@tinycloud/sdk-core 3.8.0-beta.9 → 3.8.1-beta.1

package/dist/delegations/issued.cjs

@@ -0,0 +1,697 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/delegations/issued.ts
+var issued_exports = {};
+__export(issued_exports, {
+  queryAllIssued: () => queryAllIssued,
+  queryIssued: () => queryIssued,
+  revokeIssued: () => revokeIssued
+});
+module.exports = __toCommonJS(issued_exports);
+
+// src/delegations/types.schema.ts
+var import_zod = require("zod");
+var JWKSchema = import_zod.z.object({
+  /** Key type (e.g., "EC", "RSA", "OKP") */
+  kty: import_zod.z.string(),
+  /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
+  crv: import_zod.z.string().optional(),
+  /** X coordinate for EC keys, public key for OKP */
+  x: import_zod.z.string().optional(),
+  /** Y coordinate for EC keys */
+  y: import_zod.z.string().optional(),
+  /** Private key value (d parameter) */
+  d: import_zod.z.string().optional(),
+  /** Public exponent for RSA keys */
+  e: import_zod.z.string().optional(),
+  /** Modulus for RSA keys */
+  n: import_zod.z.string().optional(),
+  /** Key ID */
+  kid: import_zod.z.string().optional(),
+  /** Algorithm */
+  alg: import_zod.z.string().optional(),
+  /** Key use (e.g., "sig", "enc") */
+  use: import_zod.z.string().optional(),
+  /** Key operations (e.g., ["sign", "verify"]) */
+  key_ops: import_zod.z.array(import_zod.z.string()).optional()
+});
+var KeyTypeSchema = import_zod.z.enum(["main", "session", "ingested"]);
+var KeyInfoSchema = import_zod.z.object({
+  /** Unique identifier for this key */
+  id: import_zod.z.string(),
+  /** DID associated with this key */
+  did: import_zod.z.string(),
+  /** Type of key determining its authority level */
+  type: KeyTypeSchema,
+  /** Private key in JWK format */
+  jwk: JWKSchema.optional(),
+  /** Priority for key selection (lower = higher priority) */
+  priority: import_zod.z.number()
+});
+var DelegationErrorSchema = import_zod.z.object({
+  /** Error code for programmatic handling */
+  code: import_zod.z.string(),
+  /** Human-readable error message */
+  message: import_zod.z.string(),
+  /** The service that produced the error */
+  service: import_zod.z.literal("delegation"),
+  /** Original error if wrapping another error */
+  cause: import_zod.z.instanceof(Error).optional(),
+  /** Additional metadata about the error */
+  meta: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional()
+});
+var DelegationErrorCodes = {
+  AUTH_REQUIRED: "AUTH_REQUIRED",
+  AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
+  AUTH_EXPIRED: "AUTH_EXPIRED",
+  NOT_INITIALIZED: "NOT_INITIALIZED",
+  NOT_FOUND: "NOT_FOUND",
+  REVOKED: "REVOKED",
+  NETWORK_ERROR: "NETWORK_ERROR",
+  TIMEOUT: "TIMEOUT",
+  ABORTED: "ABORTED",
+  INVALID_INPUT: "INVALID_INPUT",
+  PERMISSION_DENIED: "PERMISSION_DENIED",
+  CREATION_FAILED: "CREATION_FAILED",
+  REVOCATION_FAILED: "REVOCATION_FAILED",
+  INVALID_TOKEN: "INVALID_TOKEN",
+  KV_SERVICE_UNAVAILABLE: "KV_SERVICE_UNAVAILABLE",
+  DATA_FETCH_FAILED: "DATA_FETCH_FAILED",
+  VALIDATION_ERROR: "VALIDATION_ERROR",
+  UNSUPPORTED_OPERATION: "UNSUPPORTED_OPERATION",
+  /** The node answered 503: the delegation chain is too deep to evaluate right now. Retry later. */
+  CHAIN_TOO_DEEP: "CHAIN_TOO_DEEP",
+  /** The node answered 400 "invalid delegation query cursor": malformed, foreign or from another filter. Start the listing again without it. */
+  INVALID_CURSOR: "INVALID_CURSOR"
+};
+var DelegationSchema = import_zod.z.object({
+  /** Content identifier (CID) of the delegation */
+  cid: import_zod.z.string(),
+  /** DID of the delegate (the party receiving the delegation) */
+  delegateDID: import_zod.z.string(),
+  /** Space ID this delegation applies to */
