@tinycloud/sdk-core 3.8.0-beta.2 → 3.8.0-beta.21

package/dist/{credential-admission-Cg1M9uyV.d.cts → credential-admission-B7_F6Yb3.d.cts}

@@ -426,6 +426,7 @@ interface UnifiedContentSource {
     readonly kvResource: string;
     readonly selector: UnifiedResourceSelector;
     readonly encryptionNetwork: string;
+    readonly encryptionKeyPath?: string;
     readonly encryptedSymmetricKeyDigestHex: string;
     readonly keyVersion: number;
     readonly mode: "mutable" | "immutable";

package/dist/{credential-admission-7I_ymo-C.d.ts → credential-admission-DCJhDFFv.d.ts}

@@ -426,6 +426,7 @@ interface UnifiedContentSource {
     readonly kvResource: string;
     readonly selector: UnifiedResourceSelector;
     readonly encryptionNetwork: string;
+    readonly encryptionKeyPath?: string;
     readonly encryptedSymmetricKeyDigestHex: string;
     readonly keyVersion: number;
     readonly mode: "mutable" | "immutable";

package/dist/delegations/index.cjs

@@ -189,7 +189,11 @@ var DelegationErrorCodes = {
   KV_SERVICE_UNAVAILABLE: "KV_SERVICE_UNAVAILABLE",
   DATA_FETCH_FAILED: "DATA_FETCH_FAILED",
   VALIDATION_ERROR: "VALIDATION_ERROR",
-  UNSUPPORTED_OPERATION: "UNSUPPORTED_OPERATION"
+  UNSUPPORTED_OPERATION: "UNSUPPORTED_OPERATION",
+  /** The node answered 503: the delegation chain is too deep to evaluate right now. Retry later. */
+  CHAIN_TOO_DEEP: "CHAIN_TOO_DEEP",
+  /** The node answered 400 "invalid delegation query cursor": malformed, foreign or from another filter. Start the listing again without it. */
+  INVALID_CURSOR: "INVALID_CURSOR"
 };
 var DelegationSchema = import_zod.z.object({
   /** Content identifier (CID) of the delegation */
@@ -266,7 +270,7 @@ var AccountDelegationPageSchema = import_zod.z.object({
   nextCursor: import_zod.z.string().optional()
 }).strict();
 var AccountDelegationQueryOptionsSchema = import_zod.z.object({
-  direction: import_zod.z.enum(["granted", "received", "all"]).optional(),
+  direction: import_zod.z.enum(["granted", "received", "all", "issued"]).optional(),
   status: import_zod.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]).optional(),
   space: import_zod.z.string().trim().min(1).optional(),
   limit: import_zod.z.number().int().min(1).max(100).optional(),
@@ -452,6 +456,8 @@ var DelegationManagerConfigSchema = import_zod.z.object({
   ).optional(),
   /** Optional owner-signed authorization for direct CID revocation */
   signOwnerRevocation: import_zod.z.custom().optional(),
+  /** Optional signer for proofless invocations by the session's own did:key (issued-delegation list and revoke) */
+  sessionInvocationSigner: import_zod.z.custom().optional(),
   /** Optional custom fetch implementation */
   fetch: import_zod.z.unknown().refine(
     (val) => val === void 0 || typeof val === "function",
@@ -547,7 +553,7 @@ var CreateDelegationWasmResultSchema = import_zod.z.object({
   resources: import_zod.z.array(DelegatedResourceSchema)
 });
 
