@tinycloud/sdk-core 3.2.6-beta.2 → 3.3.0-beta.7

package/dist/index.cjs

@@ -6917,6 +6917,8 @@ var DelegationManagerConfigSchema = import_zod4.z.object({
     (val) => val === void 0 || typeof val === "function",
     { message: "Expected an invokeAny function or undefined" }
   ).optional(),
+  /** Optional owner-signed authorization for direct CID revocation */
+  signOwnerRevocation: import_zod4.z.custom().optional(),
   /** Optional custom fetch implementation */
   fetch: import_zod4.z.unknown().refine(
     (val) => val === void 0 || typeof val === "function",
@@ -7056,6 +7058,7 @@ var DelegationManager = class {
     this.session = config.session;
     this.invoke = config.invoke;
     this.invokeAny = config.invokeAny;
+    this.signOwnerRevocation = config.signOwnerRevocation;
     this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
     this.accountSpaceId = config.accountSpaceId;
   }
@@ -7198,6 +7201,9 @@ var DelegationManager = class {
    * Once revoked, the delegation can no longer be used to access resources.
    * This also invalidates any sub-delegations derived from this delegation.
    *
+   * Explicit target-space or authority options keep the delegated session
+   * signing path even when an owner signer is available.
+   *
    * @param cid - The CID of the delegation to revoke
    * @returns Result indicating success or an error
    *
@@ -7220,29 +7226,35 @@ var DelegationManager = class {
       };
     }
     try {
-      if (!this.invokeAny) {
+      const ownerSigner = options2?.targetSpaceId === void 0 && options2?.authorityCid === void 0 ? this.signOwnerRevocation : void 0;
+      if (!ownerSigner && !this.invokeAny) {
         return {
           ok: false,
           error: createError(
             DelegationErrorCodes.NOT_INITIALIZED,
-            "Revocation requires an invokeAny function that can sign the target CID"
+            "Revocation requires an owner signer or invokeAny function that can sign the target CID"
           )
         };
       }
-      const entry = {
-        resource: `urn:cid:${cid2}`,
-        ...options2?.targetSpaceId === void 0 ? {} : { spaceId: options2.targetSpaceId },
-        service: "delegation",
-        path: "",
-        action: DelegationAction.REVOKE
-      };
-      if (options2?.authorityCid !== void 0) {
-        Object.defineProperty(entry, "revokeAuthorityCid", {
-          value: options2.authorityCid,
-          enumerable: false
-        });
+      let headers;
+      if (ownerSigner) {
+        headers = { Authorization: await ownerSigner(cid2) };
+      } else {
+        const entry = {
+          resource: `urn:cid:${cid2}`,
+          ...options2?.targetSpaceId === void 0 ? {} : { spaceId: options2.targetSpaceId },
+          service: "delegation",
+          path: "",
+          action: DelegationAction.REVOKE
+        };
+        if (options2?.authorityCid !== void 0) {
+          Object.defineProperty(entry, "revokeAuthorityCid", {
+            value: options2.authorityCid,
+            enumerable: false
+          });
+        }
+        headers = this.invokeAny(this.session, [entry]);
       }
-      const headers = this.invokeAny(this.session, [entry]);
       const response = await this.fetchFn(`${this.host}/revoke`, {
         method: "POST",
         headers
@@ -9972,7 +9984,9 @@ function redactedCode(error) {
   if (error instanceof ShareConflict) return error.code;
   const code3 = error && typeof error === "object" && "code" in error ? error.code : void 0;
   if (typeof code3 !== "string") return "SHARE_INVALID";
-  if (code3 === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || code3 === import_sdk_services3.ErrorCodes.KV_CONFLICT || code3 === "412") return "SHARE_CONFLICT";
+  if (code3 === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || code3 === "412") return "SHARE_CONFLICT";
+  if (code3 === import_sdk_services3.ErrorCodes.NODE_BUSY || code3 === import_sdk_services3.ErrorCodes.REQUEST_TIMEOUT) return "SHARE_OFFLINE";
+  if (code3 === import_sdk_services3.ErrorCodes.OUTCOME_UNKNOWN) return "SHARE_WRITE_FAILED";
   if (code3 === "KV_NOT_FOUND" || code3 === "NOT_FOUND" || code3 === "404") return "SHARE_NOT_FOUND";
   if (code3.includes("EXPIRED") || code3 === "expired") return "SHARE_EXPIRED";
   if (code3.includes("REVOK")) return "SHARE_REVOKED";
@@ -10211,7 +10225,7 @@ var ShareRecipientClient = class {
           if (portableDelegation !== void 0 && kv !== void 0) {
             const result2 = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
             if (!result2.ok) {
-              if (result2.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || result2.error.code === import_sdk_services3.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
+              if (result2.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
               throw result2.error;
             }
             return { etag: result2.data.headers.etag };
@@ -10219,7 +10233,7 @@ var ShareRecipientClient = class {
           if (policySession !== void 0) return this.nativeSave(envelope, policySession, resolvedPath, bytes2, input);
           const result = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
           if (!result.ok) {
-            if (result.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === import_sdk_services3.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
+            if (result.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
             throw result.error;
           }
           return { etag: result.data.headers.etag };
@@ -12842,7 +12856,16 @@ var PersistedSessionDataSchema = import_zod8.z.object({
    * for backward compatibility with sessions persisted before this field
    * existed — those restore and lazily re-resolve their hosts.
    */
-  tinycloudHosts: import_zod8.z.array(import_zod8.z.string()).optional()
+  tinycloudHosts: import_zod8.z.array(import_zod8.z.string()).optional(),
+  /**
+   * Replica gate stamp from a fresh sign-in (`establishSessionStamp`). Restore validates it with
+   * `restoreSessionStamp` and never re-establishes it. Absent for sessions persisted before
+   * replication existed; restore treats that as `not_established`.
+   */
+  replicaStamp: import_zod8.z.object({
+    incarnation: import_zod8.z.string().min(1),
+    lifecycleEpoch: import_zod8.z.number().int().nonnegative()
+  }).strict().optional()
 });
 var TinyCloudSessionSchema = import_zod8.z.object({
   /** User's Ethereum address */