+  spaceId: import_zod.z.string(),
+  /** Resource path this delegation grants access to */
+  path: import_zod.z.string(),
+  /** Actions this delegation authorizes */
+  actions: import_zod.z.array(import_zod.z.string()),
+  /** Exact ReCap caveats that constrain every action in this scope. */
+  caveats: import_zod.z.array(import_zod.z.record(import_zod.z.string(), import_zod.z.unknown())).optional(),
+  /** When this delegation expires (accepts Date or ISO string from JSON) */
+  expiry: import_zod.z.coerce.date(),
+  /** Whether this delegation has been revoked */
+  isRevoked: import_zod.z.boolean(),
+  /** DID of the delegator (the party granting the delegation) */
+  delegatorDID: import_zod.z.string().optional(),
+  /** When this delegation was created (accepts Date or ISO string from JSON) */
+  createdAt: import_zod.z.coerce.date().optional(),
+  /** Parent delegation CID if this is a sub-delegation */
+  parentCid: import_zod.z.string().optional(),
+  /** Whether sub-delegation is allowed */
+  allowSubDelegation: import_zod.z.boolean().optional(),
+  /** Authorization header (UCAN bearer token) */
+  authHeader: import_zod.z.string().optional()
+});
+var DelegationStatusSchema = import_zod.z.object({
+  cid: import_zod.z.string().min(1),
+  status: import_zod.z.enum(["active", "revoked", "expired", "unavailable", "not_found"]),
+  exists: import_zod.z.boolean(),
+  active: import_zod.z.boolean(),
+  revoked: import_zod.z.boolean(),
+  expired: import_zod.z.boolean()
+}).strict().superRefine((value, context) => {
+  const valid = value.status === "active" ? value.exists && value.active && !value.revoked && !value.expired : value.status === "revoked" ? value.exists && !value.active && value.revoked && !value.expired : value.status === "expired" ? value.exists && !value.active && !value.revoked && value.expired : value.status === "unavailable" ? value.exists && !value.active && !value.revoked && !value.expired : !value.exists && !value.active && !value.revoked && !value.expired;
+  if (!valid) {
+    context.addIssue({
+      code: import_zod.z.ZodIssueCode.custom,
+      message: "delegation status flags do not match status"
+    });
+  }
+});
+var DelegationRevocationReceiptSchema = import_zod.z.object({
+  revoked: import_zod.z.literal(true),
+  cid: import_zod.z.string().min(1)
+}).strict();
+var AccountDelegationResourceSchema = import_zod.z.object({
+  resource: import_zod.z.string().min(1),
+  actions: import_zod.z.array(import_zod.z.string()),
+  caveats: import_zod.z.array(import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()))
+}).strict();
+var AccountDelegationDateSchema = import_zod.z.string().datetime({ offset: true }).transform((value) => new Date(value));
+var AccountDelegationRecordSchema = import_zod.z.object({
+  cid: import_zod.z.string().min(1),
+  direction: import_zod.z.enum(["granted", "received"]),
+  delegatorDid: import_zod.z.string().min(1),
+  delegateDid: import_zod.z.string().min(1),
+  resources: import_zod.z.array(AccountDelegationResourceSchema),
+  parents: import_zod.z.array(import_zod.z.string()),
+  issuedAt: AccountDelegationDateSchema.nullable(),
+  notBefore: AccountDelegationDateSchema.nullable(),
+  expiresAt: AccountDelegationDateSchema.nullable(),
+  status: import_zod.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]),
+  revokedAt: AccountDelegationDateSchema.nullable().optional(),
+  revokedBy: import_zod.z.string().optional(),
+  revokedAncestorCid: import_zod.z.string().optional()
+}).strict();
+var AccountDelegationPageSchema = import_zod.z.object({
+  schemaVersion: import_zod.z.literal(2),
+  items: import_zod.z.array(AccountDelegationRecordSchema),
+  nextCursor: import_zod.z.string().optional()
+}).strict();
