@tinycloud/sdk-core 3.8.0-beta.1 → 3.8.0-beta.15

package/dist/delegations/index.cjs

@@ -189,7 +189,11 @@ var DelegationErrorCodes = {
   KV_SERVICE_UNAVAILABLE: "KV_SERVICE_UNAVAILABLE",
   DATA_FETCH_FAILED: "DATA_FETCH_FAILED",
   VALIDATION_ERROR: "VALIDATION_ERROR",
-  UNSUPPORTED_OPERATION: "UNSUPPORTED_OPERATION"
+  UNSUPPORTED_OPERATION: "UNSUPPORTED_OPERATION",
+  /** The node answered 503: the delegation chain is too deep to evaluate right now. Retry later. */
+  CHAIN_TOO_DEEP: "CHAIN_TOO_DEEP",
+  /** The node answered 400 "invalid delegation query cursor": malformed, foreign or from another filter. Start the listing again without it. */
+  INVALID_CURSOR: "INVALID_CURSOR"
 };
 var DelegationSchema = import_zod.z.object({
   /** Content identifier (CID) of the delegation */
@@ -266,7 +270,7 @@ var AccountDelegationPageSchema = import_zod.z.object({
   nextCursor: import_zod.z.string().optional()
 }).strict();
 var AccountDelegationQueryOptionsSchema = import_zod.z.object({
-  direction: import_zod.z.enum(["granted", "received", "all"]).optional(),
+  direction: import_zod.z.enum(["granted", "received", "all", "issued"]).optional(),
   status: import_zod.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]).optional(),
   space: import_zod.z.string().trim().min(1).optional(),
   limit: import_zod.z.number().int().min(1).max(100).optional(),
@@ -452,6 +456,8 @@ var DelegationManagerConfigSchema = import_zod.z.object({
   ).optional(),
   /** Optional owner-signed authorization for direct CID revocation */
   signOwnerRevocation: import_zod.z.custom().optional(),
+  /** Optional signer for proofless invocations by the session's own did:key (issued-delegation list and revoke) */
+  sessionInvocationSigner: import_zod.z.custom().optional(),
   /** Optional custom fetch implementation */
   fetch: import_zod.z.unknown().refine(
     (val) => val === void 0 || typeof val === "function",
@@ -547,7 +553,7 @@ var CreateDelegationWasmResultSchema = import_zod.z.object({
   resources: import_zod.z.array(DelegatedResourceSchema)
 });
 
