@tinycloud/sdk-core 3.1.0-beta.8 → 3.1.0

package/dist/index.js

@@ -4207,6 +4207,32 @@ function parseCompactUcanAuthorization(input, expectedCid) {
     throw new Error("compact UCAN CID does not match exact Authorization bytes");
   return { authorization: input, cid: cid2, header, payload };
 }
+var SignedCompactAttenuationSchema = z2.record(z2.record(z2.array(z2.unknown()).min(1)));
+function parseSignedCompactUcanAttenuation(input, expectedCid) {
+  if (typeof input !== "string" || /\s/.test(input))
+    throw new Error("Authorization must be compact UCAN bytes");
+  const segments = input.split(".");
+  if (segments.length !== 3 || segments.some((segment) => segment.length === 0))
+    throw new Error("Authorization must have three compact segments");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  const headerValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url2(headerSegment)));
+  const payloadValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url2(payloadSegment)));
+  if (!isRecordValue(headerValue) || !isRecordValue(headerValue.jwk) || headerValue.alg !== "EdDSA" || headerValue.typ !== "JWT" || headerValue.ucv !== "0.10.0" || headerValue.jwk.kty !== "OKP" || headerValue.jwk.crv !== "Ed25519" || !isRecordValue(payloadValue) || typeof payloadValue.iss !== "string")
+    throw new Error("Authorization has an invalid signed UCAN header or issuer");
+  const att = SignedCompactAttenuationSchema.parse(payloadValue.att);
+  const principal = payloadValue.iss.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  const publicKey = didMaterial.length === 34 && didMaterial[0] === 237 && didMaterial[1] === 1 ? didMaterial.slice(2) : new Uint8Array();
+  const jwkKey = typeof headerValue.jwk.x === "string" ? decodeBase64Url2(headerValue.jwk.x) : new Uint8Array();
+  if (publicKey.length !== 32 || !equalBytes(publicKey, jwkKey))
+    throw new Error("compact UCAN JWK does not bind issuer");
+  const signature = decodeBase64Url2(signatureSegment);
+  if (!ed255193.verify(signature, new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), publicKey))
+    throw new Error("compact UCAN signature is invalid");
+  const cid2 = CID.createV1(85, create(30, blake3(new TextEncoder().encode(input)))).toString();
+  if (expectedCid !== void 0 && cid2 !== expectedCid) throw new Error("compact UCAN CID does not match exact Authorization bytes");
+  return { cid: cid2, payload: { att } };
+}
 function parsePolicySessionUcan(authorization, expectedProofs) {
   const parsed = parseCompactUcanAuthorization(authorization);
   const fact = parsed.payload.fct[0];
@@ -6694,7 +6720,7 @@ var DelegationManager = class {
    * }
    * ```
    */
-  async revoke(cid2) {
+  async revoke(cid2, options2) {
     if (!cid2) {
       return {
         ok: false,
@@ -6714,15 +6740,20 @@ var DelegationManager = class {
           )
         };
       }
-      const headers = this.invokeAny(
-        this.session,
-        [{
-          resource: `urn:cid:${cid2}`,
-          service: "delegation",
-          path: "",
-          action: DelegationAction.REVOKE
-        }]
-      );
+      const entry = {
+        resource: `urn:cid:${cid2}`,
+        ...options2?.targetSpaceId === void 0 ? {} : { spaceId: options2.targetSpaceId },
+        service: "delegation",
+        path: "",
+        action: DelegationAction.REVOKE
+      };
+      if (options2?.authorityCid !== void 0) {
+        Object.defineProperty(entry, "revokeAuthorityCid", {
+          value: options2.authorityCid,
+          enumerable: false
+        });
+      }
+      const headers = this.invokeAny(this.session, [entry]);
       const response = await this.fetchFn(`${this.host}/revoke`, {
         method: "POST",
         headers
@@ -6880,7 +6911,8 @@ var DelegationManager = class {
         )
       };
     }
-    if (!this.accountSpaceId) {
+    const accountSpaceId = this.accountSpaceId;
+    if (!accountSpaceId) {
       return {
         ok: false,
         error: createError(
@@ -6891,7 +6923,7 @@ var DelegationManager = class {
     }
     try {
       const invocationHeaders = this.invokeAny(this.session, [{
-        spaceId: this.accountSpaceId,
+        spaceId: accountSpaceId,
         service: "delegation",
         path: "",
         action: DelegationAction.LIST
@@ -8189,8 +8221,17 @@ function canonicalizeRecapCaveats(caveats) {
   }
   return `[${branches.join(",")}]`;
 }
+var EXPLICIT_ONLY_ACTIONS = {
+  "tinycloud.kv/sync": true,
+  "tinycloud.kv/retain": true
+};
+function isExplicitOnlyAction(action) {
+  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);
+}
 function actionContains(grantedAction, requestedAction) {
-  if (grantedAction === "*" || grantedAction === requestedAction) return true;
+  if (grantedAction === requestedAction) return true;
+  if (isExplicitOnlyAction(requestedAction)) return false;
+  if (grantedAction === "*") return true;
   if (!grantedAction.endsWith("/*")) return false;
   const service = grantedAction.slice(0, -2);
   return requestedAction === service || requestedAction.startsWith(`${service}/`);
@@ -10877,7 +10918,9 @@ var SharingService = class {
         if (delegation.allowSubDelegation === false) continue;
         if (!this.pathMatches(delegation.path || "", path)) continue;
         const delegationActions = delegation.actions || [];
-        if (!actions.every((action) => delegationActions.includes(action) || delegationActions.includes("*"))) {
+        if (!actions.every(
+          (action) => delegationActions.some((granted) => actionContains(granted, action))
+        )) {
           continue;
         }
         if ((delegation.caveats?.length ?? 0) > 0) {
@@ -13965,6 +14008,56 @@ var AccountService = class {
         await this.upsertSpacesIndexQuietly(registered);
         return ok3({ spaces: registered, recoveredFromBatchError: batchResult.error });
       },
+      /**
+       * Register only spaces without a registry record (TC-800). Existing
+       * records, including renamed or archived ones, are kept byte-for-byte.
