@tinycloud/node-sdk 3.0.0-beta.13 → 3.0.0-beta.14

package/dist/{core-DWFGaDwP.d.cts → core-D4IVgDr5.d.cts}

@@ -1040,6 +1040,10 @@ declare class UnsupportedSessionRestoreError extends Error {
     readonly code: "RESTORE_SESSION_KEY_REPLACEMENT_UNSUPPORTED";
     constructor(reason?: string);
 }
+declare class InvalidRestoredSessionError extends Error {
+    readonly code: "AUTH_EXPIRED";
+    constructor(message?: string);
+}
 /**
  * Configuration for TinyCloudNode.
  * All fields are optional - TinyCloudNode can work with zero configuration.
@@ -2460,4 +2464,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, serializeDelegation as G, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RuntimeDelegationActivator as l, type RuntimePermissionGrantOptions as m, type SecretReadInput as n, type SecretReadResult as o, type SignStrategy as p, type TinyCloudNodeConfig as q, type UnifiedOwnerRootReceipt as r, UnsupportedSessionRestoreError as s, type WasmKeyProviderConfig as t, activateCompactRuntimeDelegation as u, activateValidatedRuntimeDelegation as v, createWasmKeyProvider as w, defaultSignStrategy as x, deserializeDelegation as y, grantAuthRequest as z };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, serializeDelegation as G, InvalidRestoredSessionError as I, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RuntimeDelegationActivator as l, type RuntimePermissionGrantOptions as m, type SecretReadInput as n, type SecretReadResult as o, type SignStrategy as p, type TinyCloudNodeConfig as q, type UnifiedOwnerRootReceipt as r, UnsupportedSessionRestoreError as s, type WasmKeyProviderConfig as t, activateCompactRuntimeDelegation as u, activateValidatedRuntimeDelegation as v, createWasmKeyProvider as w, defaultSignStrategy as x, deserializeDelegation as y, grantAuthRequest as z };

package/dist/{core-DWFGaDwP.d.ts → core-D4IVgDr5.d.ts}

@@ -1040,6 +1040,10 @@ declare class UnsupportedSessionRestoreError extends Error {
     readonly code: "RESTORE_SESSION_KEY_REPLACEMENT_UNSUPPORTED";
     constructor(reason?: string);
 }
+declare class InvalidRestoredSessionError extends Error {
+    readonly code: "AUTH_EXPIRED";
+    constructor(message?: string);
+}
 /**
  * Configuration for TinyCloudNode.
  * All fields are optional - TinyCloudNode can work with zero configuration.
@@ -2460,4 +2464,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, serializeDelegation as G, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RuntimeDelegationActivator as l, type RuntimePermissionGrantOptions as m, type SecretReadInput as n, type SecretReadResult as o, type SignStrategy as p, type TinyCloudNodeConfig as q, type UnifiedOwnerRootReceipt as r, UnsupportedSessionRestoreError as s, type WasmKeyProviderConfig as t, activateCompactRuntimeDelegation as u, activateValidatedRuntimeDelegation as v, createWasmKeyProvider as w, defaultSignStrategy as x, deserializeDelegation as y, grantAuthRequest as z };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, serializeDelegation as G, InvalidRestoredSessionError as I, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RuntimeDelegationActivator as l, type RuntimePermissionGrantOptions as m, type SecretReadInput as n, type SecretReadResult as o, type SignStrategy as p, type TinyCloudNodeConfig as q, type UnifiedOwnerRootReceipt as r, UnsupportedSessionRestoreError as s, type WasmKeyProviderConfig as t, activateCompactRuntimeDelegation as u, activateValidatedRuntimeDelegation as v, createWasmKeyProvider as w, defaultSignStrategy as x, deserializeDelegation as y, grantAuthRequest as z };

