@tinycloud/sdk-core 3.8.0-beta.2 → 3.8.0-beta.21

package/dist/index.js

@@ -3437,6 +3437,7 @@ import { sha256 as sha2564 } from "@noble/hashes/sha256";
 import { blake3 } from "@noble/hashes/blake3";
 import { ed25519 as ed255193 } from "@noble/curves/ed25519";
 import { z as z2 } from "zod";
+import { parseEncryptionResource as parseNamedEncryptionResource } from "@tinycloud/sdk-services";
 
 // src/http-error.ts
 import { ErrorCodes, serviceError } from "@tinycloud/sdk-services";
@@ -3705,12 +3706,9 @@ function parseKvResource(resource) {
   return { space, path };
 }
 function parseEncryptionResource(resource) {
-  if (!resource.startsWith("urn:tinycloud:encryption:")) throw new Error("encryption capability is invalid");
-  const rest = resource.slice("urn:tinycloud:encryption:".length);
-  const separator = rest.lastIndexOf(":");
-  const ownerDid = separator < 0 ? "" : rest.slice(0, separator);
-  const network = separator < 0 ? "" : rest.slice(separator + 1);
-  if (!ownerDid.startsWith("did:") || network.length === 0 || network.includes(":") || network.includes("/") || network.includes("%") || network.includes("?") || network.includes("#")) {
+  try {
+    if (parseNamedEncryptionResource(resource).keyPath?.endsWith("/")) throw new Error("prefix");
+  } catch {
     throw new Error("encryption capability is invalid");
   }
 }
@@ -6177,7 +6175,11 @@ var DelegationErrorCodes = {
   KV_SERVICE_UNAVAILABLE: "KV_SERVICE_UNAVAILABLE",
   DATA_FETCH_FAILED: "DATA_FETCH_FAILED",
   VALIDATION_ERROR: "VALIDATION_ERROR",
-  UNSUPPORTED_OPERATION: "UNSUPPORTED_OPERATION"
+  UNSUPPORTED_OPERATION: "UNSUPPORTED_OPERATION",
+  /** The node answered 503: the delegation chain is too deep to evaluate right now. Retry later. */
+  CHAIN_TOO_DEEP: "CHAIN_TOO_DEEP",
+  /** The node answered 400 "invalid delegation query cursor": malformed, foreign or from another filter. Start the listing again without it. */
+  INVALID_CURSOR: "INVALID_CURSOR"
 };
 var DelegationSchema = z4.object({
   /** Content identifier (CID) of the delegation */
@@ -6254,7 +6256,7 @@ var AccountDelegationPageSchema = z4.object({
   nextCursor: z4.string().optional()
 }).strict();
 var AccountDelegationQueryOptionsSchema = z4.object({
-  direction: z4.enum(["granted", "received", "all"]).optional(),
+  direction: z4.enum(["granted", "received", "all", "issued"]).optional(),
   status: z4.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]).optional(),
   space: z4.string().trim().min(1).optional(),
   limit: z4.number().int().min(1).max(100).optional(),
@@ -6440,6 +6442,8 @@ var DelegationManagerConfigSchema = z4.object({
   ).optional(),
   /** Optional owner-signed authorization for direct CID revocation */
   signOwnerRevocation: z4.custom().optional(),
+  /** Optional signer for proofless invocations by the session's own did:key (issued-delegation list and revoke) */
+  sessionInvocationSigner: z4.custom().optional(),
   /** Optional custom fetch implementation */
   fetch: z4.unknown().refine(
     (val) => val === void 0 || typeof val === "function",
@@ -6535,7 +6539,7 @@ var CreateDelegationWasmResultSchema = z4.object({
   resources: z4.array(DelegatedResourceSchema)
 });
 
-// src/delegations/DelegationManager.ts
+// src/delegations/shared.ts
 var DelegationAction = {
   REVOKE: "tinycloud.delegation/revoke",
   STATUS: "tinycloud.delegation/status",
@@ -6552,6 +6556,8 @@ function createError(code3, message, cause, meta) {
     meta
   };
 }
+
+// src/delegations/DelegationManager.ts
 async function readInvokedJson(response, action) {
   const text3 = await response.text();
   if (text3.trim() === "") {
@@ -6574,11 +6580,13 @@ var DelegationManager = class {
    * @param config - Configuration including hosts, session, and invoke function
    */
   constructor(config) {
+    this.issuedState = { issuedQuerySupported: false };
     this.hosts = config.hosts;
     this.session = config.session;
     this.invoke = config.invoke;
     this.invokeAny = config.invokeAny;
     this.signOwnerRevocation = config.signOwnerRevocation;
+    this.sessionInvocationSigner = config.sessionInvocationSigner;
     this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
     this.accountSpaceId = config.accountSpaceId;
   }
@@ -6801,8 +6809,14 @@ var DelegationManager = class {
       };
     }
   }
-  /** Query lifecycle-complete delegation history for the authenticated account. */
-  async query(options2 = {}) {
+  /**
+   * Query lifecycle-complete delegation history for the authenticated account.