+       * Bootstrap repair uses this on populated accounts.
+       */
+      registerMissing: async (spaces) => {
+        if (spaces.length === 0) return ok3([]);
+        await this.config.ensureAccountSpaceHosted?.();
+        const kvResult = this.accountKV();
+        if (!kvResult.ok) return kvResult;
+        const kv = kvResult.data;
+        const stored = spaces.map((space) => spaceRecordFromInput(space));
+        const keys = stored.map((record2) => spaceKey(record2.space_id));
+        const read2 = await kv.batchGet(keys);
+        if (!read2.ok) return accountErr(read2.error);
+        const byKey = new Map(read2.data.results.map((result) => [result.key, result.result]));
+        const final = new Array(keys.length);
+        const missing = [];
+        for (let i = 0; i < keys.length; i++) {
+          const key = keys[i];
+          const result = byKey.get(key);
+          if (!result) {
+            return err3(serviceError4(
+              ErrorCodes4.NETWORK_ERROR,
+              `KV batch read omitted requested key ${JSON.stringify(key)}`,
+              SERVICE_NAME2
+            ));
+          }
+          if (result.ok) {
+            final[i] = spaceFromRecord(key, result.data.data);
+          } else if (result.error.code === ErrorCodes4.KV_NOT_FOUND) {
+            missing.push({ index: i, key, record: stored[i] });
+          } else {
+            return accountErr(result.error);
+          }
+        }
+        const creates = await Promise.all(missing.map(async ({ index, key, record: record2 }) => {
+          const written = await kv.put(key, record2, { ifNoneMatch: "*" });
+          if (written.ok) return { index, result: ok3(spaceFromRecord(key, record2)) };
+          const raced = await kv.get(key);
+          if (raced.ok) return { index, result: ok3(spaceFromRecord(key, raced.data.data)) };
+          return { index, result: err3(written.error) };
+        }));
+        for (const { index, result } of creates) {
+          if (!result.ok) return accountErr(result.error);
+          final[index] = result.data;
+        }
+        await this.upsertSpacesIndexQuietly(final);
+        return ok3(final);
+      },
       syncAccessible: async () => {
         const synced = await this.syncAccessibleSpaces({ tolerateStorageFull: false });
         return synced.ok ? ok3(synced.data.spaces) : synced;
@@ -16030,10 +16123,12 @@ import {
   BOOTSTRAP_SESSION_REQUESTS,
   BOOTSTRAP_SPACE_MANIFESTS,
   BOOTSTRAP_SPACE_NAMES,
+  AGENTS_SPACE,
   SECRET_RECORDS_SCHEMA,
   TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
   TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
   TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_AGENTS_SPACE_MANIFEST,
   TINYCLOUD_PUBLIC_SPACE_MANIFEST,
   TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   bootstrapEncryptionNetworkId,
@@ -18528,6 +18623,7 @@ export {
   ACCOUNT_MANIFEST_PERMISSIONS2 as ACCOUNT_MANIFEST_PERMISSIONS,
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE,
+  AGENTS_SPACE,
   ATTESTED_ENFORCER_BINDING_V2_SCHEMA,
   AccountService,
   AutoApproveSpaceCreationHandler,
@@ -18700,6 +18796,7 @@ export {
   SpaceErrorCodes,
   SpaceService,
   TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_AGENTS_SPACE_MANIFEST,
   TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
   TINYCLOUD_CANONICAL_IDENTITY_CLAIM,
   TINYCLOUD_DEFAULT_SPACE_MANIFEST,
@@ -18844,6 +18941,7 @@ export {
   isCapabilitySubset,
   isDigest,
   isEvmAddress,
+  isExplicitOnlyAction,
   isNetworkId,
   isPlausibleOpenKeyActionId,
   isStorageFullError2 as isStorageFullError,
@@ -18882,6 +18980,7 @@ export {
   parseSecretCatalogKey,
   parseShareArtifact,
   parseShareUrl,
+  parseSignedCompactUcanAttenuation,
   parseSpaceUri,
   pkhDid,
   policyCidFromCanonicalBytes,