+var AccountDelegationQueryOptionsSchema = import_zod.z.object({
+  direction: import_zod.z.enum(["granted", "received", "all", "issued"]).optional(),
+  status: import_zod.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]).optional(),
+  space: import_zod.z.string().trim().min(1).optional(),
+  limit: import_zod.z.number().int().min(1).max(100).optional(),
+  cursor: import_zod.z.string().min(1).optional()
+}).strict();
+var CapabilityEntrySchema = import_zod.z.object({
+  /** Resource URI this capability applies to */
+  resource: import_zod.z.string(),
+  /** Action this capability authorizes */
+  action: import_zod.z.string(),
+  /** Keys that can exercise this capability, ordered by priority */
+  keys: import_zod.z.array(KeyInfoSchema),
+  /** The delegation that grants this capability */
+  delegation: DelegationSchema,
+  /** When this capability expires (accepts Date or ISO string from JSON) */
+  expiresAt: import_zod.z.coerce.date().optional()
+});
+var DelegationRecordSchema = import_zod.z.object({
+  /** Content identifier (CID) of the delegation */
+  cid: import_zod.z.string(),
+  /** Space ID this delegation applies to */
+  spaceId: import_zod.z.string(),
+  /** DID of the delegator (grantor) */
+  delegator: import_zod.z.string(),
+  /** DID of the delegatee (recipient) */
+  delegatee: import_zod.z.string(),
+  /** Key ID used to sign/exercise this delegation */
+  keyId: import_zod.z.string().optional(),
+  /** Resource path pattern this delegation grants access to */
+  path: import_zod.z.string(),
+  /** Actions this delegation authorizes */
+  actions: import_zod.z.array(import_zod.z.string()),
+  /** When this delegation expires (accepts Date or ISO string from JSON) */
+  expiry: import_zod.z.coerce.date().optional(),
+  /** When this delegation becomes valid (not before) (accepts Date or ISO string) */
+  notBefore: import_zod.z.coerce.date().optional(),
+  /** Whether this delegation has been revoked */
+  isRevoked: import_zod.z.boolean(),
+  /** When this delegation was created (accepts Date or ISO string from JSON) */
+  createdAt: import_zod.z.coerce.date(),
+  /** Parent delegation CID if this is a sub-delegation */
+  parentCid: import_zod.z.string().optional()
+});
+var CreateDelegationParamsSchema = import_zod.z.object({
+  /** DID of the delegate (the party receiving the delegation) */
+  delegateDID: import_zod.z.string(),
+  /** Resource path this delegation grants access to */
+  path: import_zod.z.string(),
+  /** Actions to authorize */
+  actions: import_zod.z.array(import_zod.z.string()),
+  /** When this delegation expires (accepts Date or ISO string) */
+  expiry: import_zod.z.coerce.date().optional(),
+  /** Whether to disable sub-delegation */
+  disableSubDelegation: import_zod.z.boolean().optional(),
+  /** Optional statement for the SIWE message */
+  statement: import_zod.z.string().optional()
+});
+var DelegationChainSchema = import_zod.z.array(DelegationSchema);
+var DelegationChainV2Schema = import_zod.z.object({
+  /** The root delegation from the original authority */
+  root: DelegationSchema,
+  /** Intermediate delegations in the chain (may be empty) */
+  chain: import_zod.z.array(DelegationSchema),
+  /** The final delegation to the current user */
+  leaf: DelegationSchema
+});
+var DelegationDirectionSchema = import_zod.z.enum(["granted", "received", "all"]);
+var DelegationFiltersSchema = import_zod.z.object({
+  /** Filter by delegation direction */
+  direction: DelegationDirectionSchema.optional(),
+  /** Filter by resource path pattern */
+  path: import_zod.z.string().optional(),
+  /** Filter by required actions */
+  actions: import_zod.z.array(import_zod.z.string()).optional(),
+  /** Include revoked delegations */
