@tinycloud/sdk-core 2.2.0-beta.3 → 2.2.0-beta.6

package/dist/index.js

@@ -2694,12 +2694,6 @@ var DEFAULT_STANDARD_ENTRIES = [
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
     actions: ["read", "write"]
-  },
-  {
-    service: "tinycloud.capabilities",
-    space: DEFAULT_MANIFEST_SPACE,
-    path: "/",
-    actions: ["read"]
   }
 ];
 var DEFAULT_ADMIN_ENTRIES = [
@@ -2714,12 +2708,6 @@ var DEFAULT_ADMIN_ENTRIES = [
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
     actions: ["read", "write", "ddl"]
-  },
-  {
-    service: "tinycloud.capabilities",
-    space: DEFAULT_MANIFEST_SPACE,
-    path: "/",
-    actions: ["read", "admin"]
   }
 ];
 var DEFAULT_ALL_ENTRIES = [
@@ -2740,12 +2728,6 @@ var DEFAULT_ALL_ENTRIES = [
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
     actions: ["read", "write"]
-  },
-  {
-    service: "tinycloud.capabilities",
-    space: DEFAULT_MANIFEST_SPACE,
-    path: "/",
-    actions: ["read", "admin"]
   }
 ];
 function parseExpiry(duration) {
@@ -2895,7 +2877,8 @@ function defaultEntriesForTier(tier) {
     service: e.service,
     space: e.space,
     path: e.path,
-    actions: [...e.actions]
+    actions: [...e.actions],
+    ...e.skipPrefix !== void 0 ? { skipPrefix: e.skipPrefix } : {}
   }));
 }
 function resolveManifest(input) {
@@ -2908,8 +2891,8 @@ function resolveManifest(input) {
   const defaultEntries = defaultEntriesForTier(tier);
   const explicitEntries = manifest.permissions ?? [];
   const allEntries = [...defaultEntries, ...explicitEntries];
-  const resources = allEntries.map(
-    (entry) => resolveEntry(entry, prefix, expiryMs, space)
+  const resources = withCapabilitiesReadForSpaces(
+    allEntries.map((entry) => resolveEntry(entry, prefix, expiryMs, space))
   );
   const additionalDelegates = manifest.did === void 0 ? [] : [
     {
@@ -2992,6 +2975,24 @@ function dedupeResources(resources) {
   }
   return [...byKey.values()];
 }
+function capabilitiesReadPermission(space) {
+  return {
+    service: "tinycloud.capabilities",
+    space,
+    path: "",
+    actions: ["tinycloud.capabilities/read"]
+  };
+}
+function withCapabilitiesReadForSpaces(resources) {
+  if (resources.length === 0) {
+    return [];
+  }
+  const spaces = new Set(resources.map((resource) => resource.space));
+  return dedupeResources([
+    ...resources,
+    ...[...spaces].map(capabilitiesReadPermission)
+  ]);
+}
 function accountRegistryPermission() {
   return {
     service: "tinycloud.kv",
@@ -3019,6 +3020,7 @@ function composeManifestRequest(inputs, options = {}) {
   if (includeAccountRegistryPermissions) {
     resources.push(accountRegistryPermission());
   }
+  const resourcesWithImplicitCapabilities = withCapabilitiesReadForSpaces(resources);
   const manifestsByAppId = /* @__PURE__ */ new Map();
   for (const manifest of manifests) {
     const current = manifestsByAppId.get(manifest.app_id);
@@ -3038,7 +3040,7 @@ function composeManifestRequest(inputs, options = {}) {
   })) : [];
   return {
     manifests,
-    resources: dedupeResources(resources),
+    resources: resourcesWithImplicitCapabilities,
     delegationTargets,
     registryRecords,
     expiryMs: Math.max(...resolved.map((entry) => entry.expiryMs)),
@@ -4257,6 +4259,8 @@ import { uriToMultiaddr } from "@multiformats/uri-to-multiaddr";
 import { ed25519 } from "@noble/curves/ed25519";
 import { bases } from "multiformats/basics";
 import { verifyMessage } from "viem";
+var DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
+var DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
 var LocationRecordValidationError = class extends Error {
