@tinycloud/node-sdk 2.6.0-beta.0 → 2.6.0-beta.2

package/dist/{core-ojeY-wet.d.cts → core-Cr-zD1lk.d.cts}

@@ -910,6 +910,12 @@ declare class TinyCloudNode {
     private _delegationManager?;
     private _spaceService?;
     private runtimePermissionGrants;
+    /**
+     * Memoized `recapOperationsFromSession` result, keyed by the exact SIWE it
+     * was parsed from. The primary session is stable for the life of a sign-in,
+     * so this avoids re-parsing the recap on every registration.
+     */
+    private _recapOperationsCache?;
     /**
      * TinyCloudSession captured by {@link restoreSession} when there's no
      * auth-layer signer available (session-only mode used by OpenKey-backed
@@ -1052,6 +1058,42 @@ declare class TinyCloudNode {
     private isFreshBootstrapAccount;
     private runAccountBootstrap;
     private registerBootstrapRuntimeGrant;
+    /**
+     * Map the base session's OWN recap into runtime permission operations.
+     *
+     * Uses the RAW `parseRecapFromSiwe` binding — NOT `parseRecapCapabilities`,
+     * whose `normalizeSpace` collapses `tinycloud:pkh:...:<owner>:<space>` to a
+     * bare short name and would conflate two owners' identically-named spaces.
+     * We must keep the full owner-scoped URI so a synthetic primary grant can
+     * never cover an operation on a different owner's space.
+     *
+     * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
+     * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
+     * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+     * One op per action.
+     *
+     * Returns `[]` for session-only / restored-without-siwe modes and for any
+     * unparseable SIWE — the primary grant is simply not registered in that case.
+     */
+    private recapOperationsFromSession;
+    /**
+     * Register the base (primary) session's own recap as a synthetic runtime
+     * grant tagged `provenance: "primary"` so it always out-ranks other covering
+     * grants in {@link findGrantForOperations}. This closes the selection-design
+     * hazard where a broad — possibly broken — bootstrap/delegated grant could
+     * hijack an operation the primary session itself already authorized (TC-111).
+     *
+     * Two safety exclusions:
+     *  - Ops whose space is in `lastActivationSkippedSpaceIds` are dropped: the
+     *    node refused to activate those spaces this sign-in even though the recap
+     *    claims them. Including them would let the synthetic primary out-rank a
+     *    working grant and 401 (the "skipped-activation inverted hijack").
+     *  - Encryption `resource` ops are kept as-is (space-independent).
+     *
+     * No-ops when nothing remains after exclusion. Callers (`signIn`,
+     * `restoreSession`) clear `runtimePermissionGrants` first, so no dupes.
+     */
+    private registerPrimarySessionGrant;
     private writeManifestRegistryRecords;
     private scheduleAccountRegistrySync;
     private withAccountRegistryRetry;

package/dist/{core-ojeY-wet.d.ts → core-Cr-zD1lk.d.ts}

@@ -910,6 +910,12 @@ declare class TinyCloudNode {
     private _delegationManager?;
     private _spaceService?;
     private runtimePermissionGrants;
+    /**
+     * Memoized `recapOperationsFromSession` result, keyed by the exact SIWE it
+     * was parsed from. The primary session is stable for the life of a sign-in,
+     * so this avoids re-parsing the recap on every registration.
+     */
+    private _recapOperationsCache?;
     /**
      * TinyCloudSession captured by {@link restoreSession} when there's no
      * auth-layer signer available (session-only mode used by OpenKey-backed
@@ -1052,6 +1058,42 @@ declare class TinyCloudNode {
     private isFreshBootstrapAccount;
     private runAccountBootstrap;
     private registerBootstrapRuntimeGrant;
+    /**
+     * Map the base session's OWN recap into runtime permission operations.
+     *
+     * Uses the RAW `parseRecapFromSiwe` binding — NOT `parseRecapCapabilities`,
+     * whose `normalizeSpace` collapses `tinycloud:pkh:...:<owner>:<space>` to a
+     * bare short name and would conflate two owners' identically-named spaces.
+     * We must keep the full owner-scoped URI so a synthetic primary grant can
+     * never cover an operation on a different owner's space.
+     *
+     * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
+     * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
+     * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+     * One op per action.
+     *
+     * Returns `[]` for session-only / restored-without-siwe modes and for any
+     * unparseable SIWE — the primary grant is simply not registered in that case.
+     */
+    private recapOperationsFromSession;
+    /**
+     * Register the base (primary) session's own recap as a synthetic runtime
+     * grant tagged `provenance: "primary"` so it always out-ranks other covering
+     * grants in {@link findGrantForOperations}. This closes the selection-design
+     * hazard where a broad — possibly broken — bootstrap/delegated grant could
+     * hijack an operation the primary session itself already authorized (TC-111).
+     *
+     * Two safety exclusions:
+     *  - Ops whose space is in `lastActivationSkippedSpaceIds` are dropped: the
+     *    node refused to activate those spaces this sign-in even though the recap
+     *    claims them. Including them would let the synthetic primary out-rank a
+     *    working grant and 401 (the "skipped-activation inverted hijack").
+     *  - Encryption `resource` ops are kept as-is (space-independent).
+     *
+     * No-ops when nothing remains after exclusion. Callers (`signIn`,
+     * `restoreSession`) clear `runtimePermissionGrants` first, so no dupes.
+     */
+    private registerPrimarySessionGrant;
     private writeManifestRegistryRecords;
     private scheduleAccountRegistrySync;
     private withAccountRegistryRetry;

