@tinycloud/node-sdk 3.11.0-beta.0 → 3.11.0-beta.1

package/dist/{TinyCloudNode-BpolXzu5.d.ts → TinyCloudNode-BlNcvo1c.d.ts}

@@ -655,6 +655,13 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private guardSpaceCreation;
     private recordActivationSkippedSpaces;
     createBootstrapSession(options: CreateBootstrapSessionOptions): Promise<TinyCloudSession>;
+    /**
+     * When a session that starts at `now` ends. Refused with a dated message when
+     * the configured lifetime reaches past what a sign-in message can carry,
+     * instead of the bare `RangeError` or WASM parse error `toISOString()` and
+     * `prepareSession` would otherwise give.
+     */
+    private sessionExpiryFrom;
     private persistedData;
     /**
      * Sign in and create a new session.

package/dist/{TinyCloudNode-wAQN1Ndh.d.cts → TinyCloudNode-CnVaWnAX.d.cts}

@@ -655,6 +655,13 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private guardSpaceCreation;
     private recordActivationSkippedSpaces;
     createBootstrapSession(options: CreateBootstrapSessionOptions): Promise<TinyCloudSession>;
+    /**
+     * When a session that starts at `now` ends. Refused with a dated message when
+     * the configured lifetime reaches past what a sign-in message can carry,
+     * instead of the bare `RangeError` or WASM parse error `toISOString()` and
+     * `prepareSession` would otherwise give.
+     */
+    private sessionExpiryFrom;
     private persistedData;
     /**
      * Sign in and create a new session.

package/dist/{authority-C0JKqTwY.d.cts → authority-B2SLx27M.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-wAQN1Ndh.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-CnVaWnAX.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/{authority-Cj8MLCkr.d.ts → authority-DHIk5QvV.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-BpolXzu5.js';
+import { T as TinyCloudNode } from './TinyCloudNode-BlNcvo1c.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/core.cjs