+  includeRevoked: import_zod.z.boolean().optional(),
+  /** Filter by delegator DID */
+  delegator: import_zod.z.string().optional(),
+  /** Filter by delegatee DID */
+  delegatee: import_zod.z.string().optional(),
+  /** Only include delegations valid at this time */
+  validAt: import_zod.z.coerce.date().optional(),
+  /** Maximum number of results to return */
+  limit: import_zod.z.number().optional(),
+  /** Cursor for pagination */
+  cursor: import_zod.z.string().optional()
+});
+var SpaceOwnershipSchema = import_zod.z.enum(["owned", "delegated"]);
+var SpaceInfoSchema = import_zod.z.object({
+  /** Space identifier */
+  id: import_zod.z.string(),
+  /** Human-readable name for the space */
+  name: import_zod.z.string().optional(),
+  /** DID of the space owner */
+  owner: import_zod.z.string(),
+  /** Whether user owns or has delegated access */
+  type: SpaceOwnershipSchema,
+  /** Permissions the user has in this space */
+  permissions: import_zod.z.array(import_zod.z.string()).optional(),
+  /** When the access expires (for delegated spaces) */
+  expiresAt: import_zod.z.coerce.date().optional()
+});
+var ShareSchemaSchema = import_zod.z.enum(["base64", "compact", "ipfs"]);
+var ShareLinkSchema = import_zod.z.object({
+  /** Unique token identifying this share link */
+  token: import_zod.z.string(),
+  /** Full URL for sharing */
+  url: import_zod.z.string(),
+  /** The delegation this link grants access to */
+  delegation: DelegationSchema,
+  /** Encoding schema used for the link */
+  schema: ShareSchemaSchema,
+  /** When this share link expires */
+  expiresAt: import_zod.z.coerce.date().optional(),
+  /** Human-readable description of what is being shared */
+  description: import_zod.z.string().optional()
+});
+function createShareLinkDataSchema(dataSchema) {
+  return import_zod.z.object({
+    /** The retrieved data */
+    data: dataSchema,
+    /** The delegation that authorized this access */
+    delegation: DelegationSchema,
+    /** The space the data belongs to */
+    spaceId: import_zod.z.string(),
+    /** The resource path that was accessed */
+    path: import_zod.z.string()
+  });
+}
+var ShareLinkDataSchema = createShareLinkDataSchema(import_zod.z.unknown());
+var IngestOptionsSchema = import_zod.z.object({
+  /** Whether to persist the delegation to storage */
+  persist: import_zod.z.boolean().optional(),
+  /** Whether to validate the full delegation chain */
+  validateChain: import_zod.z.boolean().optional(),
+  /** Name for the ingested key */
+  keyName: import_zod.z.string().optional(),
+  /** Whether to create a session key for this delegation */
+  createSessionKey: import_zod.z.boolean().optional(),
+  /** Override the priority for the ingested key */
+  priority: import_zod.z.number().optional()
+});
+var GenerateShareParamsSchema = import_zod.z.object({
+  /** Resource path to share */
+  path: import_zod.z.string(),
+  /** Actions to authorize */
+  actions: import_zod.z.array(import_zod.z.string()).optional(),
+  /** When the share link expires */
+  expiry: import_zod.z.coerce.date().optional(),
+  /** Encoding schema for the link */
+  schema: ShareSchemaSchema.optional(),
+  /** Human-readable description */
+  description: import_zod.z.string().optional(),
+  /** Base URL for the share link */
+  baseUrl: import_zod.z.string().optional(),
+  /**
+   * Whether the recipient may re-delegate the share. Default `true`.
+   * `false` issues a terminal delegation: the node refuses onward `/delegate`.
+   * Without a session-key delegation that covers the path, `false` fails with PERMISSION_DENIED.
+   * Receive such a share with `receive(link, { autoSubdelegate: false })`; the default auto-subdelegation is refused for it.