   constructor(message) {
     super(`Location record validation failed: ${message}`);
@@ -4291,7 +4295,9 @@ function canonicalLocationPayload(payload) {
 async function signLocationRecord(payload, signer) {
   validateLocationRecordPayload(payload);
   const message = canonicalLocationPayload(payload);
-  const signature = signer.type === "did:pkh" ? await signer.signMessage(message) : base64UrlEncode2(await signer.signBytes(new TextEncoder().encode(message)));
+  const signature = signer.type === "did:pkh" ? await signer.signMessage(message) : base64UrlEncode2(
+    await signer.signBytes(new TextEncoder().encode(message))
+  );
   return { ...payload, signature };
 }
 function validateLocationRecordPayload(input) {
@@ -4305,7 +4311,9 @@ function validateLocationRecordPayload(input) {
   validateSubject(payload.subject);
   validateMultiaddrs(payload.multiaddrs);
   if (typeof payload.updated_at !== "string" || Number.isNaN(Date.parse(payload.updated_at))) {
-    throw new LocationRecordValidationError("updated_at must be an ISO timestamp");
+    throw new LocationRecordValidationError(
+      "updated_at must be an ISO timestamp"
+    );
   }
   if (typeof payload.sequence !== "number" || !Number.isSafeInteger(payload.sequence) || payload.sequence < 0) {
     throw new LocationRecordValidationError(
@@ -4324,7 +4332,9 @@ function validateLocationRecord(input) {
   const payload = validateLocationRecordPayload(input);
   const signature = input.signature;
   if (typeof signature !== "string" || signature.length === 0) {
-    throw new LocationRecordValidationError("signature must be a non-empty string");
+    throw new LocationRecordValidationError(
+      "signature must be a non-empty string"
+    );
   }
   return { ...payload, signature };
 }
@@ -4376,6 +4386,22 @@ async function resolveCloudLocation(subject, options = {}) {
     resolvedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
+async function resolveTinyCloudHosts(subject, options = {}) {
+  const location = await resolveCloudLocation(subject, {
+    explicitMultiaddrs: hostsToMultiaddrs(options.explicitHosts),
+    blockchain: options.blockchain,
+    centralizedRegistryUrl: options.registryUrl === null ? void 0 : options.registryUrl ?? DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
+    fallbackMultiaddrs: hostsToMultiaddrs(
+      options.fallbackHosts === null ? void 0 : options.fallbackHosts ?? [DEFAULT_TINYCLOUD_FALLBACK_HOST]
+    ),
+    fetch: options.fetch,
+    verifyRecords: options.verifyRecords
+  });
+  return {
+    hosts: location.multiaddrs.map((addr) => multiaddrToHttpUrl(addr)),
+    location
+  };
+}
 function multiaddrToHttpUrl(input) {
   const uri = multiaddrToUri(multiaddr(input));
   if (!uri.startsWith("http://") && !uri.startsWith("https://")) {
@@ -4392,6 +4418,14 @@ function httpUrlToMultiaddr(input) {
   }
   return uriToMultiaddr(url.toString()).toString();
 }
+function hostsToMultiaddrs(hosts) {
+  if (hosts === void 0 || hosts.length === 0) {
+    return void 0;
+  }
+  return hosts.map(
+    (host) => host.startsWith("/") ? host : httpUrlToMultiaddr(host)
+  );
+}
 async function resolveExplicit(subject, multiaddrs) {
   return resolveAttempt("explicit", async () => {
     if (multiaddrs === void 0 || multiaddrs.length === 0) {
@@ -4405,7 +4439,12 @@ async function resolveBlockchain(subject, resolver, verifyRecords) {
     if (!resolver) {
       return null;
     }
-    return toCandidate(subject, "blockchain", await resolver(subject), verifyRecords);
+    return toCandidate(
+      subject,
+      "blockchain",
