@tinycloud/sdk-core 3.2.6-beta.4 → 3.3.0-beta.11

package/dist/index.cjs

@@ -221,6 +221,7 @@ __export(index_exports, {
   SpaceService: () => SpaceService,
   StorageFullMonitor: () => import_sdk_services9.StorageFullMonitor,
   TC832_RESERVED_SCOPES: () => import_sdk_services9.TC832_RESERVED_SCOPES,
+  TERMINAL_DELEGATION_FACT: () => TERMINAL_DELEGATION_FACT,
   TINYCLOUD_ACCOUNT_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
   TINYCLOUD_AGENTS_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_AGENTS_SPACE_MANIFEST,
   TINYCLOUD_APPLICATIONS_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
@@ -381,6 +382,7 @@ __export(index_exports, {
   makePkhSpaceId: () => makePkhSpaceId,
   makePublicSpaceId: () => makePublicSpaceId,
   manifestAbilitiesUnion: () => manifestAbilitiesUnion,
+  markDelegationTerminal: () => markDelegationTerminal,
   multiaddrToHttpUrl: () => multiaddrToHttpUrl,
   networkDiscoveryKey: () => import_sdk_services9.networkDiscoveryKey,
   normalizeDefaults: () => normalizeDefaults,
@@ -6917,6 +6919,8 @@ var DelegationManagerConfigSchema = import_zod4.z.object({
     (val) => val === void 0 || typeof val === "function",
     { message: "Expected an invokeAny function or undefined" }
   ).optional(),
+  /** Optional owner-signed authorization for direct CID revocation */
+  signOwnerRevocation: import_zod4.z.custom().optional(),
   /** Optional custom fetch implementation */
   fetch: import_zod4.z.unknown().refine(
     (val) => val === void 0 || typeof val === "function",
@@ -7056,6 +7060,7 @@ var DelegationManager = class {
     this.session = config.session;
     this.invoke = config.invoke;
     this.invokeAny = config.invokeAny;
+    this.signOwnerRevocation = config.signOwnerRevocation;
     this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
     this.accountSpaceId = config.accountSpaceId;
   }
@@ -7198,6 +7203,9 @@ var DelegationManager = class {
    * Once revoked, the delegation can no longer be used to access resources.
    * This also invalidates any sub-delegations derived from this delegation.
    *
+   * Explicit target-space or authority options keep the delegated session
+   * signing path even when an owner signer is available.
+   *
    * @param cid - The CID of the delegation to revoke
    * @returns Result indicating success or an error
    *
@@ -7220,29 +7228,35 @@ var DelegationManager = class {
       };
     }
     try {
-      if (!this.invokeAny) {
+      const ownerSigner = options2?.targetSpaceId === void 0 && options2?.authorityCid === void 0 ? this.signOwnerRevocation : void 0;
+      if (!ownerSigner && !this.invokeAny) {
         return {
           ok: false,
           error: createError(
             DelegationErrorCodes.NOT_INITIALIZED,
-            "Revocation requires an invokeAny function that can sign the target CID"
+            "Revocation requires an owner signer or invokeAny function that can sign the target CID"
           )
         };
       }
-      const entry = {
-        resource: `urn:cid:${cid2}`,
-        ...options2?.targetSpaceId === void 0 ? {} : { spaceId: options2.targetSpaceId },
-        service: "delegation",
-        path: "",
-        action: DelegationAction.REVOKE
-      };
-      if (options2?.authorityCid !== void 0) {
-        Object.defineProperty(entry, "revokeAuthorityCid", {
-          value: options2.authorityCid,
-          enumerable: false
-        });
+      let headers;
+      if (ownerSigner) {
+        headers = { Authorization: await ownerSigner(cid2) };
+      } else {
+        const entry = {
+          resource: `urn:cid:${cid2}`,
+          ...options2?.targetSpaceId === void 0 ? {} : { spaceId: options2.targetSpaceId },
+          service: "delegation",
+          path: "",
+          action: DelegationAction.REVOKE
+        };
+        if (options2?.authorityCid !== void 0) {
+          Object.defineProperty(entry, "revokeAuthorityCid", {
+            value: options2.authorityCid,
+            enumerable: false
+          });
+        }
+        headers = this.invokeAny(this.session, [entry]);
       }
-      const headers = this.invokeAny(this.session, [entry]);
       const response = await this.fetchFn(`${this.host}/revoke`, {
         method: "POST",
         headers
@@ -9972,7 +9986,9 @@ function redactedCode(error) {
   if (error instanceof ShareConflict) return error.code;
   const code3 = error && typeof error === "object" && "code" in error ? error.code : void 0;
   if (typeof code3 !== "string") return "SHARE_INVALID";
-  if (code3 === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || code3 === import_sdk_services3.ErrorCodes.KV_CONFLICT || code3 === "412") return "SHARE_CONFLICT";
+  if (code3 === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || code3 === "412") return "SHARE_CONFLICT";
+  if (code3 === import_sdk_services3.ErrorCodes.NODE_BUSY || code3 === import_sdk_services3.ErrorCodes.REQUEST_TIMEOUT) return "SHARE_OFFLINE";
+  if (code3 === import_sdk_services3.ErrorCodes.OUTCOME_UNKNOWN) return "SHARE_WRITE_FAILED";
   if (code3 === "KV_NOT_FOUND" || code3 === "NOT_FOUND" || code3 === "404") return "SHARE_NOT_FOUND";
   if (code3.includes("EXPIRED") || code3 === "expired") return "SHARE_EXPIRED";
   if (code3.includes("REVOK")) return "SHARE_REVOKED";
@@ -10211,7 +10227,7 @@ var ShareRecipientClient = class {
           if (portableDelegation !== void 0 && kv !== void 0) {
             const result2 = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
             if (!result2.ok) {
-              if (result2.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || result2.error.code === import_sdk_services3.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
+              if (result2.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
               throw result2.error;
             }
             return { etag: result2.data.headers.etag };
@@ -10219,7 +10235,7 @@ var ShareRecipientClient = class {
           if (policySession !== void 0) return this.nativeSave(envelope, policySession, resolvedPath, bytes2, input);
           const result = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
           if (!result.ok) {
-            if (result.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === import_sdk_services3.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
+            if (result.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
             throw result.error;
           }
           return { etag: result.data.headers.etag };
@@ -12780,6 +12796,37 @@ async function parseSignedSiweCacao(authorization, expectedCid) {
   return { cid: cid2, issuer, audience, attenuation, ...expiresAt === void 0 ? {} : { expiresAt } };
 }
 
