@tinycloud/node-sdk 3.0.0-beta.13 → 3.0.0-beta.14

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, CapabilityPresentationEnvelopeV1, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, ParsedNetworkId, ParsedSecretCatalogKey, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, l as RuntimeDelegationActivator, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, v as activateValidatedRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, z as grantAuthRequest, G as serializeDelegation } from './core-DWFGaDwP.cjs';
+export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, l as RuntimeDelegationActivator, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, v as activateValidatedRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, z as grantAuthRequest, G as serializeDelegation } from './core-D4IVgDr5.cjs';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import 'events';
 import '@tinycloud/sdk-services';
@@ -133,6 +133,28 @@ type NodeUserAuthorizationAuthorizeFn = (input: OpenKeyBridgeInput) => Promise<{
  */
 declare function wireOpenKeyAuthorize(openkey: OpenKeyAuthorizeTinyCloud): NodeUserAuthorizationAuthorizeFn;
 
+/**
+ * Internal helpers for TinyCloudNode.delegateTo and the legacy
+ * createDelegation compatibility shim. Exported from their own module so
+ * they are easy to unit-test without spinning up a full TinyCloudNode.
+ *
+ * None of these are part of the public API — the module path is not
+ * re-exported from `@tinycloud/node-sdk` or `@tinycloud/node-sdk/core`.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Extract the `expirationTime` field of a signed SIWE message as a `Date`.
+ *
+ * Returns `undefined` only when the SIWE genuinely has no `Expiration Time`
+ * line (RFC-4501 permits it). Propagates parse errors — the SDK always
+ * produces signed SIWEs during sign-in, so an unparseable `session.siwe`
+ * means something is actively wrong and we do not want to silently skip
+ * the expiry check.
+ */
+declare function extractSiweExpiration(siwe: string): Date | undefined;
+
 /**
  * NodeWasmBindings - Default IWasmBindings implementation for Node.js.
  *
@@ -175,4 +197,4 @@ declare class NodeWasmBindings implements IWasmBindings {
     createSessionManager(): ISessionManager;
 }
 
-export { type NodeUserAuthorizationAuthorizeFn, NodeWasmBindings, type OpenKeyAuthorizeTinyCloud, type OpenKeyBridgeInput, PrivateKeySigner, wireOpenKeyAuthorize };
+export { type NodeUserAuthorizationAuthorizeFn, NodeWasmBindings, type OpenKeyAuthorizeTinyCloud, type OpenKeyBridgeInput, PrivateKeySigner, extractSiweExpiration, wireOpenKeyAuthorize };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, CapabilityPresentationEnvelopeV1, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, ParsedNetworkId, ParsedSecretCatalogKey, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, l as RuntimeDelegationActivator, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, v as activateValidatedRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, z as grantAuthRequest, G as serializeDelegation } from './core-DWFGaDwP.js';
+export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, l as RuntimeDelegationActivator, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, v as activateValidatedRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, z as grantAuthRequest, G as serializeDelegation } from './core-D4IVgDr5.js';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import 'events';
 import '@tinycloud/sdk-services';
@@ -133,6 +133,28 @@ type NodeUserAuthorizationAuthorizeFn = (input: OpenKeyBridgeInput) => Promise<{
  */
 declare function wireOpenKeyAuthorize(openkey: OpenKeyAuthorizeTinyCloud): NodeUserAuthorizationAuthorizeFn;
 
+/**
+ * Internal helpers for TinyCloudNode.delegateTo and the legacy
+ * createDelegation compatibility shim. Exported from their own module so
+ * they are easy to unit-test without spinning up a full TinyCloudNode.
+ *
+ * None of these are part of the public API — the module path is not
+ * re-exported from `@tinycloud/node-sdk` or `@tinycloud/node-sdk/core`.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Extract the `expirationTime` field of a signed SIWE message as a `Date`.
+ *
+ * Returns `undefined` only when the SIWE genuinely has no `Expiration Time`
+ * line (RFC-4501 permits it). Propagates parse errors — the SDK always
+ * produces signed SIWEs during sign-in, so an unparseable `session.siwe`
+ * means something is actively wrong and we do not want to silently skip
+ * the expiry check.
+ */
+declare function extractSiweExpiration(siwe: string): Date | undefined;
+
 /**
  * NodeWasmBindings - Default IWasmBindings implementation for Node.js.
  *
@@ -175,4 +197,4 @@ declare class NodeWasmBindings implements IWasmBindings {
     createSessionManager(): ISessionManager;
 }
 