+   *
+   * `scope.spaces` lists the spaces to sign `tinycloud.delegation/list` for, in order. Omitted, the
+   * account space is tried, then the session's own space. A caller that knows which of them the session
+   * holds passes only those; an empty list sends nothing and answers PERMISSION_DENIED.
+   */
+  async query(options2 = {}, scope = {}) {
     const validated = AccountDelegationQueryOptionsSchema.safeParse(options2);
     if (!validated.success) {
       return {
@@ -6815,6 +6829,7 @@ var DelegationManager = class {
         )
       };
     }
+    if (validated.data.direction === "issued") return this.queryIssued(validated.data);
     if (!this.invokeAny) {
       return {
         ok: false,
@@ -6836,7 +6851,7 @@ var DelegationManager = class {
     }
     try {
       let response;
-      for (const spaceId of /* @__PURE__ */ new Set([accountSpaceId, this.session.spaceId])) {
+      for (const spaceId of new Set(scope.spaces ?? [accountSpaceId, this.session.spaceId])) {
         const headers = Object.fromEntries(new Headers(this.invokeAny(this.session, [{
           spaceId,
           service: "delegation",
@@ -6896,6 +6911,45 @@ var DelegationManager = class {
       };
     }
   }
+  /** The state the lazily loaded issued-delegation module reads and updates. */
+  issuedContext() {
+    return {
+      host: this.host,
+      fetchFn: this.fetchFn,
+      sessionInvocationSigner: this.sessionInvocationSigner,
+      state: this.issuedState
+    };
+  }
+  /**
+   * Lists the delegations this session's own key issued (`direction: "issued"`).
+   * The implementation loads on first use.
+   */
+  async queryIssued(options2) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.queryIssued(this.issuedContext(), options2);
+  }
+  /**
+   * Every delegation this session's key issued, following `nextCursor` until
+   * it is absent. `maxItems` stops early once that many are collected;
+   * `untilCid` stops after the page that contains that delegation. Items come
+   * in CID order (each carries `issuedAt`). The implementation loads on first use.
+   */
+  async queryAllIssued(options2 = {}) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.queryAllIssued((page) => this.query(page), options2);
+  }
+  /**
+   * Revokes a delegation this session's key issued, with no proof: a UCAN
+   * signed by the session's own did:key carrying `urn:cid:<cid>` and
+   * `tinycloud.delegation/revoke`. Revoking a delegation that is already revoked
+   * succeeds. A refusal (the key is not the delegator) carries the node's
+   * message; 503 means the chain is too deep right now, retry later.
+   * The implementation loads on first use.
+   */
+  async revokeIssued(cid2) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.revokeIssued(this.issuedContext(), cid2);
+  }
   /**
    * Gets the full delegation chain for a given delegation.