+   */
+  allowSubDelegation: import_zod.z.boolean().optional()
+});
+var DelegationManagerConfigSchema = import_zod.z.object({
+  /** TinyCloud host URLs */
+  hosts: import_zod.z.array(import_zod.z.string()),
+  /** Account space used by account-wide delegation history queries */
+  accountSpaceId: import_zod.z.string().min(1).optional(),
+  /** Active session for authentication */
+  session: import_zod.z.unknown().refine(
+    (val) => val !== null && typeof val === "object",
+    { message: "Expected a ServiceSession object" }
+  ),
+  /** Platform-specific invoke function */
+  invoke: import_zod.z.unknown().refine(
+    (val) => typeof val === "function",
+    { message: "Expected an invoke function" }
+  ),
+  /** Platform-specific invoke function for raw resource URIs */
+  invokeAny: import_zod.z.unknown().refine(
+    (val) => val === void 0 || typeof val === "function",
+    { message: "Expected an invokeAny function or undefined" }
+  ).optional(),
+  /** Optional owner-signed authorization for direct CID revocation */
+  signOwnerRevocation: import_zod.z.custom().optional(),
+  /** Optional signer for proofless invocations by the session's own did:key (issued-delegation list and revoke) */
+  sessionInvocationSigner: import_zod.z.custom().optional(),
+  /** Optional custom fetch implementation */
+  fetch: import_zod.z.unknown().refine(
+    (val) => val === void 0 || typeof val === "function",
+    { message: "Expected a fetch function or undefined" }
+  ).optional()
+});
+var KeyProviderSchema = import_zod.z.object({
+  /** Generate a new session key, returns key ID */
+  createSessionKey: import_zod.z.unknown().refine(
+    (val) => typeof val === "function",
+    { message: "Expected a function" }
+  ),
+  /** Get JWK for a key */
+  getJWK: import_zod.z.unknown().refine(
+    (val) => typeof val === "function",
+    { message: "Expected a function" }
+  ),
+  /** Get DID for a key */
+  getDID: import_zod.z.unknown().refine(
+    (val) => typeof val === "function",
+    { message: "Expected a function" }
+  )
+});
+var DelegationApiResponseSchema = import_zod.z.object({
+  /** SIWE message content */
+  siwe: import_zod.z.string(),
+  /** Signature of the SIWE message */
+  signature: import_zod.z.string(),
+  /** Delegation version */
+  version: import_zod.z.number(),
+  /** CID of the created delegation */
+  cid: import_zod.z.string().optional()
+});
+var DelegatedResourceSchema = import_zod.z.object({
+  /** Short-form service name, e.g. "kv", "sql", "duckdb", "capabilities", "hooks". */
+  service: import_zod.z.string(),
+  /** Full space id string, e.g. "tinycloud:pkh:eip155:1:0x....:default". */
+  space: import_zod.z.string(),
+  /** Resource path; empty string when the resource URI had no path segment. */
+  path: import_zod.z.string(),
+  /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
+  actions: import_zod.z.array(import_zod.z.string()),
+  /** Exact ReCap caveats that constrain every action in this scope. */
+  caveats: import_zod.z.array(import_zod.z.record(import_zod.z.string(), import_zod.z.unknown())).optional()
+});
+var CreateDelegationWasmParamsSchema = import_zod.z.object({
+  /** The session containing delegation credentials */
+  session: import_zod.z.unknown().refine(
+    (val) => val !== null && typeof val === "object",
+    { message: "Expected a ServiceSession object" }
+  ),
+  /** DID of the delegate */
+  delegateDID: import_zod.z.string(),
+  /** Space ID this delegation applies to */
+  spaceId: import_zod.z.string(),
+  /**
+   * Multi-resource abilities map: short-service → path → full-URN actions.
+   * Matches the shape accepted by `prepareSession`.
+   *
+   * Example:
+   * ```
+   * {
+   *   kv: {
+   *     "com.listen.app/": ["tinycloud.kv/get", "tinycloud.kv/put"]
+   *   },
+   *   sql: {
+   *     "com.listen.app/data.sqlite": ["tinycloud.sql/read"]
+   *   }
+   * }
+   * ```
+   */
+  abilities: import_zod.z.record(import_zod.z.string(), import_zod.z.record(import_zod.z.string(), import_zod.z.array(import_zod.z.string()))),
+  /** Expiration time in seconds since Unix epoch */
+  expirationSecs: import_zod.z.number(),
+  /** Optional not-before time in seconds since Unix epoch */
+  notBeforeSecs: import_zod.z.number().optional(),
+  /** Issue a terminal delegation: the node refuses onward delegation. Default `false`. */
+  disableSubDelegation: import_zod.z.boolean().optional()
+});
+var CreateDelegationWasmResultSchema = import_zod.z.object({
+  /** Base64url-encoded UCAN delegation */
+  delegation: import_zod.z.string(),
+  /** CID of the delegation */
+  cid: import_zod.z.string(),
+  /** DID of the delegate */
+  delegateDID: import_zod.z.string(),
+  /** Expiration time */
+  expiry: import_zod.z.coerce.date(),
+  /**
+   * All (service, space, path, actions) entries granted by this delegation.