-export { type NodeUserAuthorizationAuthorizeFn, NodeWasmBindings, type OpenKeyAuthorizeTinyCloud, type OpenKeyBridgeInput, PrivateKeySigner, wireOpenKeyAuthorize };
+export { type NodeUserAuthorizationAuthorizeFn, NodeWasmBindings, type OpenKeyAuthorizeTinyCloud, type OpenKeyBridgeInput, PrivateKeySigner, extractSiweExpiration, wireOpenKeyAuthorize };

package/dist/index.js

@@ -19371,18 +19371,23 @@ var UnsupportedSessionRestoreError = class extends Error {
     this.name = "UnsupportedSessionRestoreError";
   }
 };
+var InvalidRestoredSessionError = class extends Error {
+  constructor(message = "Persisted session authority is invalid or expired.") {
+    super(message);
+    this.code = "AUTH_EXPIRED";
+    this.name = "InvalidRestoredSessionError";
+  }
+};
 function canonicalRestoredVerificationMethod(canonicalVerificationMethod, persistedVerificationMethod) {
   if (typeof persistedVerificationMethod !== "string") return void 0;
   const principal = canonicalVerificationMethod.split("#", 1)[0];
   return persistedVerificationMethod === principal || persistedVerificationMethod === canonicalVerificationMethod ? canonicalVerificationMethod : void 0;
 }
 function persistedExpiry(value) {
-  if (typeof value !== "string") {
-    throw new Error("Persisted session without a SIWE expiration must include expiresAt.");
-  }
+  if (typeof value !== "string") throw new InvalidRestoredSessionError("Persisted session must include expiresAt.");
   const expiry = new Date(value);
   if (!Number.isFinite(expiry.getTime()) || expiry.getTime() <= Date.now()) {
-    throw new Error("Persisted session expiry is invalid or expired.");
+    throw new InvalidRestoredSessionError();
   }
   return expiry;
 }
@@ -20574,7 +20579,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return;
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        if (/Unauthorized Action|\b401\b/.test(message)) {
+        if (/Unauthorized Action|\b(?:401|403)\b/.test(message)) {
           console.warn(
             "TinyCloud account registry sync stopped: authorization verdict is not retryable",
             error
@@ -20824,9 +20829,14 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   async restoreSession(sessionData) {
     await this.wasmBindings.ensureInitialized?.();
-    const restoredJwk = clonePersistedSessionJwk(sessionData.jwk);
+    let restoredJwk;
+    try {
+      restoredJwk = clonePersistedSessionJwk(sessionData.jwk);
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid private Ed25519 session key.");
+    }
     if (sessionData.chainId !== void 0 && (!Number.isSafeInteger(sessionData.chainId) || sessionData.chainId <= 0)) {
-      throw new Error("Persisted session chain ID must be a positive safe integer.");
+      throw new InvalidRestoredSessionError("Persisted session chain ID must be a positive safe integer.");
     }
     const stagedManager = this.wasmBindings.createSessionManager();
     const stagedReplace = stagedManager.replaceSessionKey;
@@ -20838,32 +20848,31 @@ var _TinyCloudNode = class _TinyCloudNode {
     let stagedKeyId;
     let stagedJwk;
     let canonicalVerificationMethod;
+    const keyIds = liveKeys.call(this.sessionManager);
+    if (!Array.isArray(keyIds) || !keyIds.every((keyId) => typeof keyId === "string")) {
+      throw new UnsupportedSessionRestoreError("it cannot reliably enumerate every live session signer");
+    }
+    for (const keyId of keyIds) {
+      if (keyId === this.sessionKeyId) continue;
+      const jwk = this.sessionManager.jwk(keyId);
+      if (!jwk) throw new Error("missing live session key");
+      stagedReplace.call(stagedManager, clonePersistedSessionJwk(JSON.parse(jwk)), keyId);
+    }
     try {
-      const keyIds = liveKeys.call(this.sessionManager);
