@tinycloud/node-sdk 2.6.1 → 2.6.2-beta.0

package/dist/index.js

@@ -18848,7 +18848,8 @@ var _TinyCloudNode = class _TinyCloudNode {
           return operation ? [operation] : [];
         })
       );
-      return this.wasmBindings.invokeAny(grant?.session ?? session, entries, facts);
+      const invocationSession = !grant || grant.provenance === "primary" ? session : grant.session;
+      return this.wasmBindings.invokeAny(invocationSession, entries, facts);
     };
     this.explicitHost = config.host;
     this.config = {
@@ -21402,7 +21403,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const { subset, missing } = isCapabilitySubset(expandedEntries, granted);
     if (!subset) {
       const runtimeGrant = this.findGrantForOperations(
-        this.permissionEntriesToOperations(expandedEntries, session)
+        this.permissionEntriesToOperations(expandedEntries, session),
+        { excludePrimary: true }
       );
       if (runtimeGrant) {
         const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
@@ -21861,7 +21863,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       path,
       action
     });
-    return grant?.session ?? fallback;
+    if (!grant) {
+      return fallback;
+    }
+    return grant.provenance === "primary" ? fallback : grant.session;
   }
   findGrantForOperations(operations, options) {
     if (operations.length === 0) {