@tinycloud/node-sdk 2.6.3 → 2.6.4-beta.1

package/dist/{core-C6iGIPrJ.d.cts → core-BVk0VwGe.d.cts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, ResolvedDelegate, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -199,6 +199,8 @@ interface NodeUserAuthorizationConfig {
     enablePublicSpace?: boolean;
     /** WASM bindings for cryptographic operations. Required. */
     wasmBindings: IWasmBindings;
+    /** Existing session manager to share with a higher-level SDK client. */
+    sessionManager?: ISessionManager;
     /**
      * SIWE nonce override. If omitted, the WASM layer generates a random nonce.
      * If `siweConfig.nonce` is also provided, `siweConfig.nonce` wins.
@@ -295,6 +297,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private _capabilityRequest?;
     private readonly includeAccountRegistryPermissions;
     private sessionManager;
+    private activeSessionKeyId;
     private extensions;
     private _session?;
     private _tinyCloudSession?;

package/dist/{core-C6iGIPrJ.d.ts → core-BVk0VwGe.d.ts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, ResolvedDelegate, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, AccountService, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -199,6 +199,8 @@ interface NodeUserAuthorizationConfig {
     enablePublicSpace?: boolean;
     /** WASM bindings for cryptographic operations. Required. */
     wasmBindings: IWasmBindings;
+    /** Existing session manager to share with a higher-level SDK client. */
+    sessionManager?: ISessionManager;
     /**
      * SIWE nonce override. If omitted, the WASM layer generates a random nonce.
      * If `siweConfig.nonce` is also provided, `siweConfig.nonce` wins.
@@ -295,6 +297,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private _capabilityRequest?;
     private readonly includeAccountRegistryPermissions;
     private sessionManager;
+    private activeSessionKeyId;
     private extensions;
     private _session?;
     private _tinyCloudSession?;

package/dist/core.cjs

@@ -348,6 +348,7 @@ function addRawAbility(rawAbilities, resource, action) {
 }
 var NodeUserAuthorization = class {
   constructor(config) {
+    this.activeSessionKeyId = "default";
     this.extensions = [];
     this._nodeFeatures = [];
     this._lastActivationSkippedSpaceIds = [];
@@ -396,7 +397,7 @@ var NodeUserAuthorization = class {
     this.includeAccountRegistryPermissions = config.includeAccountRegistryPermissions ?? true;
     this._manifest = config.manifest;
     this._capabilityRequest = config.capabilityRequest;
-    this.sessionManager = this.wasm.createSessionManager();
+    this.sessionManager = config.sessionManager ?? this.wasm.createSessionManager();
   }
   /**
    * Return the manifest currently driving sign-in behavior, or
@@ -903,7 +904,8 @@ var NodeUserAuthorization = class {
     const chainId = this._chainId;
     await this.resolveTinyCloudHostsForSignIn(address, chainId);
     const keyId = `session-${Date.now()}`;
-    this.sessionManager.renameSessionKeyId("default", keyId);
+    this.sessionManager.renameSessionKeyId(this.activeSessionKeyId, keyId);
+    this.activeSessionKeyId = keyId;
     const jwkString = this.sessionManager.jwk(keyId);
     if (!jwkString) {
       throw new Error("Failed to create session key");
@@ -1052,7 +1054,8 @@ var NodeUserAuthorization = class {
     const address = (0, import_sdk_core3.canonicalizeAddress)(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     const keyId = `session-${Date.now()}`;
-    this.sessionManager.renameSessionKeyId("default", keyId);
+    this.sessionManager.renameSessionKeyId(this.activeSessionKeyId, keyId);
+    this.activeSessionKeyId = keyId;
     const jwkString = this.sessionManager.jwk(keyId);
     if (!jwkString) {
       throw new Error("Failed to create session key");
@@ -1959,6 +1962,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       signer: this.signer,
       signStrategy: config.signStrategy ?? { type: "auto-sign" },
       wasmBindings: this.wasmBindings,
+      sessionManager: this.sessionManager,
       sessionStorage: config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
       spacePrefix: config.prefix,
@@ -2147,6 +2151,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.runtimePermissionGrants = [];
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
+    const signedInSession = this.currentTinyCloudSession();
+    if (signedInSession) {
+      this.sessionKeyId = signedInSession.sessionKey;
+      this.sessionKeyJwk = signedInSession.jwk;
+    }
     this.initializeServices();
     const primarySession = this.currentTinyCloudSession();
     if (primarySession) {
@@ -2948,6 +2957,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       signer: this.signer,
       signStrategy: this.config.signStrategy ?? { type: "auto-sign" },
       wasmBindings: this.wasmBindings,
+      sessionManager: this.sessionManager,
       sessionStorage: options?.sessionStorage ?? this.config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
       spacePrefix: prefix,
@@ -2995,6 +3005,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       signer: this.signer,
       signStrategy: this.config.signStrategy ?? { type: "auto-sign" },
       wasmBindings: this.wasmBindings,
+      sessionManager: this.sessionManager,
       sessionStorage: options?.sessionStorage ?? this.config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
       spacePrefix: prefix,
@@ -3470,7 +3481,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegationCid: params.session.delegationCid,
       jwk: params.session.jwk,
       spaceId: params.session.spaceId,
-      verificationMethod: params.session.verificationMethod
+      // Session storage carries the verification method as a DID URL
+      // (`did:key:...#key-id`). The Rust UCAN builder expects the principal
+      // DID here and rejects the fragment as an invalid audience DID.
+      verificationMethod: params.session.verificationMethod.split("#", 1)[0]
     };
     const result = this.wasmBindings.createDelegation(
       wasmSession,