth.delegation"),
+      version: import_zod.z.literal(1),
+      requestId: import_zod.z.string().min(1),
+      delegationCid: import_zod.z.string().min(1).optional(),
+      delegation: PortableDelegationSchema,
+      // This field is presentation metadata only. A later import operation obtains
+      // effective permissions from validated, installed delegation authority.
+      permissions: import_zod.z.array(PermissionEntrySchema).optional(),
+      expiry: import_zod.z.string().datetime({ offset: true }).optional(),
+      prompted: import_zod.z.boolean().optional()
+    }).strict();
+    DelegationRequestBindingSchema = PermissionRequestArtifactSchema.pick({ requestId: true, requested: true }).strict();
+  }
+});
+
+// src/recovery.ts
+var init_recovery = __esm({
+  "src/recovery.ts"() {
+    "use strict";
+    init_cli_name();
+  }
+});
+
+// src/secrets.ts
+var nodeSdk;
+var init_secrets = __esm({
+  "src/secrets.ts"() {
+    "use strict";
+    nodeSdk = __toESM(require("@tinycloud/node-sdk"), 1);
+    init_errors();
+  }
+});
+
+// src/mcp-authority.ts
+var mcp_authority_exports = {};
+__export(mcp_authority_exports, {
+  nodeRevocationOf: () => nodeRevocationOf,
+  operationRetryDescriptor: () => operationRetryDescriptor
+});
+module.exports = __toCommonJS(mcp_authority_exports);
+init_kv_failure();
+
+// src/invoke.ts
+var import_node_crypto3 = require("crypto");
+var import_node_path3 = require("path");
+init_cli_name();
+var import_node_sdk2 = require("@tinycloud/node-sdk");
+init_jcs();
+init_errors();
+init_authority();
+init_artifacts();
+
+// src/redaction.ts
+var import_node_sdk = require("@tinycloud/node-sdk");
+init_contract();
+init_recovery();
+var DELEGATION_CID2 = new RegExp(DELEGATION_CID_PATTERN);
+
+// src/invoke.ts
+init_state();
+init_secrets();
+function operationRetryDescriptor(operation, input, requiresCallerInput = false) {
+  return {
+    operationId: operation.operationId,
+    operationVersion: operation.operationVersion,
+    inputDigest: (0, import_node_crypto3.createHash)("sha256").update(jcsCanonicalize(input), "utf8").digest("hex"),
+    requiresCallerInput
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  nodeRevocationOf,
+  operationRetryDescriptor
+});
+//# sourceMappingURL=mcp-authority.cjs.map