@tinycloud/sdk-core 2.2.0-beta.4 → 2.2.0-beta.6

package/dist/index.d.ts

@@ -234,7 +234,7 @@ interface PermissionEntry {
  *
  * - `false` → no auto-included permissions
  * - `true` → standard tier (KV + SQL read/write + capabilities:read)
- * - `"admin"` → standard + SQL ddl + capabilities:admin
+ * - `"admin"` → standard + SQL ddl
  * - `"all"` → everything the SDK supports (including DuckDB)
  *
  * Unknown string values silently fall back to `true`. Values are normalized
@@ -1303,11 +1303,11 @@ declare const DelegationSchema: z.ZodObject<{
     authHeader: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
-    actions: string[];
     expiry: Date;
     spaceId: string;
     cid: string;
     delegateDID: string;
+    actions: string[];
     isRevoked: boolean;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
@@ -1316,11 +1316,11 @@ declare const DelegationSchema: z.ZodObject<{
     authHeader?: string | undefined;
 }, {
     path: string;
-    actions: string[];
     expiry: Date;
     spaceId: string;
     cid: string;
     delegateDID: string;
+    actions: string[];
     isRevoked: boolean;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
@@ -1461,11 +1461,11 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         authHeader: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1474,11 +1474,11 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         authHeader?: string | undefined;
     }, {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1510,11 +1510,11 @@ declare const CapabilityEntrySchema: z.ZodObject<{
     }[];
     delegation: {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1547,11 +1547,11 @@ declare const CapabilityEntrySchema: z.ZodObject<{
     }[];
     delegation: {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1594,10 +1594,10 @@ declare const DelegationRecordSchema: z.ZodObject<{
     parentCid: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
-    actions: string[];
     spaceId: string;
     createdAt: Date;
     cid: string;
+    actions: string[];
     isRevoked: boolean;
     delegator: string;
     delegatee: string;
@@ -1607,10 +1607,10 @@ declare const DelegationRecordSchema: z.ZodObject<{
     keyId?: string | undefined;
 }, {
     path: string;
-    actions: string[];
     spaceId: string;
     createdAt: Date;
     cid: string;
+    actions: string[];
     isRevoked: boolean;
     delegator: string;
     delegatee: string;
@@ -1638,15 +1638,15 @@ declare const CreateDelegationParamsSchema: z.ZodObject<{
     statement: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
-    actions: string[];
     delegateDID: string;
+    actions: string[];
     statement?: string | undefined;
     expiry?: Date | undefined;
     disableSubDelegation?: boolean | undefined;
 }, {
     path: string;
-    actions: string[];
     delegateDID: string;
+    actions: string[];
     statement?: string | undefined;
     expiry?: Date | undefined;
     disableSubDelegation?: boolean | undefined;
@@ -1682,11 +1682,11 @@ declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
     authHeader: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
-    actions: string[];
     expiry: Date;
     spaceId: string;
     cid: string;
     delegateDID: string;
+    actions: string[];
     isRevoked: boolean;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
@@ -1695,11 +1695,11 @@ declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
     authHeader?: string | undefined;
 }, {
     path: string;
-    actions: string[];
     expiry: Date;
     spaceId: string;
     cid: string;
     delegateDID: string;
+    actions: string[];
     isRevoked: boolean;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
@@ -1740,11 +1740,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1753,11 +1753,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader?: string | undefined;
     }, {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1793,11 +1793,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1806,11 +1806,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader?: string | undefined;
     }, {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1846,11 +1846,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1859,11 +1859,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader?: string | undefined;
     }, {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1874,11 +1874,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     root: {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1888,11 +1888,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
     };
     chain: {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1902,11 +1902,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
     }[];
     leaf: {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1917,11 +1917,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
 }, {
     root: {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1931,11 +1931,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
     };
     chain: {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1945,11 +1945,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
     }[];
     leaf: {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -2086,11 +2086,11 @@ declare const ShareLinkSchema: z.ZodObject<{
         authHeader: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -2099,11 +2099,11 @@ declare const ShareLinkSchema: z.ZodObject<{
         authHeader?: string | undefined;
     }, {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -2121,11 +2121,11 @@ declare const ShareLinkSchema: z.ZodObject<{
     url: string;
     delegation: {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -2141,11 +2141,11 @@ declare const ShareLinkSchema: z.ZodObject<{
     url: string;
     delegation: {
         path: string;
-        actions: string[];
         expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
+        actions: string[];
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -2211,16 +2211,16 @@ declare const GenerateShareParamsSchema: z.ZodObject<{
     baseUrl: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
-    actions?: string[] | undefined;
-    expiry?: Date | undefined;
     description?: string | undefined;
+    expiry?: Date | undefined;
+    actions?: string[] | undefined;
     schema?: "base64" | "compact" | "ipfs" | undefined;
     baseUrl?: string | undefined;
 }, {
     path: string;
-    actions?: string[] | undefined;
-    expiry?: Date | undefined;
     description?: string | undefined;
+    expiry?: Date | undefined;
+    actions?: string[] | undefined;
     schema?: "base64" | "compact" | "ipfs" | undefined;
     baseUrl?: string | undefined;
 }>;
@@ -2318,13 +2318,13 @@ declare const DelegatedResourceSchema: z.ZodObject<{
     actions: z.ZodArray<z.ZodString, "many">;
 }, "strip", z.ZodTypeAny, {
     path: string;
-    service: string;
     space: string;
+    service: string;
     actions: string[];
 }, {
     path: string;
-    service: string;
     space: string;
+    service: string;
     actions: string[];
 }>;
 type DelegatedResource = z.infer<typeof DelegatedResourceSchema>;
@@ -2416,20 +2416,20 @@ declare const CreateDelegationWasmResultSchema: z.ZodObject<{
         actions: z.ZodArray<z.ZodString, "many">;
     }, "strip", z.ZodTypeAny, {
         path: string;
-        service: string;
         space: string;
+        service: string;
         actions: string[];
     }, {
         path: string;
-        service: string;
         space: string;
+        service: string;
         actions: string[];
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     resources: {
         path: string;
-        service: string;
         space: string;
+        service: string;
         actions: string[];
     }[];
     expiry: Date;
@@ -2439,8 +2439,8 @@ declare const CreateDelegationWasmResultSchema: z.ZodObject<{
 }, {
     resources: {
         path: string;
-        service: string;
         space: string;
+        service: string;
         actions: string[];
     }[];
     expiry: Date;

