@tinycloud/sdk-core 3.1.0-beta.11 → 3.1.0-beta.12

package/dist/index.cjs

@@ -400,6 +400,7 @@ __export(index_exports, {
   parseSecretCatalogKey: () => import_sdk_services9.parseSecretCatalogKey,
   parseShareArtifact: () => parseShareArtifact,
   parseShareUrl: () => parseShareUrl,
+  parseSignedCompactUcanAttenuation: () => parseSignedCompactUcanAttenuation,
   parseSpaceUri: () => parseSpaceUri,
   pkhDid: () => pkhDid,
   policyCidFromCanonicalBytes: () => policyCidFromCanonicalBytes,
@@ -4682,6 +4683,32 @@ function parseCompactUcanAuthorization(input, expectedCid) {
     throw new Error("compact UCAN CID does not match exact Authorization bytes");
   return { authorization: input, cid: cid2, header, payload };
 }
+var SignedCompactAttenuationSchema = import_zod2.z.record(import_zod2.z.record(import_zod2.z.array(import_zod2.z.unknown()).min(1)));
+function parseSignedCompactUcanAttenuation(input, expectedCid) {
+  if (typeof input !== "string" || /\s/.test(input))
+    throw new Error("Authorization must be compact UCAN bytes");
+  const segments = input.split(".");
+  if (segments.length !== 3 || segments.some((segment) => segment.length === 0))
+    throw new Error("Authorization must have three compact segments");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  const headerValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url2(headerSegment)));
+  const payloadValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url2(payloadSegment)));
+  if (!isRecordValue(headerValue) || !isRecordValue(headerValue.jwk) || headerValue.alg !== "EdDSA" || headerValue.typ !== "JWT" || headerValue.ucv !== "0.10.0" || headerValue.jwk.kty !== "OKP" || headerValue.jwk.crv !== "Ed25519" || !isRecordValue(payloadValue) || typeof payloadValue.iss !== "string")
+    throw new Error("Authorization has an invalid signed UCAN header or issuer");
+  const att = SignedCompactAttenuationSchema.parse(payloadValue.att);
+  const principal = payloadValue.iss.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  const publicKey = didMaterial.length === 34 && didMaterial[0] === 237 && didMaterial[1] === 1 ? didMaterial.slice(2) : new Uint8Array();
+  const jwkKey = typeof headerValue.jwk.x === "string" ? decodeBase64Url2(headerValue.jwk.x) : new Uint8Array();
+  if (publicKey.length !== 32 || !equalBytes(publicKey, jwkKey))
+    throw new Error("compact UCAN JWK does not bind issuer");
+  const signature = decodeBase64Url2(signatureSegment);
+  if (!import_ed255193.ed25519.verify(signature, new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), publicKey))
+    throw new Error("compact UCAN signature is invalid");
+  const cid2 = CID.createV1(85, create(30, (0, import_blake3.blake3)(new TextEncoder().encode(input)))).toString();
+  if (expectedCid !== void 0 && cid2 !== expectedCid) throw new Error("compact UCAN CID does not match exact Authorization bytes");
+  return { cid: cid2, payload: { att } };
+}
 function parsePolicySessionUcan(authorization, expectedProofs) {
   const parsed = parseCompactUcanAuthorization(authorization);
   const fact = parsed.payload.fct[0];
@@ -7169,7 +7196,7 @@ var DelegationManager = class {
    * }
    * ```
    */
-  async revoke(cid2) {
+  async revoke(cid2, options2) {
     if (!cid2) {
       return {
         ok: false,
@@ -7189,15 +7216,20 @@ var DelegationManager = class {
           )
         };
       }
-      const headers = this.invokeAny(
-        this.session,
-        [{
-          resource: `urn:cid:${cid2}`,
-          service: "delegation",
-          path: "",
-          action: DelegationAction.REVOKE
-        }]
-      );
+      const entry = {
+        resource: `urn:cid:${cid2}`,
+        ...options2?.targetSpaceId === void 0 ? {} : { spaceId: options2.targetSpaceId },
+        service: "delegation",
+        path: "",
+        action: DelegationAction.REVOKE
+      };
+      if (options2?.authorityCid !== void 0) {
+        Object.defineProperty(entry, "revokeAuthorityCid", {
+          value: options2.authorityCid,
+          enumerable: false
+        });
+      }
+      const headers = this.invokeAny(this.session, [entry]);
       const response = await this.fetchFn(`${this.host}/revoke`, {
         method: "POST",
         headers
@@ -7355,7 +7387,8 @@ var DelegationManager = class {
         )
       };
     }
-    if (!this.accountSpaceId) {
+    const accountSpaceId = this.accountSpaceId;
+    if (!accountSpaceId) {
       return {
         ok: false,
         error: createError(
@@ -7366,7 +7399,7 @@ var DelegationManager = class {
     }
     try {
       const invocationHeaders = this.invokeAny(this.session, [{
-        spaceId: this.accountSpaceId,
+        spaceId: accountSpaceId,
         service: "delegation",
         path: "",
         action: DelegationAction.LIST