@tinycloud/node-sdk 3.3.0-beta.15 → 3.3.0-beta.16

package/dist/{TinyCloudNode-CcNh20QX.d.cts → TinyCloudNode-DmF9QUcS.d.cts}

@@ -1287,7 +1287,8 @@ interface DelegateToOptions {
      * Mark the delegation terminal: the node refuses any delegation that cites
      * it as a parent (`terminal-parent-cannot-redelegate`). The delegate can
      * still use it directly. Only session-key UCAN delegations can carry the
-     * marker, so this throws with `forceWalletSign`. Default false.
+     * marker, so this throws with `forceWalletSign`, and with a `did:pkh`
+     * recipient (use its session-key DID). Default false.
      */
     disableSubDelegation?: boolean;
 }
@@ -2746,7 +2747,9 @@ declare class TinyCloudNode {
          * Prevent the recipient from creating sub-delegations (default: false).
          * The delegation carries the node's terminal marker, so the node refuses
          * its children. Needs capabilities the current session holds; throws
-         * rather than fall back to a wallet-signed delegation.
+         * rather than fall back to a wallet-signed delegation, and throws for a
+         * `did:pkh` recipient (a wallet-mode `useDelegation` of it is refused);
+         * grant the recipient's session-key DID instead.
          */
         disableSubDelegation?: boolean;
         /** Expiration time in milliseconds from now (default: 1 hour) */

package/dist/{TinyCloudNode-CcNh20QX.d.ts → TinyCloudNode-DmF9QUcS.d.ts}

@@ -1287,7 +1287,8 @@ interface DelegateToOptions {
      * Mark the delegation terminal: the node refuses any delegation that cites
      * it as a parent (`terminal-parent-cannot-redelegate`). The delegate can
      * still use it directly. Only session-key UCAN delegations can carry the
-     * marker, so this throws with `forceWalletSign`. Default false.
+     * marker, so this throws with `forceWalletSign`, and with a `did:pkh`
+     * recipient (use its session-key DID). Default false.
      */
     disableSubDelegation?: boolean;
 }
@@ -2746,7 +2747,9 @@ declare class TinyCloudNode {
          * Prevent the recipient from creating sub-delegations (default: false).
          * The delegation carries the node's terminal marker, so the node refuses
          * its children. Needs capabilities the current session holds; throws
-         * rather than fall back to a wallet-signed delegation.
+         * rather than fall back to a wallet-signed delegation, and throws for a
+         * `did:pkh` recipient (a wallet-mode `useDelegation` of it is refused);
+         * grant the recipient's session-key DID instead.
          */
         disableSubDelegation?: boolean;
         /** Expiration time in milliseconds from now (default: 1 hour) */

package/dist/{authority-D_u9a7Wl.d.ts → authority-BY0jd0P3.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-CcNh20QX.js';
+import { T as TinyCloudNode } from './TinyCloudNode-DmF9QUcS.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/{authority-Cwotwza3.d.cts → authority-Cy5tMflt.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-CcNh20QX.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-DmF9QUcS.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/core.cjs

@@ -3347,7 +3347,7 @@ function ownerPermissionsToAbilities(permissions) {
   }
   return { abilities, rawAbilities };
 }
-var TERMINAL_DELEGATION_REQUIRES_SESSION_KEY = "disableSubDelegation requires a session-key delegation";
+var TERMINAL_DELEGATION_REQUIRES_SESSION_KEY = "disableSubDelegation requires a session-key delegation to a did:key (not did:pkh); use the session-key DID or drop the flag";
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
@@ -8182,6 +8182,9 @@ var _TinyCloudNode = class _TinyCloudNode {
         "delegateTo: onPrepared cannot be combined with forceWalletSign=true; the wallet-signed path activates the delegation before it could be handed to onPrepared."
       );
     }
+    if (options?.disableSubDelegation && did.startsWith("did:pkh:")) {
+      throw new Error(TERMINAL_DELEGATION_REQUIRES_SESSION_KEY);
+    }
     const session = this.currentTinyCloudSession();
     if (!session) {
       throw new import_sdk_core10.SessionExpiredError(/* @__PURE__ */ new Date(0));