    *
@@ -7202,7 +7256,8 @@ function validateEncodedShareData(data) {
 // src/manifest.ts
 import ms from "ms";
 import { ACCOUNT_MANIFEST_PERMISSIONS } from "@tinycloud/bootstrap";
-import { resolveSecretPath, SECRET_NAME_RE } from "@tinycloud/sdk-services";
+import { resolveSecretPath, SECRET_NAME_RE, parseNetworkId } from "@tinycloud/sdk-services";
+import { parseEncryptionResource as parseEncryptionResource2 } from "@tinycloud/sdk-services/encryption/resource";
 var DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
 var ManifestValidationError = class extends Error {
   constructor(message) {
@@ -7325,6 +7380,16 @@ function expandEncryptionPermissionEntry(entry) {
       `tinycloud.encryption entries require path to be a networkId URN (got ${JSON.stringify(entry.path)})`
     );
   }
+  const sharePrefix = entry.path.endsWith("/share/");
+  if (entry.path.includes("/") && !sharePrefix) {
+    throw new ManifestValidationError("named keys go in manifest.keys");
+  }
+  try {
+    const network = parseNetworkId(sharePrefix ? entry.path.slice(0, -"/share/".length) : entry.path);
+    if (sharePrefix && network.name !== "default") throw new Error("share prefix requires default network");
+  } catch {
+    throw new ManifestValidationError("tinycloud.encryption entries require a valid networkId URN");
+  }
   const normalizedActions = [];
   for (const action of entry.actions) {
     if (action === "decrypt" || action === "tinycloud.encryption/decrypt") {
@@ -7356,6 +7421,9 @@ function expandEncryptionPermissionEntry(entry) {
       seen.add(a);
     }
   }
+  if (sharePrefix && dedupedActions.some((action) => action !== "tinycloud.encryption/decrypt")) {
+    throw new ManifestValidationError("share prefix only supports decrypt");
+  }
   return [
     {
       service: ENCRYPTION_PERMISSION_SERVICE,
@@ -7371,6 +7439,55 @@ function expandEncryptionPermissionEntry(entry) {
 function expandPermissionEntries(entries) {
   return entries.flatMap(expandPermissionEntry);
 }
+function expandRuntimePermissionEntries(entries, ownerDid) {
+  return entries.flatMap((entry) => {
+    if (entry.service !== ENCRYPTION_PERMISSION_SERVICE || typeof entry.path !== "string" || !entry.path.includes("/") || entry.path.endsWith("/share/")) {
+      return expandPermissionEntry(entry);
+    }
+    let resource;
+    let ownerNetwork;
+    try {
+      resource = parseEncryptionResource2(entry.path);
+      if (typeof ownerDid !== "string" || ownerDid.length === 0) throw new Error("missing owner");
+      ownerNetwork = parseEncryptionResource2(`urn:tinycloud:encryption:${ownerDid}:default`);
+    } catch {
+      throw new ManifestValidationError("runtime Share key creation requires a canonical current-owner key resource");
+    }
+    if (resource.kind !== "key" || resource.networkId !== ownerNetwork.networkId || !/^share\/[^/]+$/.test(resource.path) || entry.space !== void 0 && entry.space !== ENCRYPTION_MANIFEST_SPACE || !Array.isArray(entry.actions) || entry.actions.length === 0 || entry.actions.some((action) => action !== "key.create" && action !== "tinycloud.encryption/key.create")) {
+      throw new ManifestValidationError("runtime Share key creation requires the current owner's exact default/share/<id> key and key.create only");
+    }
+    return [{
+      ...entry,
+      space: ENCRYPTION_MANIFEST_SPACE,
+      path: `${resource.networkId}/${resource.path}`,
+      actions: ["tinycloud.encryption/key.create"],
+      skipPrefix: true
+    }];
+  });
+}
+function expandDelegationPermissionEntries(entries) {
+  return entries.flatMap((entry) => {
+    if (entry.service !== ENCRYPTION_PERMISSION_SERVICE || typeof entry.path !== "string" || !entry.path.includes("/")) {