+// src/delegations/terminal.ts
+var import_blake35 = require("@noble/hashes/blake3");
+var import_ed2551910 = require("@noble/curves/ed25519");
+var TERMINAL_DELEGATION_FACT = Object.freeze({
+  "xyz.tinycloud.policy/delegationMode": "terminal"
+});
+function markDelegationTerminal(token, key) {
+  const [headerSegment, payloadSegment, signatureSegment] = token.split(".");
+  const decoder = new TextDecoder();
+  const header = JSON.parse(decoder.decode(decodeBase64Url(headerSegment)));
+  const payload = JSON.parse(decoder.decode(decodeBase64Url(payloadSegment)));
+  if (signatureSegment === void 0 || header.alg !== "EdDSA" || key.kty !== "OKP" || key.crv !== "Ed25519" || !key.d) {
+    throw new Error("terminal delegations require an Ed25519 session key");
+  }
+  const privateKey = decodeBase64Url(key.d);
+  const signer = `did:key:${base58btc.encode(Uint8Array.of(237, 1, ...import_ed2551910.ed25519.getPublicKey(privateKey)))}`;
+  if (typeof payload.iss !== "string" || payload.iss.split("#")[0] !== signer) {
+    throw new Error("session key is not the delegation issuer");
+  }
+  const facts = payload.fct ?? [];
+  if (!Array.isArray(facts)) throw new Error("delegation facts are not an array");
+  const encoder = new TextEncoder();
+  let delegation = token;
+  if (!facts.some((fact) => fact?.["xyz.tinycloud.policy/delegationMode"] === "terminal")) {
+    payload.fct = [...facts, { ...TERMINAL_DELEGATION_FACT }];
+    const signingInput = `${headerSegment}.${encodeBase64Url(encoder.encode(JSON.stringify(payload)))}`;
+    delegation = `${signingInput}.${encodeBase64Url(import_ed2551910.ed25519.sign(encoder.encode(signingInput), privateKey))}`;
+  }
+  return { delegation, cid: CID.createV1(85, create(30, (0, import_blake35.blake3)(encoder.encode(delegation)))).toString() };
+}
+
 // src/networkId.ts
 var import_sdk_services4 = require("@tinycloud/sdk-services");
 function canonicalizeNetworkId(networkId) {
@@ -12842,7 +12889,16 @@ var PersistedSessionDataSchema = import_zod8.z.object({
    * for backward compatibility with sessions persisted before this field
    * existed — those restore and lazily re-resolve their hosts.
    */
-  tinycloudHosts: import_zod8.z.array(import_zod8.z.string()).optional()
+  tinycloudHosts: import_zod8.z.array(import_zod8.z.string()).optional(),
+  /**
+   * Replica gate stamp from a fresh sign-in (`establishSessionStamp`). Restore validates it with
+   * `restoreSessionStamp` and never re-establishes it. Absent for sessions persisted before
+   * replication existed; restore treats that as `not_established`.
+   */
+  replicaStamp: import_zod8.z.object({
+    incarnation: import_zod8.z.string().min(1),
+    lifecycleEpoch: import_zod8.z.number().int().nonnegative()
+  }).strict().optional()
 });
 var TinyCloudSessionSchema = import_zod8.z.object({
   /** User's Ethereum address */
@@ -18358,7 +18414,7 @@ function portForProtocol(protocol) {
 }
 
 // src/location.ts
-var import_ed2551910 = require("@noble/curves/ed25519");
+var import_ed2551911 = require("@noble/curves/ed25519");
 var import_viem6 = require("viem");
 var DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 var DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
@@ -19126,7 +19182,7 @@ function verifyDidKeySignature(did, payload, signature) {
       "did:key signature must be a base64url Ed25519 signature"
     );
   }
-  return import_ed2551910.ed25519.verify(
+  return import_ed2551911.ed25519.verify(
     signatureBytes,
     new TextEncoder().encode(payload),
     publicKey
@@ -19134,7 +19190,7 @@ function verifyDidKeySignature(did, payload, signature) {
 }
 function verifyDidKeyEd25519Signature(did, payload, signature) {
   const publicKey = ed25519PublicKeyFromDidKey2(did);
-  return import_ed2551910.ed25519.verify(signature, payload, publicKey);
+  return import_ed2551911.ed25519.verify(signature, payload, publicKey);
 }
 function ed25519PublicKeyFromDidKey2(did) {
   const identifier = did.slice("did:key:".length);