-// src/delegations/DelegationManager.ts
+// src/delegations/shared.ts
 var DelegationAction = {
   REVOKE: "tinycloud.delegation/revoke",
   STATUS: "tinycloud.delegation/status",
@@ -564,6 +570,8 @@ function createError(code3, message, cause, meta) {
     meta
   };
 }
+
+// src/delegations/DelegationManager.ts
 async function readInvokedJson(response, action) {
   const text = await response.text();
   if (text.trim() === "") {
@@ -586,11 +594,13 @@ var DelegationManager = class {
    * @param config - Configuration including hosts, session, and invoke function
    */
   constructor(config) {
+    this.issuedState = { issuedQuerySupported: false };
     this.hosts = config.hosts;
     this.session = config.session;
     this.invoke = config.invoke;
     this.invokeAny = config.invokeAny;
     this.signOwnerRevocation = config.signOwnerRevocation;
+    this.sessionInvocationSigner = config.sessionInvocationSigner;
     this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
     this.accountSpaceId = config.accountSpaceId;
   }
@@ -813,8 +823,14 @@ var DelegationManager = class {
       };
     }
   }
-  /** Query lifecycle-complete delegation history for the authenticated account. */
-  async query(options = {}) {
+  /**
+   * Query lifecycle-complete delegation history for the authenticated account.
+   *
+   * `scope.spaces` lists the spaces to sign `tinycloud.delegation/list` for, in order. Omitted, the
+   * account space is tried, then the session's own space. A caller that knows which of them the session
+   * holds passes only those; an empty list sends nothing and answers PERMISSION_DENIED.
+   */
+  async query(options = {}, scope = {}) {
     const validated = AccountDelegationQueryOptionsSchema.safeParse(options);
     if (!validated.success) {
       return {
@@ -827,6 +843,7 @@ var DelegationManager = class {
         )
       };
     }
+    if (validated.data.direction === "issued") return this.queryIssued(validated.data);
     if (!this.invokeAny) {
       return {
         ok: false,
@@ -848,7 +865,7 @@ var DelegationManager = class {
     }
     try {
       let response;
-      for (const spaceId of /* @__PURE__ */ new Set([accountSpaceId, this.session.spaceId])) {
+      for (const spaceId of new Set(scope.spaces ?? [accountSpaceId, this.session.spaceId])) {
         const headers = Object.fromEntries(new Headers(this.invokeAny(this.session, [{
           spaceId,
           service: "delegation",
@@ -908,6 +925,45 @@ var DelegationManager = class {
       };
     }
   }
+  /** The state the lazily loaded issued-delegation module reads and updates. */
+  issuedContext() {
+    return {
+      host: this.host,
+      fetchFn: this.fetchFn,
+      sessionInvocationSigner: this.sessionInvocationSigner,
+      state: this.issuedState
+    };
+  }
+  /**
+   * Lists the delegations this session's own key issued (`direction: "issued"`).
+   * The implementation loads on first use.
+   */
+  async queryIssued(options) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.queryIssued(this.issuedContext(), options);
+  }
+  /**
+   * Every delegation this session's key issued, following `nextCursor` until
+   * it is absent. `maxItems` stops early once that many are collected;
+   * `untilCid` stops after the page that contains that delegation. Items come
+   * in CID order (each carries `issuedAt`). The implementation loads on first use.
+   */
+  async queryAllIssued(options = {}) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.queryAllIssued((page) => this.query(page), options);
+  }
+  /**
+   * Revokes a delegation this session's key issued, with no proof: a UCAN
+   * signed by the session's own did:key carrying `urn:cid:<cid>` and
+   * `tinycloud.delegation/revoke`. Revoking a delegation that is already revoked
+   * succeeds. A refusal (the key is not the delegator) carries the node's
+   * message; 503 means the chain is too deep right now, retry later.
+   * The implementation loads on first use.
+   */
+  async revokeIssued(cid2) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.revokeIssued(this.issuedContext(), cid2);
+  }
   /**
    * Gets the full delegation chain for a given delegation.
    *
@@ -1245,6 +1301,7 @@ function validateSharingServiceConfig(data) {
 var import_ms = __toESM(require("ms"), 1);
 var import_bootstrap = require("@tinycloud/bootstrap");
 var import_sdk_services = require("@tinycloud/sdk-services");
+var import_resource = require("@tinycloud/sdk-services/encryption/resource");
 var SERVICE_SHORT_TO_LONG = Object.freeze({
   kv: "tinycloud.kv",
   space: "tinycloud.space",
@@ -1260,6 +1317,9 @@ var SERVICE_LONG_TO_SHORT = Object.freeze(
     Object.entries(SERVICE_SHORT_TO_LONG).map(([s, l]) => [l, s])
   )
 );
+var KEY_SEGMENT = "[a-z0-9][a-z0-9._-]{0,63}";
+var KEY_APP_ID = new RegExp(`^${KEY_SEGMENT}$`);
+var KEY_PATH = new RegExp(`^${KEY_SEGMENT}(?:/${KEY_SEGMENT}){2,7}$`);
 