package/dist/core.cjs

@@ -50,6 +50,7 @@ __export(core_exports, {
   DuckDbService: () => import_sdk_core15.DuckDbService,
   FileSessionStorage: () => FileSessionStorage,
   IdentityParseError: () => import_sdk_core11.IdentityParseError,
+  InvalidRestoredSessionError: () => InvalidRestoredSessionError,
   KVService: () => import_sdk_core13.KVService,
   ManifestValidationError: () => import_sdk_core12.ManifestValidationError,
   MemorySessionStorage: () => MemorySessionStorage,
@@ -2357,18 +2358,23 @@ var UnsupportedSessionRestoreError = class extends Error {
     this.name = "UnsupportedSessionRestoreError";
   }
 };
+var InvalidRestoredSessionError = class extends Error {
+  constructor(message = "Persisted session authority is invalid or expired.") {
+    super(message);
+    this.code = "AUTH_EXPIRED";
+    this.name = "InvalidRestoredSessionError";
+  }
+};
 function canonicalRestoredVerificationMethod(canonicalVerificationMethod, persistedVerificationMethod) {
   if (typeof persistedVerificationMethod !== "string") return void 0;
   const principal = canonicalVerificationMethod.split("#", 1)[0];
   return persistedVerificationMethod === principal || persistedVerificationMethod === canonicalVerificationMethod ? canonicalVerificationMethod : void 0;
 }
 function persistedExpiry(value) {
-  if (typeof value !== "string") {
-    throw new Error("Persisted session without a SIWE expiration must include expiresAt.");
-  }
+  if (typeof value !== "string") throw new InvalidRestoredSessionError("Persisted session must include expiresAt.");
   const expiry = new Date(value);
   if (!Number.isFinite(expiry.getTime()) || expiry.getTime() <= Date.now()) {
-    throw new Error("Persisted session expiry is invalid or expired.");
+    throw new InvalidRestoredSessionError();
   }
   return expiry;
 }
@@ -3560,7 +3566,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return;
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        if (/Unauthorized Action|\b401\b/.test(message)) {
+        if (/Unauthorized Action|\b(?:401|403)\b/.test(message)) {
           console.warn(
             "TinyCloud account registry sync stopped: authorization verdict is not retryable",
             error
@@ -3810,9 +3816,14 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   async restoreSession(sessionData) {
     await this.wasmBindings.ensureInitialized?.();
-    const restoredJwk = clonePersistedSessionJwk(sessionData.jwk);
+    let restoredJwk;
+    try {
+      restoredJwk = clonePersistedSessionJwk(sessionData.jwk);
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid private Ed25519 session key.");
+    }
     if (sessionData.chainId !== void 0 && (!Number.isSafeInteger(sessionData.chainId) || sessionData.chainId <= 0)) {
-      throw new Error("Persisted session chain ID must be a positive safe integer.");
+      throw new InvalidRestoredSessionError("Persisted session chain ID must be a positive safe integer.");
     }
     const stagedManager = this.wasmBindings.createSessionManager();
     const stagedReplace = stagedManager.replaceSessionKey;
@@ -3824,32 +3835,31 @@ var _TinyCloudNode = class _TinyCloudNode {
     let stagedKeyId;
     let stagedJwk;
     let canonicalVerificationMethod;
+    const keyIds = liveKeys.call(this.sessionManager);
+    if (!Array.isArray(keyIds) || !keyIds.every((keyId) => typeof keyId === "string")) {
+      throw new UnsupportedSessionRestoreError("it cannot reliably enumerate every live session signer");
+    }
+    for (const keyId of keyIds) {
+      if (keyId === this.sessionKeyId) continue;
+      const jwk = this.sessionManager.jwk(keyId);
+      if (!jwk) throw new Error("missing live session key");
+      stagedReplace.call(stagedManager, clonePersistedSessionJwk(JSON.parse(jwk)), keyId);
+    }
     try {
-      const keyIds = liveKeys.call(this.sessionManager);
-      if (!Array.isArray(keyIds) || !keyIds.every((keyId) => typeof keyId === "string")) {
-        throw new UnsupportedSessionRestoreError("it cannot reliably enumerate every live session signer");
-      }
-      for (const keyId of keyIds) {
-        if (keyId === this.sessionKeyId) continue;
-        const jwk = this.sessionManager.jwk(keyId);
-        if (!jwk) throw new Error("missing live session key");
-        stagedReplace.call(stagedManager, clonePersistedSessionJwk(JSON.parse(jwk)), keyId);
-      }
       stagedKeyId = stagedReplace.call(stagedManager, restoredJwk, this.sessionKeyId);
-      const stagedJwkJson = stagedManager.jwk(stagedKeyId);
-      if (!stagedJwkJson) throw new Error("missing restored session key");
-      stagedJwk = clonePersistedSessionJwk(JSON.parse(stagedJwkJson));
-      canonicalVerificationMethod = stagedManager.getDID(stagedKeyId);
-    } catch (error) {
-      if (error instanceof UnsupportedSessionRestoreError) throw error;
-      throw new Error("Persisted session has an invalid private Ed25519 session key.");
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid private Ed25519 session key.");
     }
+    const stagedJwkJson = stagedManager.jwk(stagedKeyId);
+    if (!stagedJwkJson) throw new Error("missing restored session key");
+    stagedJwk = clonePersistedSessionJwk(JSON.parse(stagedJwkJson));
+    canonicalVerificationMethod = stagedManager.getDID(stagedKeyId);
     const restoredVerificationMethod = canonicalRestoredVerificationMethod(
       canonicalVerificationMethod,
       sessionData.verificationMethod
     );
     if (!restoredVerificationMethod) {
-      throw new Error(
+      throw new InvalidRestoredSessionError(