+   * Always non-empty on success.
+   */
+  resources: import_zod.z.array(DelegatedResourceSchema)
+});
+
+// src/delegations/shared.ts
+var DelegationAction = {
+  REVOKE: "tinycloud.delegation/revoke",
+  STATUS: "tinycloud.delegation/status",
+  LIST: "tinycloud.delegation/list",
+  GET: "tinycloud.delegation/get",
+  CHECK: "tinycloud.delegation/check"
+};
+function createError(code, message, cause, meta) {
+  return {
+    code,
+    message,
+    service: "delegation",
+    cause,
+    meta
+  };
+}
+
+// src/delegations/issued.ts
+var ISSUED_QUERY_FEATURE = "delegation-issued-query-v1";
+async function refusalText(response) {
+  const text = await response.text();
+  return text.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, 200);
+}
+async function issuedHttpError(response, what, meta) {
+  const text = await refusalText(response);
+  const details = { ...meta, status: response.status };
+  if (response.status === 401 || response.status === 403) {
+    return createError(
+      DelegationErrorCodes.PERMISSION_DENIED,
+      text === "" ? "The node refused the request" : text,
+      void 0,
+      details
+    );
+  }
+  if (response.status === 400 && text.includes("invalid delegation query cursor")) {
+    return createError(
+      DelegationErrorCodes.INVALID_CURSOR,
+      "The node rejected the page cursor; list again from the start",
+      void 0,
+      details
+    );
+  }
+  if (response.status === 503) {
+    return createError(
+      DelegationErrorCodes.CHAIN_TOO_DEEP,
+      "This delegation chain is too long for the node to check right now; try again later",
+      void 0,
+      { ...details, retryable: true }
+    );
+  }
+  return createError(
+    DelegationErrorCodes.NETWORK_ERROR,
+    `${what}: ${response.status} - ${text}`,
+    void 0,
+    details
+  );
+}
+async function nodeListsIssued(ctx) {
+  if (ctx.state.issuedQuerySupported) return { ok: true, data: true };
+  const response = await ctx.fetchFn(`${ctx.host}/info`);
+  if (!response.ok) {
+    return {
+      ok: false,
+      error: createError(
+        DelegationErrorCodes.NETWORK_ERROR,
+        `Couldn't read the node's info: ${response.status}`,
+        void 0,
+        { status: response.status }
+      )
+    };
+  }
+  const info = await response.json();
+  ctx.state.issuedQuerySupported = Array.isArray(info.features) && info.features.includes(ISSUED_QUERY_FEATURE);
+  return { ok: true, data: ctx.state.issuedQuerySupported };
+}
+async function queryIssued(ctx, options) {
+  const signer = ctx.sessionInvocationSigner;
+  if (!signer) {
+    return {
+      ok: false,
+      error: createError(
+        DelegationErrorCodes.NOT_INITIALIZED,
+        "Listing issued delegations needs a session key signer"
+      )
+    };
+  }
+  try {
+    const supported = await nodeListsIssued(ctx);
+    if (!supported.ok) return supported;
+    if (!supported.data) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.UNSUPPORTED_OPERATION,
+          "This node doesn't support listing issued delegations yet",
+          void 0,
+          { feature: ISSUED_QUERY_FEATURE }
+        )
+      };
+    }
+    const authorization = await signer.sign({
+      [`${signer.did()}/delegation`]: { [DelegationAction.LIST]: [{}] }
+    });
+    const response = await ctx.fetchFn(`${ctx.host}/delegation/query`, {
+      method: "POST",
+      headers: { Authorization: authorization, "content-type": "application/json" },
+      body: JSON.stringify(options)
+    });
+    if (!response.ok) {
+      return {
+        ok: false,
+        error: await issuedHttpError(response, "Failed to query issued delegations", {})
+      };
+    }
