@tinycloud/node-sdk 3.0.0-beta.19 → 3.0.0-beta.20

package/dist/{core-fgqq1_NV.d.cts → core-DufYfxi-.d.cts}

@@ -1390,6 +1390,8 @@ declare class TinyCloudNode {
      * rather than treating a malformed session as unrestricted authority.
      */
     getVerifiedSessionCapabilities(): PermissionEntry[];
+    /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
+    private projectSignedRecapCapabilities;
     /**
      * Get the Ethereum address for this user.
      */
@@ -1450,9 +1452,9 @@ declare class TinyCloudNode {
      * We must keep the full owner-scoped URI so a synthetic primary grant can
      * never cover an operation on a different owner's space.
      *
-     * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
-     * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
-     * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+     * Only top-level encryption network entries (`space: "encryption"` or
+     * absent) become `resource` ops. A network-shaped path nested under a
+     * data space remains a `spaceId` op, not raw network authority.
      * One op per action.
      *
      * Returns `[]` for session-only / restored-without-siwe modes and for any
@@ -2223,6 +2225,8 @@ declare class TinyCloudNode {
     private isEncryptionPermissionEntry;
     private permissionsToRawAbilities;
     private permissionOperations;
+    /** Raw network authority cannot be covered by a nested encryption space. */
+    private signedCapabilitySubset;
     private sessionCoversPermissionEntries;
     private permissionEntriesToOperations;
     private findRuntimeGrantsForPermissionEntries;

package/dist/{core-fgqq1_NV.d.ts → core-DufYfxi-.d.ts}

@@ -1390,6 +1390,8 @@ declare class TinyCloudNode {
      * rather than treating a malformed session as unrestricted authority.
      */
     getVerifiedSessionCapabilities(): PermissionEntry[];
+    /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
+    private projectSignedRecapCapabilities;
     /**
      * Get the Ethereum address for this user.
      */
@@ -1450,9 +1452,9 @@ declare class TinyCloudNode {
      * We must keep the full owner-scoped URI so a synthetic primary grant can
      * never cover an operation on a different owner's space.
      *
-     * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
-     * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
-     * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+     * Only top-level encryption network entries (`space: "encryption"` or
+     * absent) become `resource` ops. A network-shaped path nested under a
+     * data space remains a `spaceId` op, not raw network authority.
      * One op per action.
      *
      * Returns `[]` for session-only / restored-without-siwe modes and for any
@@ -2223,6 +2225,8 @@ declare class TinyCloudNode {
     private isEncryptionPermissionEntry;
     private permissionsToRawAbilities;
     private permissionOperations;
+    /** Raw network authority cannot be covered by a nested encryption space. */
+    private signedCapabilitySubset;
     private sessionCoversPermissionEntries;
     private permissionEntriesToOperations;
     private findRuntimeGrantsForPermissionEntries;