         "Persisted session verification method does not match its private Ed25519 session key."
       );
     }
@@ -3861,25 +3871,36 @@ var _TinyCloudNode = class _TinyCloudNode {
     ];
     const hasPersistedProof = proofValues.every((value) => value !== void 0);
     if (!hasPersistedProof && (proofValues.some((value) => value !== void 0) || sessionData.expiresAt !== void 0)) {
-      throw new Error("Persisted session authority metadata is incomplete.");
+      throw new InvalidRestoredSessionError("Persisted session authority metadata is incomplete.");
+    }
+    let restoredAddress;
+    try {
+      restoredAddress = hasPersistedProof ? (0, import_sdk_core8.canonicalizeAddress)(sessionData.address) : void 0;
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid wallet address.");
     }
-    const restoredAddress = hasPersistedProof ? (0, import_sdk_core8.canonicalizeAddress)(sessionData.address) : void 0;
     let stagedSessionExpiry = /* @__PURE__ */ new Date(0);
     let stagedRecap = [];
     if (hasPersistedProof) {
       if (typeof this.wasmBindings.validatePersistedSession !== "function") {
         throw new UnsupportedSessionRestoreError("it cannot verify persisted SIWE authority");
       }
-      const verified = this.wasmBindings.validatePersistedSession({
-        delegationHeader: sessionData.delegationHeader,
-        delegationCid: sessionData.delegationCid,
-        spaceId: sessionData.spaceId,
-        jwk: stagedJwk,
-        address: restoredAddress,
-        chainId: sessionData.chainId,
-        siwe: sessionData.siwe,
-        signature: sessionData.signature
-      });
+      const verified = (() => {
+        try {
+          return this.wasmBindings.validatePersistedSession({
+            delegationHeader: sessionData.delegationHeader,
+            delegationCid: sessionData.delegationCid,
+            spaceId: sessionData.spaceId,
+            jwk: stagedJwk,
+            address: restoredAddress,
+            chainId: sessionData.chainId,
+            siwe: sessionData.siwe,
+            signature: sessionData.signature
+          });
+        } catch (error) {
+          throw new InvalidRestoredSessionError(error instanceof Error ? error.message : String(error));
+        }
+      })();
       const exactRecap = verified.verifiedRecap;
       if (!Array.isArray(exactRecap) || !exactRecap.every(
         (entry) => entry !== null && typeof entry === "object" && typeof entry.service === "string" && typeof entry.space === "string" && typeof entry.path === "string" && Array.isArray(entry.actions) && entry.actions.every((action) => typeof action === "string") && Array.isArray(entry.caveats) && entry.caveats.every(
@@ -3900,7 +3921,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const signedExpiry = verified.expiresAt === void 0 ? void 0 : persistedExpiry(verified.expiresAt);
       const persistedPolicyExpiry = sessionData.expiresAt === void 0 ? void 0 : persistedExpiry(sessionData.expiresAt);
       if (signedExpiry && persistedPolicyExpiry && !sameInstant(signedExpiry, persistedPolicyExpiry)) {
-        throw new Error("Persisted session expiry does not match its signed SIWE authority.");
+        throw new InvalidRestoredSessionError("Persisted session expiry does not match its signed SIWE authority.");
       }
       stagedSessionExpiry = signedExpiry ?? persistedPolicyExpiry ?? persistedExpiry(void 0);
     }
@@ -4093,7 +4114,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const delegations = input.recap.map((entry) => ({
         cid: session.delegationCid,
         delegateDID: session.verificationMethod,
-        spaceId: entry.space,
+        spaceId: this.spaceIdsEqual(entry.space, session.spaceId) ? session.spaceId : entry.space,
         path: entry.path,
         actions: [...entry.actions],
         caveats: cloneRecapCaveats(entry.caveats),
@@ -6863,21 +6884,15 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return granted.spaceId !== void 0 && requested.spaceId !== void 0 && this.spaceIdsEqual(granted.spaceId, requested.spaceId) && this.pathContains(granted.path, requested.path);
   }
-  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. The embedded
-  // EIP-155 address is case-insensitive, but the CLI canonicalizes it to
-  // lowercase when building a space URI while stored runtime delegations keep
-  // the EIP-55 checksummed form — so a byte-for-byte compare spuriously rejects
-  // an otherwise-valid grant. Lowercase ONLY the `eip155:<chain>:0x<addr>`
-  // segment and leave everything else (crucially the case-sensitive space NAME)
-  // byte-exact. Mirrors the CLI's `normalizeSpaceForCompare` (OPENKEY_SCOPE_MISMATCH fix).
+  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. Compare
+  // only the embedded EIP-155 address without case sensitivity; chain, name,
+  // and all non-PKH space identifiers remain byte-exact.
   spaceIdsEqual(a, b) {
     return this.normalizeSpaceAddress(a) === this.normalizeSpaceAddress(b);
   }
   normalizeSpaceAddress(space) {
-    return space.replace(
-      /(eip155:\d+:)(0x[0-9a-fA-F]{40})/,
-      (_match, prefix, addr) => prefix + addr.toLowerCase()
-    );
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
   }
   actionContains(grantedAction, requestedAction) {
     if (grantedAction === requestedAction) {
@@ -7757,6 +7772,7 @@ var import_sdk_core21 = require("@tinycloud/sdk-core");
   DuckDbService,
   FileSessionStorage,
   IdentityParseError,
+  InvalidRestoredSessionError,
   KVService,
   ManifestValidationError,
   MemorySessionStorage,