-      if (!Array.isArray(keyIds) || !keyIds.every((keyId) => typeof keyId === "string")) {
-        throw new UnsupportedSessionRestoreError("it cannot reliably enumerate every live session signer");
-      }
-      for (const keyId of keyIds) {
-        if (keyId === this.sessionKeyId) continue;
-        const jwk = this.sessionManager.jwk(keyId);
-        if (!jwk) throw new Error("missing live session key");
-        stagedReplace.call(stagedManager, clonePersistedSessionJwk(JSON.parse(jwk)), keyId);
-      }
       stagedKeyId = stagedReplace.call(stagedManager, restoredJwk, this.sessionKeyId);
-      const stagedJwkJson = stagedManager.jwk(stagedKeyId);
-      if (!stagedJwkJson) throw new Error("missing restored session key");
-      stagedJwk = clonePersistedSessionJwk(JSON.parse(stagedJwkJson));
-      canonicalVerificationMethod = stagedManager.getDID(stagedKeyId);
-    } catch (error) {
-      if (error instanceof UnsupportedSessionRestoreError) throw error;
-      throw new Error("Persisted session has an invalid private Ed25519 session key.");
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid private Ed25519 session key.");
     }
+    const stagedJwkJson = stagedManager.jwk(stagedKeyId);
+    if (!stagedJwkJson) throw new Error("missing restored session key");
+    stagedJwk = clonePersistedSessionJwk(JSON.parse(stagedJwkJson));
+    canonicalVerificationMethod = stagedManager.getDID(stagedKeyId);
     const restoredVerificationMethod = canonicalRestoredVerificationMethod(
       canonicalVerificationMethod,
       sessionData.verificationMethod
     );
     if (!restoredVerificationMethod) {
-      throw new Error(
+      throw new InvalidRestoredSessionError(
         "Persisted session verification method does not match its private Ed25519 session key."
       );
     }
@@ -20875,25 +20884,36 @@ var _TinyCloudNode = class _TinyCloudNode {
     ];
     const hasPersistedProof = proofValues.every((value) => value !== void 0);
     if (!hasPersistedProof && (proofValues.some((value) => value !== void 0) || sessionData.expiresAt !== void 0)) {
-      throw new Error("Persisted session authority metadata is incomplete.");
+      throw new InvalidRestoredSessionError("Persisted session authority metadata is incomplete.");
+    }
+    let restoredAddress;
+    try {
+      restoredAddress = hasPersistedProof ? canonicalizeAddress2(sessionData.address) : void 0;
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid wallet address.");
     }
-    const restoredAddress = hasPersistedProof ? canonicalizeAddress2(sessionData.address) : void 0;
     let stagedSessionExpiry = /* @__PURE__ */ new Date(0);
     let stagedRecap = [];
     if (hasPersistedProof) {
       if (typeof this.wasmBindings.validatePersistedSession !== "function") {
         throw new UnsupportedSessionRestoreError("it cannot verify persisted SIWE authority");
       }
-      const verified = this.wasmBindings.validatePersistedSession({
-        delegationHeader: sessionData.delegationHeader,
-        delegationCid: sessionData.delegationCid,
-        spaceId: sessionData.spaceId,
-        jwk: stagedJwk,
-        address: restoredAddress,
-        chainId: sessionData.chainId,
-        siwe: sessionData.siwe,
-        signature: sessionData.signature
-      });
+      const verified = (() => {
+        try {
+          return this.wasmBindings.validatePersistedSession({
+            delegationHeader: sessionData.delegationHeader,
+            delegationCid: sessionData.delegationCid,
+            spaceId: sessionData.spaceId,
+            jwk: stagedJwk,
+            address: restoredAddress,
+            chainId: sessionData.chainId,
+            siwe: sessionData.siwe,
