@tinycloud/node-sdk 3.11.0-beta.0 → 3.11.0-beta.1

package/dist/encryption-keys.d.cts

@@ -1,6 +1,6 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-wAQN1Ndh.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-CnVaWnAX.cjs';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';

package/dist/encryption-keys.d.ts

@@ -1,6 +1,6 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-BpolXzu5.js';
+import { T as TinyCloudNode } from './TinyCloudNode-BlNcvo1c.js';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';

package/dist/index.cjs

@@ -19952,7 +19952,7 @@ var NodeUserAuthorization = class {
     }
     const jwk = JSON.parse(jwkString);
     const now = /* @__PURE__ */ new Date();
-    const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
+    const expirationTime = this.sessionExpiryFrom(now);
     const primaryIdentity = pkhSpaceIdentity(options.spaceId);
     const resourcesBySpace = /* @__PURE__ */ new Map();
     for (const resource of options.capabilityRequest.resources) {
@@ -20007,6 +20007,17 @@ var NodeUserAuthorization = class {
       signature: signature2
     };
   }
+  /**
+   * When a session that starts at `now` ends. Refused with a dated message when
+   * the configured lifetime reaches past what a sign-in message can carry,
+   * instead of the bare `RangeError` or WASM parse error `toISOString()` and
+   * `prepareSession` would otherwise give.
+   */
+  sessionExpiryFrom(now) {
+    const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
+    (0, import_sdk_core5.assertExpiryWithinTechnicalLimit)(expirationTime, "siwe");
+    return expirationTime;
+  }
   persistedData(session, expiresAt, createdAt, replicaStamp) {
     return {
       address: session.address,
@@ -20062,7 +20073,7 @@ var NodeUserAuthorization = class {
     const capabilityPlan = this.resolveSignInCapabilities(address, chainId);
     const spaceId = capabilityPlan.spaceId;
     const now = /* @__PURE__ */ new Date();
-    const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
+    const expirationTime = this.sessionExpiryFrom(now);
     const prepared = this.prepareSessionWithResources({
       abilities: capabilityPlan.abilities,
       ...capabilityPlan.spaceAbilities !== void 0 ? { spaceAbilities: capabilityPlan.spaceAbilities } : {},
@@ -20208,7 +20219,7 @@ var NodeUserAuthorization = class {
     const capabilityPlan = this.resolveSignInCapabilities(address, chainId);
     const spaceId = capabilityPlan.spaceId;
     const now = /* @__PURE__ */ new Date();
-    const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
+    const expirationTime = this.sessionExpiryFrom(now);
     const prepared = this.prepareSessionWithResources({
       abilities: capabilityPlan.abilities,
       ...capabilityPlan.spaceAbilities !== void 0 ? { spaceAbilities: capabilityPlan.spaceAbilities } : {},
@@ -20271,7 +20282,7 @@ var NodeUserAuthorization = class {
       siwe: prepared.siwe,
       signature: signature2
     };
-    const expiresAt = lastAnchoredLine(prepared.siwe ?? "", /^Expiration Time: (.+)$/gm) ?? new Date(Date.now() + this.sessionExpirationMs).toISOString();
+    const expiresAt = lastAnchoredLine(prepared.siwe ?? "", /^Expiration Time: (.+)$/gm) ?? this.sessionExpiryFrom(/* @__PURE__ */ new Date()).toISOString();
     const createdAt = lastAnchoredLine(prepared.siwe ?? "", /^Issued At: (.+)$/gm) ?? (/* @__PURE__ */ new Date()).toISOString();
     const replicaStamp = await this.establishReplicaStamp?.(tinyCloudSession);
     const persistedData = this.persistedData(tinyCloudSession, expiresAt, createdAt, replicaStamp);
@@ -25552,6 +25563,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       // DID here and rejects the fragment as an invalid audience DID.
       verificationMethod: params.session.verificationMethod.split("#", 1)[0]
     };
+    (0, import_sdk_core10.assertExpiryWithinTechnicalLimit)(params.expirationSecs * 1e3, "ucan");
     const result = this.wasmBindings.createDelegation(
       wasmSession,
       params.delegateDID,
@@ -25584,9 +25596,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const permissions = ownerDelegationPermissions(params);
     const now = /* @__PURE__ */ new Date();
-    if (!(params.expiresAt instanceof Date) || params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > import_sdk_core10.EXPIRY.MAX_MS) {
-      throw new Error("Owner delegation expiry must be explicit, future, and within EXPIRY.MAX_MS");
+    if (!(params.expiresAt instanceof Date) || params.expiresAt.getTime() <= now.getTime()) {
+      throw new Error("Owner delegation expiry must be explicit, future, and a valid date");
     }
+    (0, import_sdk_core10.assertExpiryWithinTechnicalLimit)(params.expiresAt, "siwe");
     if (!this.signer) throw new Error("Owner wallet signer is required");
     const session = this.currentTinyCloudSession();
     if (!session) throw new Error("Owner session is required");
@@ -25687,6 +25700,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * not sent.
    */
   async authorizeShareDeliveryV3(input) {
+    (0, import_sdk_core10.assertExpiryWithinTechnicalLimit)(new Date(input.expiresAt), "siwe");
     const envelopeRef = await (0, import_sdk_core10.shortDeliveryLinkBodyCid)(input.shareUrl, input.trustedOrigins);
     const session = this.currentTinyCloudSession();
     const serviceSession = this._serviceContext?.session;
@@ -25739,6 +25753,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
   }
   async createRootDelegationForSharing(params, assertActive) {
+    (0, import_sdk_core10.assertExpiryWithinTechnicalLimit)(params.requestedExpiry, "siwe");
     try {
       return (await this.createOwnerDelegation({
         delegateDid: params.shareKeyDID,
@@ -26435,6 +26450,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (sessionExpiry !== void 0 && sessionExpiry < expiresAt) {
       expiresAt = sessionExpiry;
     }
+    (0, import_sdk_core10.assertExpiryWithinTechnicalLimit)(expiresAt, "siwe");
     const delegations = [];
     let rawEntriesAttached = false;
     for (const [spaceId, entries] of bySpace) {
@@ -27907,6 +27923,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const now = /* @__PURE__ */ new Date();
     const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
     const expirationTime = new Date(now.getTime() + expiryMs);
+    (0, import_sdk_core10.assertExpiryWithinTechnicalLimit)(expirationTime, "siwe");
     const prepared = this.wasmBindings.prepareSession({
       abilities,
       address: this.wasmBindings.ensureEip55(session.address),
@@ -28061,6 +28078,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const { abilities, rawAbilities } = this.buildActivationAbilities(delegation);
     const now = /* @__PURE__ */ new Date();
     const expirationTime = delegation.expiry;
+    (0, import_sdk_core10.assertExpiryWithinTechnicalLimit)(expirationTime, "siwe");
     const prepared = this.wasmBindings.prepareSession({
       abilities,
       address: this.wasmBindings.ensureEip55(mySession.address),
@@ -28180,6 +28198,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const now = /* @__PURE__ */ new Date();
     const requestedExpiry = params.expiryMs === void 0 ? parentDelegation.expiry : new Date(now.getTime() + params.expiryMs);
     const actualExpiry = requestedExpiry > parentDelegation.expiry ? parentDelegation.expiry : requestedExpiry;
+    (0, import_sdk_core10.assertExpiryWithinTechnicalLimit)(actualExpiry, "siwe");
     const abilities = {};
     const rawAbilities = {};
     for (const resource of requestedResources) {