+      return expandPermissionEntry(entry);
+    }
+    let resource;
+    try {
+      resource = parseEncryptionResource2(entry.path);
+    } catch {
+      throw new ManifestValidationError("delegation requires a canonical exact named-key resource");
+    }
+    if (resource.kind !== "key" || !Array.isArray(entry.actions) || entry.actions.length === 0 || entry.actions.some((action) => action !== "decrypt" && action !== "tinycloud.encryption/decrypt")) {
+      throw new ManifestValidationError("named-key delegation requires an exact key and decrypt only");
+    }
+    return [{
+      ...entry,
+      space: ENCRYPTION_MANIFEST_SPACE,
+      path: `${resource.networkId}/${resource.path}`,
+      actions: ["tinycloud.encryption/decrypt"],
+      skipPrefix: true
+    }];
+  });
+}
 function applyPrefix(prefix, path, skipPrefix) {
   if (skipPrefix) {
     return path;
@@ -7449,8 +7566,56 @@ function validateManifest(input) {
   if (m.secrets !== void 0) {
     validateManifestSecrets(m.secrets);
   }
+  if (Object.prototype.hasOwnProperty.call(m, "keys_app_id") && (typeof m.keys_app_id !== "string" || !KEY_APP_ID.test(m.keys_app_id))) {
+    throw new ManifestValidationError("manifest.keys_app_id is invalid");
+  }
+  validateManifestKeys(m.keys_app_id ?? m.app_id, m.keys);
   return m;
 }
+var KEY_SEGMENT = "[a-z0-9][a-z0-9._-]{0,63}";
+var KEY_APP_ID = new RegExp(`^${KEY_SEGMENT}$`);
+var KEY_PATH = new RegExp(`^${KEY_SEGMENT}(?:/${KEY_SEGMENT}){2,7}$`);
+var KEY_ABILITIES = ["key.create", "decrypt", "key.block", "key.unblock"];
+function validateManifestKeys(appId, keys) {
+  if (keys === void 0) return;
+  if (!Array.isArray(keys) || keys.length > 32) {
+    throw new ManifestValidationError("manifest.keys must contain at most 32 entries");
+  }
+  if (keys.length === 0) return;
+  if (!KEY_APP_ID.test(appId)) {
+    throw new ManifestValidationError("manifest.keys requires a valid app_id");
+  }
+  const paths = /* @__PURE__ */ new Set();
+  let prefixSeen = false;
+  for (const [index, value] of keys.entries()) {
+    const label = `manifest.keys[${index}]`;
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new ManifestValidationError(`${label} must be an object`);
+    }
+    const entry = value;
+    const fields = Object.keys(entry);
+    const hasPath = Object.prototype.hasOwnProperty.call(entry, "path");
+    const hasPrefix = Object.prototype.hasOwnProperty.call(entry, "prefix");
+    if (hasPath === hasPrefix || fields.some((field) => !["path", "prefix", "abilities"].includes(field))) {
+      throw new ManifestValidationError(`${label} must have one path or prefix and abilities`);
+    }
+    if (!Array.isArray(entry.abilities) || entry.abilities.length === 0 || new Set(entry.abilities).size !== entry.abilities.length || entry.abilities.some((ability) => typeof ability !== "string" || !KEY_ABILITIES.includes(ability))) {
+      throw new ManifestValidationError(`${label}.abilities is invalid`);
+    }
+    if (hasPath) {
+      const path = entry.path;
+      if (typeof path !== "string" || path.length > 255 || !KEY_PATH.test(path) || !path.startsWith(`apps/${appId}/`) || paths.has(path)) {
+        throw new ManifestValidationError(`${label}.path is invalid`);
+      }
+      paths.add(path);
+    } else {
+      if (entry.prefix !== `apps/${appId}/` || prefixSeen) {
+        throw new ManifestValidationError(`${label}.prefix is invalid`);
+      }
+      prefixSeen = true;
+    }
+  }
+}
 function resolveManifestKnowledgeRoot(knowledge) {
   if (knowledge === void 0) {
     return void 0;
@@ -7968,6 +8133,7 @@ function manifestAbilitiesUnion(resolved) {
 }
 
 // src/capabilities.ts