@@ -1437,7 +1437,7 @@ var NodeUserAuthorization = class {
     }
     const jwk = JSON.parse(jwkString);
     const now = /* @__PURE__ */ new Date();
-    const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
+    const expirationTime = this.sessionExpiryFrom(now);
     const primaryIdentity = pkhSpaceIdentity(options.spaceId);
     const resourcesBySpace = /* @__PURE__ */ new Map();
     for (const resource of options.capabilityRequest.resources) {
@@ -1492,6 +1492,17 @@ var NodeUserAuthorization = class {
       signature
     };
   }
+  /**
+   * When a session that starts at `now` ends. Refused with a dated message when
+   * the configured lifetime reaches past what a sign-in message can carry,
+   * instead of the bare `RangeError` or WASM parse error `toISOString()` and
+   * `prepareSession` would otherwise give.
+   */
+  sessionExpiryFrom(now) {
+    const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
+    (0, import_sdk_core5.assertExpiryWithinTechnicalLimit)(expirationTime, "siwe");
+    return expirationTime;
+  }
   persistedData(session, expiresAt, createdAt, replicaStamp) {
     return {
       address: session.address,
@@ -1547,7 +1558,7 @@ var NodeUserAuthorization = class {
     const capabilityPlan = this.resolveSignInCapabilities(address, chainId);
     const spaceId = capabilityPlan.spaceId;
     const now = /* @__PURE__ */ new Date();
-    const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
+    const expirationTime = this.sessionExpiryFrom(now);
     const prepared = this.prepareSessionWithResources({
       abilities: capabilityPlan.abilities,
       ...capabilityPlan.spaceAbilities !== void 0 ? { spaceAbilities: capabilityPlan.spaceAbilities } : {},
@@ -1693,7 +1704,7 @@ var NodeUserAuthorization = class {
     const capabilityPlan = this.resolveSignInCapabilities(address, chainId);
     const spaceId = capabilityPlan.spaceId;
     const now = /* @__PURE__ */ new Date();
-    const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
+    const expirationTime = this.sessionExpiryFrom(now);
     const prepared = this.prepareSessionWithResources({
       abilities: capabilityPlan.abilities,
       ...capabilityPlan.spaceAbilities !== void 0 ? { spaceAbilities: capabilityPlan.spaceAbilities } : {},
@@ -1756,7 +1767,7 @@ var NodeUserAuthorization = class {
       siwe: prepared.siwe,
       signature
     };
-    const expiresAt = lastAnchoredLine(prepared.siwe ?? "", /^Expiration Time: (.+)$/gm) ?? new Date(Date.now() + this.sessionExpirationMs).toISOString();
+    const expiresAt = lastAnchoredLine(prepared.siwe ?? "", /^Expiration Time: (.+)$/gm) ?? this.sessionExpiryFrom(/* @__PURE__ */ new Date()).toISOString();
     const createdAt = lastAnchoredLine(prepared.siwe ?? "", /^Issued At: (.+)$/gm) ?? (/* @__PURE__ */ new Date()).toISOString();
     const replicaStamp = await this.establishReplicaStamp?.(tinyCloudSession);
     const persistedData = this.persistedData(tinyCloudSession, expiresAt, createdAt, replicaStamp);
@@ -7730,6 +7741,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       // DID here and rejects the fragment as an invalid audience DID.
       verificationMethod: params.session.verificationMethod.split("#", 1)[0]
     };
+    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(params.expirationSecs * 1e3, "ucan");
     const result = this.wasmBindings.createDelegation(
       wasmSession,
       params.delegateDID,
@@ -7762,9 +7774,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const permissions = ownerDelegationPermissions(params);
     const now = /* @__PURE__ */ new Date();
-    if (!(params.expiresAt instanceof Date) || params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > import_sdk_core11.EXPIRY.MAX_MS) {
-      throw new Error("Owner delegation expiry must be explicit, future, and within EXPIRY.MAX_MS");
+    if (!(params.expiresAt instanceof Date) || params.expiresAt.getTime() <= now.getTime()) {
+      throw new Error("Owner delegation expiry must be explicit, future, and a valid date");
     }
+    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(params.expiresAt, "siwe");
     if (!this.signer) throw new Error("Owner wallet signer is required");
     const session = this.currentTinyCloudSession();
     if (!session) throw new Error("Owner session is required");
@@ -7865,6 +7878,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * not sent.
    */
   async authorizeShareDeliveryV3(input) {
+    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(new Date(input.expiresAt), "siwe");
     const envelopeRef = await (0, import_sdk_core11.shortDeliveryLinkBodyCid)(input.shareUrl, input.trustedOrigins);
     const session = this.currentTinyCloudSession();
     const serviceSession = this._serviceContext?.session;
@@ -7917,6 +7931,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
   }
   async createRootDelegationForSharing(params, assertActive) {
+    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(params.requestedExpiry, "siwe");
     try {
       return (await this.createOwnerDelegation({
         delegateDid: params.shareKeyDID,
@@ -8613,6 +8628,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (sessionExpiry !== void 0 && sessionExpiry < expiresAt) {
       expiresAt = sessionExpiry;
     }
+    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(expiresAt, "siwe");
     const delegations = [];
     let rawEntriesAttached = false;
     for (const [spaceId, entries] of bySpace) {
@@ -10085,6 +10101,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const now = /* @__PURE__ */ new Date();
     const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
     const expirationTime = new Date(now.getTime() + expiryMs);
+    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(expirationTime, "siwe");
     const prepared = this.wasmBindings.prepareSession({
       abilities,
       address: this.wasmBindings.ensureEip55(session.address),
@@ -10239,6 +10256,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const { abilities, rawAbilities } = this.buildActivationAbilities(delegation);
     const now = /* @__PURE__ */ new Date();
     const expirationTime = delegation.expiry;
+    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(expirationTime, "siwe");
     const prepared = this.wasmBindings.prepareSession({
       abilities,
       address: this.wasmBindings.ensureEip55(mySession.address),
@@ -10358,6 +10376,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const now = /* @__PURE__ */ new Date();
     const requestedExpiry = params.expiryMs === void 0 ? parentDelegation.expiry : new Date(now.getTime() + params.expiryMs);
     const actualExpiry = requestedExpiry > parentDelegation.expiry ? parentDelegation.expiry : requestedExpiry;
+    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(actualExpiry, "siwe");
     const abilities = {};
     const rawAbilities = {};
     for (const resource of requestedResources) {