package/dist/core.cjs

@@ -2933,16 +2933,26 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   getVerifiedSessionCapabilities() {
     const session = this.currentTinyCloudSession();
-    if (!session || !session.siwe) return [];
-    return (0, import_sdk_core8.parseRecapCapabilities)(
-      (siwe) => this.parseRecapWithCaveats(siwe),
-      session.siwe
-    ).map((entry) => entry.service === "tinycloud.encryption" ? {
-      service: entry.service,
-      path: entry.path,
-      actions: [...entry.actions],
-      ...entry.caveats === void 0 ? {} : { caveats: entry.caveats }
-    } : entry);
+    return session?.siwe ? this.projectSignedRecapCapabilities(session.siwe) : [];
+  }
+  /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
+  projectSignedRecapCapabilities(siwe) {
+    const projected = this.parseRecapWithCaveats(siwe).map((entry) => {
+      const normalized = (0, import_sdk_core8.parseRecapCapabilities)(() => [entry], siwe)[0];
+      if (normalized.service !== "tinycloud.encryption") return normalized;
+      if (!this.isEncryptionNetworkOperation("encryption", entry.path, entry.space)) {
+        return { ...normalized, space: entry.space };
+      }
+      return {
+        service: normalized.service,
+        path: normalized.path,
+        actions: normalized.actions,
+        ...normalized.caveats === void 0 ? {} : { caveats: normalized.caveats }
+      };
+    });
+    return projected.sort(
+      (left, right) => (left.space ?? "").localeCompare(right.space ?? "") || left.service.localeCompare(right.service) || left.path.localeCompare(right.path)
+    );
   }
   /**
    * Get the Ethereum address for this user.
@@ -3397,9 +3407,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * We must keep the full owner-scoped URI so a synthetic primary grant can
    * never cover an operation on a different owner's space.
    *
-   * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
-   * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
-   * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+   * Only top-level encryption network entries (`space: "encryption"` or
+   * absent) become `resource` ops. A network-shaped path nested under a
+   * data space remains a `spaceId` op, not raw network authority.
    * One op per action.
    *
    * Returns `[]` for session-only / restored-without-siwe modes and for any
@@ -3420,7 +3430,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         operations = entries.flatMap((entry) => {
           const service = this.invocationServiceName(entry.service);
           return entry.actions.map((action) => ({
-            ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId: entry.space },
+            ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId: entry.space },
             service,
             path: entry.path,
             action,
@@ -4034,7 +4044,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     operations = recap.flatMap((entry) => {
       const service = this.invocationServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId: entry.space },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId: entry.space },
         service,
         path: entry.path,
         action,
@@ -4820,16 +4830,11 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          let permissionHint;
-          if (response.status === 401 || response.status === 403) {
-            try {
-              const body = await response.json();
-              const record = typeof body === "object" && body !== null ? body : void 0;
-              const nested = typeof record?.error === "object" && record.error !== null ? record.error : void 0;
-              permissionHint = (0, import_sdk_services.parsePermissionHint)(record?.permissionHint) ?? (0, import_sdk_services.parsePermissionHint)(nested?.permissionHint);
-            } catch {
-            }
-          }
+          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services.parsePermissionHint)({
+            service: "tinycloud.encryption",
+            path: networkId,
+            actions: ["tinycloud.encryption/decrypt"]
+          }) : void 0;
           throw new import_sdk_core8.DecryptTransportResponseError(response.status, permissionHint);
         }
         return await response.json();
@@ -5764,7 +5769,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           continue;
         }
         let space;
-        if (service !== "tinycloud.encryption") {
+        if (service !== "tinycloud.encryption" || operation.resource === void 0) {
           if (typeof operation.spaceId !== "string") continue;
           try {
             space = this.resolvePermissionSpace(operation.spaceId, session);
@@ -6309,11 +6314,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return { delegation: delegation2, prompted: true };
     }
-    const granted = (0, import_sdk_core8.parseRecapCapabilities)(
-      (siwe) => this.parseRecapWithCaveats(siwe),
-      session.siwe
-    );
-    const { subset, missing } = (0, import_sdk_core8.isCapabilitySubset)(expandedEntries, granted);
+    const granted = this.projectSignedRecapCapabilities(session.siwe);
+    const { subset, missing } = this.signedCapabilitySubset(expandedEntries, granted);
     if (!subset) {
       const runtimeOperations = this.permissionEntriesToOperations(expandedEntries, session);
       const runtimeGrant = this.findGrantForOperations(
@@ -6633,7 +6635,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return abilities;
   }
   isEncryptionPermissionEntry(entry) {
-    return entry.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE && entry.path.startsWith("urn:tinycloud:encryption:");
+    return entry.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE && this.isEncryptionNetworkOperation("encryption", entry.path, entry.space);
   }
   permissionsToRawAbilities(entries) {
     const rawAbilities = {};
@@ -6657,7 +6659,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return entries.flatMap((entry) => {
       const service = this.shortServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId },
         service,
         path: entry.path,
         action,
@@ -6665,13 +6667,21 @@ var _TinyCloudNode = class _TinyCloudNode {
       }));
     });
   }
+  /** Raw network authority cannot be covered by a nested encryption space. */
+  signedCapabilitySubset(requested, granted) {
+    const rawGranted = granted.filter((entry) => this.isEncryptionPermissionEntry(entry)).map((entry) => ({ ...entry, space: "encryption" }));
+    const spaceGranted = granted.filter((entry) => !this.isEncryptionPermissionEntry(entry));
+    const missing = requested.filter((entry) => {
+      const raw = this.isEncryptionPermissionEntry(entry);
+      const comparable = raw ? { ...entry, space: "encryption" } : entry;
+      return !(0, import_sdk_core8.isCapabilitySubset)([comparable], raw ? rawGranted : spaceGranted).subset;
+    });
+    return { subset: missing.length === 0, missing };
+  }
   sessionCoversPermissionEntries(session, entries) {
     try {
-      const granted = (0, import_sdk_core8.parseRecapCapabilities)(
-        (siwe) => this.parseRecapWithCaveats(siwe),
-        session.siwe
-      );
-      return (0, import_sdk_core8.isCapabilitySubset)(entries, granted).subset;
+      const granted = this.projectSignedRecapCapabilities(session.siwe);
+      return this.signedCapabilitySubset(entries, granted).subset;
     } catch {
       return false;
     }
@@ -6681,7 +6691,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const spaceId = this.resolvePermissionSpace(entry.space, session);
       const service = this.shortServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId },
         service,
         path: entry.path,
         action,
@@ -6770,7 +6780,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return resources.flatMap((resource) => {
       const service = this.invocationServiceName(resource.service);
       return resource.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, resource.path) ? { resource: resource.path } : { spaceId: resource.space },
+        ...this.isEncryptionNetworkOperation(service, resource.path, resource.space) ? { resource: resource.path } : { spaceId: resource.space },
         service,
         path: resource.path,
         action,
@@ -6831,7 +6841,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     for (const resource of resources) {
       const service = this.invocationServiceName(resource.service);
-      if (this.isEncryptionNetworkOperation(service, resource.path)) {
+      if (this.isEncryptionNetworkOperation(service, resource.path, resource.space)) {
         rawAbilities[_a = resource.path] ?? (rawAbilities[_a] = []);
         addActions(rawAbilities[resource.path], resource.actions);
         continue;
@@ -6928,8 +6938,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const verified = this.wasmBindings.parseVerifiedRecapFromSiwe?.(siwe);
     return verified == null ? this.wasmBindings.parseRecapFromSiwe(siwe) : verifierRecapEntries(verified);
   }
-  isEncryptionNetworkOperation(service, path) {
-    return service === "encryption" && path.startsWith("urn:tinycloud:encryption:");
+  isEncryptionNetworkOperation(service, path, space) {
+    return service === "encryption" && (space === void 0 || space === "encryption") && path.startsWith("urn:tinycloud:encryption:");
   }
   operationFromInvokeAnyEntry(entry) {
     const service = this.invocationServiceName(entry.service);
@@ -6942,7 +6952,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...entry.caveats === void 0 ? {} : { caveats: cloneRecapCaveats(entry.caveats) }
       };
     }
-    if (this.isEncryptionNetworkOperation(service, entry.path)) {
+    if (entry.spaceId === void 0 && this.isEncryptionNetworkOperation(service, entry.path)) {
       return {
         resource: entry.path,
         service,