+      await resolver(subject),
+      verifyRecords
+    );
   });
 }
 async function resolveCentralized(subject, options, verifyRecords) {
@@ -4457,13 +4496,17 @@ async function toCandidate(subject, source, input, verifyRecord) {
       );
     }
     if (verifyRecord && !await verifyLocationRecord(record)) {
-      throw new LocationRecordValidationError("location record signature is invalid");
+      throw new LocationRecordValidationError(
+        "location record signature is invalid"
+      );
     }
     return { source, multiaddrs: [...record.multiaddrs], record };
   }
   const candidateInput = input;
   if (!Array.isArray(candidateInput.multiaddrs)) {
-    throw new LocationRecordValidationError("candidate multiaddrs must be an array");
+    throw new LocationRecordValidationError(
+      "candidate multiaddrs must be an array"
+    );
   }
   validateMultiaddrs(candidateInput.multiaddrs);
   if (candidateInput.record !== void 0) {
@@ -4474,7 +4517,9 @@ async function toCandidate(subject, source, input, verifyRecord) {
       );
     }
     if (verifyRecord && !await verifyLocationRecord(record)) {
-      throw new LocationRecordValidationError("location record signature is invalid");
+      throw new LocationRecordValidationError(
+        "location record signature is invalid"
+      );
     }
     return { source, multiaddrs: [...candidateInput.multiaddrs], record };
   }
@@ -4482,10 +4527,14 @@ async function toCandidate(subject, source, input, verifyRecord) {
 }
 function validateSubject(subject) {
   if (typeof subject !== "string" || subject.length === 0) {
-    throw new LocationRecordValidationError("subject must be a non-empty string");
+    throw new LocationRecordValidationError(
+      "subject must be a non-empty string"
+    );
   }
   if (!subject.startsWith("did:pkh:") && !subject.startsWith("did:key:")) {
-    throw new LocationRecordValidationError("subject must be did:pkh or did:key");
+    throw new LocationRecordValidationError(
+      "subject must be did:pkh or did:key"
+    );
   }
 }
 function validateMultiaddrs(input) {
@@ -4529,16 +4578,24 @@ function verifyDidKeySignature(did, payload, signature) {
       "did:key signature must be a base64url Ed25519 signature"
     );
   }
-  return ed25519.verify(signatureBytes, new TextEncoder().encode(payload), publicKey);
+  return ed25519.verify(
+    signatureBytes,
+    new TextEncoder().encode(payload),
+    publicKey
+  );
 }
 function ed25519PublicKeyFromDidKey(did) {
   const identifier = did.slice("did:key:".length);
   if (!identifier.startsWith("z")) {
-    throw new LocationRecordValidationError("did:key must use base58btc multibase");
+    throw new LocationRecordValidationError(
+      "did:key must use base58btc multibase"
+    );
   }
   const bytes = bases.base58btc.decode(identifier);
   if (bytes.length !== 34 || bytes[0] !== 237 || bytes[1] !== 1) {
-    throw new LocationRecordValidationError("did:key must be an Ed25519 public key");
+    throw new LocationRecordValidationError(
+      "did:key must be an Ed25519 public key"
+    );
   }
   return bytes.slice(2);
 }
@@ -4708,6 +4765,8 @@ export {
   DEFAULT_EXPIRY,
   DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION,
+  DEFAULT_TINYCLOUD_FALLBACK_HOST,
+  DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
   DataVaultService,
   DatabaseHandle,
   DelegationErrorCodes,
@@ -4773,6 +4832,7 @@ export {
   parseSpaceUri,
   resolveCloudLocation,
   resolveManifest,
+  resolveTinyCloudHosts,
   resourceCapabilitiesToAbilitiesMap,
   resourceCapabilitiesToSpaceAbilitiesMap,
   serviceError4 as serviceError,