+    const parsed = AccountDelegationPageSchema.safeParse(await response.json());
+    if (!parsed.success) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.INVALID_TOKEN,
+          "Node returned an invalid delegation query response"
+        )
+      };
+    }
+    return { ok: true, data: parsed.data };
+  } catch (error) {
+    return {
+      ok: false,
+      error: createError(
+        DelegationErrorCodes.NETWORK_ERROR,
+        `Network error during delegation query: ${String(error)}`,
+        error instanceof Error ? error : void 0
+      )
+    };
+  }
+}
+async function queryAllIssued(query, options) {
+  const { pageSize = 100, maxItems, untilCid, ...filters } = options;
+  if (maxItems !== void 0 && (!Number.isInteger(maxItems) || maxItems < 1)) {
+    return {
+      ok: false,
+      error: createError(DelegationErrorCodes.INVALID_INPUT, "maxItems must be a positive integer")
+    };
+  }
+  const items = [];
+  const seen = /* @__PURE__ */ new Set();
+  let cursor;
+  do {
+    const limit = Math.min(pageSize, maxItems === void 0 ? pageSize : maxItems - items.length);
+    const page = await query({
+      ...filters,
+      direction: "issued",
+      limit,
+      ...cursor === void 0 ? {} : { cursor }
+    });
+    if (!page.ok) return page;
+    items.push(...page.data.items);
+    cursor = page.data.nextCursor;
+    if (cursor !== void 0) {
+      if (seen.has(cursor)) {
+        return {
+          ok: false,
+          error: createError(
+            DelegationErrorCodes.INVALID_TOKEN,
+            "The node returned the same page cursor twice while listing issued delegations"
+          )
+        };
+      }
+      seen.add(cursor);
+    }
+  } while (cursor !== void 0 && (maxItems === void 0 || items.length < maxItems) && !(untilCid !== void 0 && items.some((item) => item.cid === untilCid)));
+  return { ok: true, data: maxItems === void 0 ? items : items.slice(0, maxItems) };
+}
+async function revokeIssued(ctx, cid) {
+  if (!cid) {
+    return {
+      ok: false,
+      error: createError(DelegationErrorCodes.INVALID_INPUT, "cid is required")
+    };
+  }
+  const signer = ctx.sessionInvocationSigner;
+  if (!signer) {
+    return {
+      ok: false,
+      error: createError(
+        DelegationErrorCodes.NOT_INITIALIZED,
+        "Revoking an issued delegation needs a session key signer"
+      )
+    };
+  }
+  try {
+    const authorization = await signer.sign({
+      [`urn:cid:${cid}`]: { [DelegationAction.REVOKE]: [{}] }
+    });
+    const response = await ctx.fetchFn(`${ctx.host}/revoke`, {
+      method: "POST",
+      headers: { Authorization: authorization }
+    });
+    if (!response.ok) {
+      if (response.status === 404) {
+        return {
+          ok: false,
+          error: createError(DelegationErrorCodes.NOT_FOUND, `Delegation not found: ${cid}`)
+        };
+      }
+      return {
+        ok: false,
+        error: await issuedHttpError(response, "Failed to revoke delegation", { cid })
+      };
+    }
+    const parsed = DelegationRevocationReceiptSchema.safeParse(await response.json());
+    if (!parsed.success || parsed.data.cid !== cid) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.REVOCATION_FAILED,
+          "Node returned an invalid delegation revocation receipt",
+          void 0,
+          { cid }
+        )
+      };
+    }
+    return { ok: true, data: parsed.data };
+  } catch (error) {
+    return {
+      ok: false,
+      error: createError(
+        DelegationErrorCodes.NETWORK_ERROR,
+        `Network error during delegation revocation: ${String(error)}`,
+        error instanceof Error ? error : void 0
+      )
+    };
+  }
+}
+//# sourceMappingURL=issued.cjs.map