+            signature: sessionData.signature
+          });
+        } catch (error) {
+          throw new InvalidRestoredSessionError(error instanceof Error ? error.message : String(error));
+        }
+      })();
       const exactRecap = verified.verifiedRecap;
       if (!Array.isArray(exactRecap) || !exactRecap.every(
         (entry) => entry !== null && typeof entry === "object" && typeof entry.service === "string" && typeof entry.space === "string" && typeof entry.path === "string" && Array.isArray(entry.actions) && entry.actions.every((action) => typeof action === "string") && Array.isArray(entry.caveats) && entry.caveats.every(
@@ -20914,7 +20934,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const signedExpiry = verified.expiresAt === void 0 ? void 0 : persistedExpiry(verified.expiresAt);
       const persistedPolicyExpiry = sessionData.expiresAt === void 0 ? void 0 : persistedExpiry(sessionData.expiresAt);
       if (signedExpiry && persistedPolicyExpiry && !sameInstant(signedExpiry, persistedPolicyExpiry)) {
-        throw new Error("Persisted session expiry does not match its signed SIWE authority.");
+        throw new InvalidRestoredSessionError("Persisted session expiry does not match its signed SIWE authority.");
       }
       stagedSessionExpiry = signedExpiry ?? persistedPolicyExpiry ?? persistedExpiry(void 0);
     }
@@ -21107,7 +21127,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const delegations = input.recap.map((entry) => ({
         cid: session.delegationCid,
         delegateDID: session.verificationMethod,
-        spaceId: entry.space,
+        spaceId: this.spaceIdsEqual(entry.space, session.spaceId) ? session.spaceId : entry.space,
         path: entry.path,
         actions: [...entry.actions],
         caveats: cloneRecapCaveats(entry.caveats),
@@ -23877,21 +23897,15 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return granted.spaceId !== void 0 && requested.spaceId !== void 0 && this.spaceIdsEqual(granted.spaceId, requested.spaceId) && this.pathContains(granted.path, requested.path);
   }
-  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. The embedded
-  // EIP-155 address is case-insensitive, but the CLI canonicalizes it to
-  // lowercase when building a space URI while stored runtime delegations keep
-  // the EIP-55 checksummed form — so a byte-for-byte compare spuriously rejects
-  // an otherwise-valid grant. Lowercase ONLY the `eip155:<chain>:0x<addr>`
-  // segment and leave everything else (crucially the case-sensitive space NAME)
-  // byte-exact. Mirrors the CLI's `normalizeSpaceForCompare` (OPENKEY_SCOPE_MISMATCH fix).
+  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. Compare
+  // only the embedded EIP-155 address without case sensitivity; chain, name,
+  // and all non-PKH space identifiers remain byte-exact.
   spaceIdsEqual(a, b) {
     return this.normalizeSpaceAddress(a) === this.normalizeSpaceAddress(b);
   }
   normalizeSpaceAddress(space) {
-    return space.replace(
-      /(eip155:\d+:)(0x[0-9a-fA-F]{40})/,
-      (_match, prefix, addr) => prefix + addr.toLowerCase()
-    );
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
   }
   actionContains(grantedAction, requestedAction) {
     if (grantedAction === requestedAction) {
@@ -25120,6 +25134,7 @@ export {
   FileSessionStorage,
   HooksService3 as HooksService,
   IdentityParseError,
+  InvalidRestoredSessionError,
   KVService3 as KVService,
   ManifestValidationError,
   MemorySessionStorage,
@@ -25199,6 +25214,7 @@ export {
   expandActionShortNames,
   expandPermissionEntries2 as expandPermissionEntries,
   expandPermissionEntry,
+  extractSiweExpiration,
   generateRandomReceiverKey,
   getTinyCloudDebugLogs,
   grantAuthRequest,