 // src/identity.ts
 var import_viem = require("viem");
@@ -1326,6 +1386,7 @@ function principalDid(didUrl) {
 }
 
 // src/capabilities.ts
+var import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
 var CaveatedDelegationUnsupportedError = class extends Error {
   constructor(entries) {
     super(
@@ -2551,7 +2612,7 @@ var hashes = { ...sha2_browser_exports, ...identity_exports2 };
 var import_ed255194 = require("@noble/curves/ed25519");
 
 // src/delegations/ShareRecipientClient.ts
-var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_sdk_services4 = require("@tinycloud/sdk-services");
 var import_ed255193 = require("@noble/curves/ed25519");
 var import_sha2564 = require("@noble/hashes/sha256");
 
@@ -3632,6 +3693,7 @@ var import_sha2563 = require("@noble/hashes/sha256");
 var import_blake32 = require("@noble/hashes/blake3");
 var import_ed255192 = require("@noble/curves/ed25519");
 var import_zod4 = require("zod");
+var import_sdk_services3 = require("@tinycloud/sdk-services");
 
 // src/policy/errors.ts
 var SignedObjectProfileError = class extends Error {
@@ -4178,9 +4240,9 @@ function redactedCode(error) {
   if (error instanceof ShareConflict) return error.code;
   const code3 = error && typeof error === "object" && "code" in error ? error.code : void 0;
   if (typeof code3 !== "string") return "SHARE_INVALID";
-  if (code3 === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || code3 === "412") return "SHARE_CONFLICT";
-  if (code3 === import_sdk_services3.ErrorCodes.NODE_BUSY || code3 === import_sdk_services3.ErrorCodes.REQUEST_TIMEOUT) return "SHARE_OFFLINE";
-  if (code3 === import_sdk_services3.ErrorCodes.OUTCOME_UNKNOWN) return "SHARE_WRITE_FAILED";
+  if (code3 === import_sdk_services4.ErrorCodes.KV_PRECONDITION_FAILED || code3 === "412") return "SHARE_CONFLICT";
+  if (code3 === import_sdk_services4.ErrorCodes.NODE_BUSY || code3 === import_sdk_services4.ErrorCodes.REQUEST_TIMEOUT) return "SHARE_OFFLINE";
+  if (code3 === import_sdk_services4.ErrorCodes.OUTCOME_UNKNOWN) return "SHARE_WRITE_FAILED";
   if (code3 === "KV_NOT_FOUND" || code3 === "NOT_FOUND" || code3 === "404") return "SHARE_NOT_FOUND";
   if (code3.includes("EXPIRED") || code3 === "expired") return "SHARE_EXPIRED";
   if (code3.includes("REVOK")) return "SHARE_REVOKED";
@@ -4419,7 +4481,7 @@ var ShareRecipientClient = class {
           if (portableDelegation !== void 0 && kv !== void 0) {
             const result2 = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
             if (!result2.ok) {
-              if (result2.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
+              if (result2.error.code === import_sdk_services4.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
               throw result2.error;
             }
             return { etag: result2.data.headers.etag };
@@ -4427,7 +4489,7 @@ var ShareRecipientClient = class {
           if (policySession !== void 0) return this.nativeSave(envelope, policySession, resolvedPath, bytes2, input);
           const result = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
           if (!result.ok) {
-            if (result.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
+            if (result.error.code === import_sdk_services4.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
             throw result.error;
           }
           return { etag: result.data.headers.etag };
@@ -4511,8 +4573,8 @@ var ShareRecipientClient = class {
     if (this.options.createKVService !== void 0) {
       return this.options.createKVService({ hosts: [origin], session, invoke, fetch: this.fetchFn });
     }
-    const context = new import_sdk_services3.ServiceContext({ hosts: [origin], session, invoke, fetch: this.fetchFn });
-    const service = new import_sdk_services3.KVService({ prefix: "" });
+    const context = new import_sdk_services4.ServiceContext({ hosts: [origin], session, invoke, fetch: this.fetchFn });
+    const service = new import_sdk_services4.KVService({ prefix: "" });
     context.registerService("kv", service);
     service.initialize(context);
     return service;