+import { encryptionResourceContains } from "@tinycloud/sdk-services/encryption/resource";
 var PermissionNotInManifestError = class extends Error {
   constructor(missing, granted) {
     super(
@@ -8019,10 +8185,9 @@ function isCapabilitySubset(requested, granted) {
     const grantedActions = matchingScope.flatMap(
       (entry) => expandActionShortNames(entry.service, entry.actions)
     );
+    const namedKeyRequest = req.service === "tinycloud.encryption" && req.path.startsWith("urn:tinycloud:encryption:") && req.path.includes("/");
     const covered = requestedActions.every(
-      (requestedAction) => grantedActions.some(
-        (grantedAction) => actionContains(grantedAction, requestedAction)
-      )
+      (requestedAction) => grantedActions.some((grantedAction) => namedKeyRequest ? grantedAction === requestedAction : actionContains(grantedAction, requestedAction))
     );
     if (!covered) {
       missing.push(cloneEntry(req));
@@ -8037,7 +8202,9 @@ function canonicalizeEntryScopeMatches(requested, granted) {
   if (normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !== normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)) {
     return false;
   }
-  if (!pathContains2(granted.path, requested.path)) {
+  const namedKeyRequest = requested.service === "tinycloud.encryption" && requested.path.startsWith("urn:tinycloud:encryption:") && requested.path.includes("/");
+  const coveredPath = namedKeyRequest ? encryptionResourceContains(granted.path, requested.path) : pathContains2(granted.path, requested.path);
+  if (!coveredPath) {
     return false;
   }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
@@ -12242,15 +12409,15 @@ function markDelegationTerminal(token, key) {
 // src/networkId.ts
 import {
   buildNetworkId,
-  parseNetworkId
+  parseNetworkId as parseNetworkId2
 } from "@tinycloud/sdk-services";
 function canonicalizeNetworkId(networkId) {
-  const parsed = parseNetworkId(networkId);
+  const parsed = parseNetworkId2(networkId);
   return buildNetworkId(canonicalizeDid(parsed.ownerDid), parsed.name);
 }
 function parseCanonicalNetworkId(networkId) {
   const canonical = canonicalizeNetworkId(networkId);
-  return parseNetworkId(canonical);
+  return parseNetworkId2(canonical);
 }
 
 // src/storage.schema.ts
@@ -15063,7 +15230,7 @@ import {
   resolveSecretPath as resolveSecretPath2,
   EncryptionService,
   DecryptTransportResponseError,
-  parseNetworkId as parseNetworkId2,
+  parseNetworkId as parseNetworkId3,
   buildNetworkId as buildNetworkId2,
   isNetworkId,
   networkDiscoveryKey,
@@ -16117,8 +16284,14 @@ function diffImmutableSiweFields(original, signed, options2) {
 function extractRecapAttenuations(siwe) {
   const merged = {};
   const lines = siwe.split(/\r?\n/);
+  let resources = false;
   for (const line of lines) {
-    const match = line.match(/urn:recap:([A-Za-z0-9_-]+=*)/);
+    if (line === "Resources:") {
+      resources = true;
+      continue;
+    }
+    if (!resources) continue;
+    const match = line.match(/^- urn:recap:([A-Za-z0-9_-]+=*)$/);
     if (!match) continue;
     const encoded = match[1];
     let decodedJson;
@@ -19833,8 +20006,10 @@ export {
   ensureNetworkUsableForDecrypt,
   err5 as err,
   expandActionShortNames,
+  expandDelegationPermissionEntries,
   expandPermissionEntries,
   expandPermissionEntry,
+  expandRuntimePermissionEntries,
   extractImmutableSiweFields,
   extractRecapAttenuations,
   fetchLocationRecord,
@@ -19888,7 +20063,7 @@ export {
   parseCapabilityResource,
   parseCompactUcanAuthorization,
   parseExpiry,
-  parseNetworkId2 as parseNetworkId,
+  parseNetworkId3 as parseNetworkId,
   parseNodeNativePortableDelegation,
   parsePkhDid,
   parsePolicySessionUcan,