-// src/delegations/DelegationManager.ts
+// src/delegations/shared.ts
 var DelegationAction = {
   REVOKE: "tinycloud.delegation/revoke",
   STATUS: "tinycloud.delegation/status",
@@ -564,6 +570,8 @@ function createError(code3, message, cause, meta) {
     meta
   };
 }
+
+// src/delegations/DelegationManager.ts
 async function readInvokedJson(response, action) {
   const text = await response.text();
   if (text.trim() === "") {
@@ -586,11 +594,13 @@ var DelegationManager = class {
    * @param config - Configuration including hosts, session, and invoke function
    */
   constructor(config) {
+    this.issuedState = { issuedQuerySupported: false };
     this.hosts = config.hosts;
     this.session = config.session;
     this.invoke = config.invoke;
     this.invokeAny = config.invokeAny;
     this.signOwnerRevocation = config.signOwnerRevocation;
+    this.sessionInvocationSigner = config.sessionInvocationSigner;
     this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
     this.accountSpaceId = config.accountSpaceId;
   }
@@ -813,8 +823,14 @@ var DelegationManager = class {
       };
     }
   }
-  /** Query lifecycle-complete delegation history for the authenticated account. */
-  async query(options = {}) {
+  /**
+   * Query lifecycle-complete delegation history for the authenticated account.
+   *
+   * `scope.spaces` lists the spaces to sign `tinycloud.delegation/list` for, in order. Omitted, the
+   * account space is tried, then the session's own space. A caller that knows which of them the session
+   * holds passes only those; an empty list sends nothing and answers PERMISSION_DENIED.
+   */
+  async query(options = {}, scope = {}) {
     const validated = AccountDelegationQueryOptionsSchema.safeParse(options);
     if (!validated.success) {
       return {
@@ -827,6 +843,7 @@ var DelegationManager = class {
         )
       };
     }
+    if (validated.data.direction === "issued") return this.queryIssued(validated.data);
     if (!this.invokeAny) {
       return {
         ok: false,
@@ -848,7 +865,7 @@ var DelegationManager = class {
     }
     try {
       let response;
-      for (const spaceId of /* @__PURE__ */ new Set([accountSpaceId, this.session.spaceId])) {
+      for (const spaceId of new Set(scope.spaces ?? [accountSpaceId, this.session.spaceId])) {
         const headers = Object.fromEntries(new Headers(this.invokeAny(this.session, [{
           spaceId,
           service: "delegation",
@@ -908,6 +925,45 @@ var DelegationManager = class {
       };
     }
   }
+  /** The state the lazily loaded issued-delegation module reads and updates. */
+  issuedContext() {
+    return {
+      host: this.host,
+      fetchFn: this.fetchFn,
+      sessionInvocationSigner: this.sessionInvocationSigner,
+      state: this.issuedState
+    };
+  }
+  /**
+   * Lists the delegations this session's own key issued (`direction: "issued"`).
+   * The implementation loads on first use.
+   */
+  async queryIssued(options) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.queryIssued(this.issuedContext(), options);
+  }
+  /**
+   * Every delegation this session's key issued, following `nextCursor` until
+   * it is absent. `maxItems` stops early once that many are collected;
+   * `untilCid` stops after the page that contains that delegation. Items come
+   * in CID order (each carries `issuedAt`). The implementation loads on first use.
+   */
+  async queryAllIssued(options = {}) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.queryAllIssued((page) => this.query(page), options);
+  }
+  /**
+   * Revokes a delegation this session's key issued, with no proof: a UCAN
+   * signed by the session's own did:key carrying `urn:cid:<cid>` and
+   * `tinycloud.delegation/revoke`. Revoking a delegation that is already revoked
+   * succeeds. A refusal (the key is not the delegator) carries the node's
+   * message; 503 means the chain is too deep right now, retry later.
+   * The implementation loads on first use.
+   */
+  async revokeIssued(cid2) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.revokeIssued(this.issuedContext(), cid2);
+  }
   /**
    * Gets the full delegation chain for a given delegation.
    *
@@ -1245,6 +1301,7 @@ function validateSharingServiceConfig(data) {
 var import_ms = __toESM(require("ms"), 1);
 var import_bootstrap = require("@tinycloud/bootstrap");
 var import_sdk_services = require("@tinycloud/sdk-services");
+var import_resource = require("@tinycloud/sdk-services/encryption/resource");
 var SERVICE_SHORT_TO_LONG = Object.freeze({
   kv: "tinycloud.kv",
   space: "tinycloud.space",
@@ -1260,6 +1317,9 @@ var SERVICE_LONG_TO_SHORT = Object.freeze(
     Object.entries(SERVICE_SHORT_TO_LONG).map(([s, l]) => [l, s])
   )
 );
+var KEY_SEGMENT = "[a-z0-9][a-z0-9._-]{0,63}";
+var KEY_APP_ID = new RegExp(`^${KEY_SEGMENT}$`);
+var KEY_PATH = new RegExp(`^${KEY_SEGMENT}(?:/${KEY_SEGMENT}){2,7}$`);
 
 // src/identity.ts
 var import_viem = require("viem");
@@ -1326,6 +1386,7 @@ function principalDid(didUrl) {
 }
 
 // src/capabilities.ts
+var import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
 var CaveatedDelegationUnsupportedError = class extends Error {
   constructor(entries) {
     super(