package/dist/index.js

@@ -2694,12 +2694,6 @@ var DEFAULT_STANDARD_ENTRIES = [
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
     actions: ["read", "write"]
-  },
-  {
-    service: "tinycloud.capabilities",
-    space: DEFAULT_MANIFEST_SPACE,
-    path: "/",
-    actions: ["read"]
   }
 ];
 var DEFAULT_ADMIN_ENTRIES = [
@@ -2714,12 +2708,6 @@ var DEFAULT_ADMIN_ENTRIES = [
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
     actions: ["read", "write", "ddl"]
-  },
-  {
-    service: "tinycloud.capabilities",
-    space: DEFAULT_MANIFEST_SPACE,
-    path: "/",
-    actions: ["read", "admin"]
   }
 ];
 var DEFAULT_ALL_ENTRIES = [
@@ -2740,12 +2728,6 @@ var DEFAULT_ALL_ENTRIES = [
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
     actions: ["read", "write"]
-  },
-  {
-    service: "tinycloud.capabilities",
-    space: DEFAULT_MANIFEST_SPACE,
-    path: "/",
-    actions: ["read", "admin"]
   }
 ];
 function parseExpiry(duration) {
@@ -2895,7 +2877,8 @@ function defaultEntriesForTier(tier) {
     service: e.service,
     space: e.space,
     path: e.path,
-    actions: [...e.actions]
+    actions: [...e.actions],
+    ...e.skipPrefix !== void 0 ? { skipPrefix: e.skipPrefix } : {}
   }));
 }
 function resolveManifest(input) {
@@ -2908,8 +2891,8 @@ function resolveManifest(input) {
   const defaultEntries = defaultEntriesForTier(tier);
   const explicitEntries = manifest.permissions ?? [];
   const allEntries = [...defaultEntries, ...explicitEntries];
-  const resources = allEntries.map(
-    (entry) => resolveEntry(entry, prefix, expiryMs, space)
+  const resources = withCapabilitiesReadForSpaces(
+    allEntries.map((entry) => resolveEntry(entry, prefix, expiryMs, space))
   );
   const additionalDelegates = manifest.did === void 0 ? [] : [
     {
@@ -2992,6 +2975,24 @@ function dedupeResources(resources) {
   }
   return [...byKey.values()];
 }
+function capabilitiesReadPermission(space) {
+  return {
+    service: "tinycloud.capabilities",
+    space,
+    path: "",
+    actions: ["tinycloud.capabilities/read"]
+  };
+}
+function withCapabilitiesReadForSpaces(resources) {
+  if (resources.length === 0) {
+    return [];
+  }
+  const spaces = new Set(resources.map((resource) => resource.space));
+  return dedupeResources([
+    ...resources,
+    ...[...spaces].map(capabilitiesReadPermission)
+  ]);
+}
 function accountRegistryPermission() {
   return {
     service: "tinycloud.kv",
@@ -3019,6 +3020,7 @@ function composeManifestRequest(inputs, options = {}) {
   if (includeAccountRegistryPermissions) {
     resources.push(accountRegistryPermission());
   }
+  const resourcesWithImplicitCapabilities = withCapabilitiesReadForSpaces(resources);
   const manifestsByAppId = /* @__PURE__ */ new Map();
   for (const manifest of manifests) {
     const current = manifestsByAppId.get(manifest.app_id);
@@ -3038,7 +3040,7 @@ function composeManifestRequest(inputs, options = {}) {
   })) : [];
   return {
     manifests,
-    resources: dedupeResources(resources),
+    resources: resourcesWithImplicitCapabilities,
     delegationTargets,
     registryRecords,
     expiryMs: Math.max(...resolved.map((entry) => entry.expiryMs)),