package/dist/core.cjs

@@ -2147,6 +2147,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
     this.initializeServices();
+    const primarySession = this.currentTinyCloudSession();
+    if (primarySession) {
+      this.registerPrimarySessionGrant(primarySession);
+    }
     const bootstrapped = await this.bootstrapAccountIfNeeded();
     await this.ensureRequestedEncryptionNetworks();
     if (!bootstrapped && this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
@@ -2390,7 +2394,107 @@ var _TinyCloudNode = class _TinyCloudNode {
         host: this.config.host
       },
       operations,
-      expiresAt
+      expiresAt,
+      provenance: "bootstrap"
+    });
+  }
+  /**
+   * Map the base session's OWN recap into runtime permission operations.
+   *
+   * Uses the RAW `parseRecapFromSiwe` binding — NOT `parseRecapCapabilities`,
+   * whose `normalizeSpace` collapses `tinycloud:pkh:...:<owner>:<space>` to a
+   * bare short name and would conflate two owners' identically-named spaces.
+   * We must keep the full owner-scoped URI so a synthetic primary grant can
+   * never cover an operation on a different owner's space.
+   *
+   * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
+   * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
+   * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+   * One op per action.
+   *
+   * Returns `[]` for session-only / restored-without-siwe modes and for any
+   * unparseable SIWE — the primary grant is simply not registered in that case.
+   */
+  recapOperationsFromSession(session) {
+    const siwe = session.siwe;
+    if (!siwe) {
+      return [];
+    }
+    if (this._recapOperationsCache?.siwe === siwe) {
+      return this._recapOperationsCache.operations;
+    }
+    let operations = [];
+    try {
+      const entries = this.wasmBindings.parseRecapFromSiwe(siwe);
+      if (Array.isArray(entries)) {
+        operations = entries.flatMap((entry) => {
+          const service = this.invocationServiceName(entry.service);
+          return entry.actions.map((action) => ({
+            ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId: entry.space },
+            service,
+            path: entry.path,
+            action
+          }));
+        });
+      }
+    } catch {
+      operations = [];
+    }
+    this._recapOperationsCache = { siwe, operations };
+    return operations;
+  }
+  /**
+   * Register the base (primary) session's own recap as a synthetic runtime
+   * grant tagged `provenance: "primary"` so it always out-ranks other covering
+   * grants in {@link findGrantForOperations}. This closes the selection-design
+   * hazard where a broad — possibly broken — bootstrap/delegated grant could
+   * hijack an operation the primary session itself already authorized (TC-111).
+   *
+   * Two safety exclusions:
+   *  - Ops whose space is in `lastActivationSkippedSpaceIds` are dropped: the
+   *    node refused to activate those spaces this sign-in even though the recap
+   *    claims them. Including them would let the synthetic primary out-rank a
+   *    working grant and 401 (the "skipped-activation inverted hijack").
+   *  - Encryption `resource` ops are kept as-is (space-independent).
+   *
+   * No-ops when nothing remains after exclusion. Callers (`signIn`,
+   * `restoreSession`) clear `runtimePermissionGrants` first, so no dupes.
+   */
+  registerPrimarySessionGrant(session) {
+    const skipped = this.auth ? this.auth.lastActivationSkippedSpaceIds ?? [] : [];
+    const operations = this.recapOperationsFromSession(session).filter(
+      (operation) => operation.spaceId === void 0 || !skipped.some((spaceId) => this.spaceIdsEqual(spaceId, operation.spaceId))
+    );
+    if (operations.length === 0) {
+      return;
+    }
+    const expiresAt = extractSiweExpiration(session.siwe) ?? this.getSessionExpiry();
+    const actions = [...new Set(operations.map((operation) => operation.action))];
+    this.runtimePermissionGrants.push({
+      session: {
+        delegationHeader: session.delegationHeader,
+        delegationCid: session.delegationCid,
+        spaceId: session.spaceId,
+        verificationMethod: session.verificationMethod,
+        jwk: session.jwk
+      },
+      delegation: {
+        cid: session.delegationCid,
+        delegationHeader: session.delegationHeader,
+        delegateDID: session.verificationMethod,
+        delegatorDID: this.did,
+        spaceId: session.spaceId,
+        path: "",
+        actions,
+        expiry: expiresAt,
+        allowSubDelegation: true,
+        ownerAddress: session.address,
+        chainId: session.chainId,
+        host: this.config.host
+      },
+      operations,
+      expiresAt,
+      provenance: "primary"
     });
   }
   async writeManifestRegistryRecords() {
@@ -2726,6 +2830,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       } else {
         this._restoredTcSession = tcSession;
       }
+      this.registerPrimarySessionGrant(tcSession);
     }
   }
   /**
@@ -3764,7 +3869,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   getRuntimePermissionDelegations(permissions) {
     this.pruneExpiredRuntimePermissionGrants();
     if (permissions === void 0) {
-      return this.runtimePermissionGrants.map((grant) => grant.delegation);
+      return this.runtimePermissionGrants.filter((grant) => grant.provenance !== "primary").map((grant) => grant.delegation);
     }
     const session = this.currentTinyCloudSession();
     if (!session || !Array.isArray(permissions) || permissions.length === 0) {
@@ -3916,7 +4021,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         },
         delegation,
         operations: this.permissionOperations(delegatedEntries, spaceId),
-        expiresAt
+        expiresAt,
+        provenance: "runtime"
       });
       delegations.push(delegation);
     }
@@ -4577,7 +4683,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       return grants;
     }
     for (const operation of operations) {
-      const grant = this.findGrantForOperation(operation);
+      const grant = this.findGrantForOperation(operation, { excludePrimary: true });
       if (!grant) {
         return [];
       }
@@ -4617,7 +4723,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       delegation,
       operations,
-      expiresAt: delegation.expiry
+      expiresAt: delegation.expiry,
+      provenance: "delegated"
     };
   }
   installRuntimeGrantFromServiceSession(delegation, session, expiresAt) {
@@ -4632,7 +4739,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       session,
       delegation,
       operations,
-      expiresAt
+      expiresAt,
+      provenance: "delegated"
     });
   }
   delegatedResourcesForEntries(entries, spaceId) {
@@ -4732,21 +4840,28 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     return grant?.session ?? fallback;
   }
-  findGrantForOperations(operations) {
+  findGrantForOperations(operations, options) {
     if (operations.length === 0) {
       return void 0;
     }
     this.pruneExpiredRuntimePermissionGrants();
-    return this.runtimePermissionGrants.find((grant) => {
+    const covering = this.runtimePermissionGrants.filter((grant) => {
+      if (options?.excludePrimary && grant.provenance === "primary") {
+        return false;
+      }
       return operations.every(
         (operation) => grant.operations.some(
           (granted) => this.operationCovers(granted, operation)
         )
       );
     });
+    if (covering.length === 0) {
+      return void 0;
+    }
+    return covering.find((grant) => grant.provenance === "primary") ?? covering[0];
   }
-  findGrantForOperation(operation) {
-    return this.findGrantForOperations([operation]);
+  findGrantForOperation(operation, options) {
+    return this.findGrantForOperations([operation], options);
   }
   pruneExpiredRuntimePermissionGrants() {
     const now = Date.now();