@tinycloud/node-sdk 3.6.0-beta.4 → 3.6.0-beta.6

package/dist/index.js

@@ -17430,7 +17430,7 @@ __export(authority_exports, {
 });
 import { SiweMessage as SiweMessage4 } from "siwe";
 import {
-  actionContains as actionContains2,
+  actionContains,
   KV as KV4,
   canonicalizeRecapCaveats as canonicalizeRecapCaveats3,
   isCapabilitySubset as isCapabilitySubset3,
@@ -17546,7 +17546,7 @@ function ucanAttCovers(att, space, prefix, ability, options) {
     const path = kvPathInResource(resource, space);
     if (path === void 0) continue;
     for (const [granted, caveats] of Object.entries(abilities)) {
-      if (!actionContains2(granted, ability)) continue;
+      if (!actionContains(granted, ability)) continue;
       if (!isCapabilitySubset3(
         [{ service: KV_SERVICE2, space, path: prefix, actions: [ability] }],
         [{ service: KV_SERVICE2, space, path, actions: [granted] }]
@@ -18708,7 +18708,7 @@ import {
   KV as KV3,
   SQL as SQL2,
   DUCKDB as DUCKDB2,
-  ENCRYPTION as ENCRYPTION3,
+  ENCRYPTION as ENCRYPTION2,
   EXPIRY as EXPIRY3,
   canonicalHashHex,
   canonicalizeEncryptionJson,
@@ -18720,7 +18720,7 @@ import {
   createInMemoryRegistrySequenceStore as createInMemoryRegistrySequenceStore2,
   publishLocationRecord,
   principalDidEquals as principalDidEquals3,
-  parseNetworkId as parseNetworkId3,
+  parseNetworkId as parseNetworkId2,
   resolveSecretPath as resolveSecretPath2,
   registerPolicyV3,
   CREDENTIAL_INVITATION_REQUEST_DOMAIN,
@@ -20775,11 +20775,7 @@ function createWasmKeyProvider(sessionManager) {
 
 // src/delegateToHelpers.ts
 import {
-  actionContains,
-  ENCRYPTION as ENCRYPTION2,
   parseExpiry,
-  isNetworkId,
-  parseNetworkId as parseNetworkId2,
   SiweMessage as SiweMessage2,
   EXPIRY as EXPIRY2
 } from "@tinycloud/sdk-core";
@@ -20814,16 +20810,6 @@ function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   return entries;
 }
 var DEFAULT_DELEGATION_EXPIRY_MS = EXPIRY2.SESSION_MS;
-var SHARE_NETWORK_NAME_RE = /^share-[a-z0-9][a-z0-9-]{15,35}$/;
-function grantsCappedDecrypt(path, actions) {
-  if (!actions.some((action) => actionContains(action, ENCRYPTION2.DECRYPT))) {
-    return false;
-  }
-  return !(isNetworkId(path) && SHARE_NETWORK_NAME_RE.test(parseNetworkId2(path).name));
-}
-function includesDecrypt(entries) {
-  return entries.some((entry) => grantsCappedDecrypt(entry.path, entry.actions));
-}
 function resolveExpiryMs(expiry) {
   if (expiry === void 0) {
     return DEFAULT_DELEGATION_EXPIRY_MS;
@@ -21013,8 +20999,7 @@ var NodeSecretsService = class {
       );
     }
     try {
-      const grant = action === "get" && this.config.grantGetPermissions !== void 0 ? this.config.grantGetPermissions : this.config.grantPermissions;
-      await grant(escalation);
+      await this.config.grantPermissions(escalation);
       return this.restoreUnlockAfterEscalation();
     } catch (error) {
       return this.escalationError(action, target, error);
@@ -21061,8 +21046,8 @@ var NodeSecretsService = class {
 // src/TinyCloudNode.ts
 var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
-var NETWORK_CREATE_ACTION2 = ENCRYPTION3.NETWORK_CREATE;
-var DECRYPT_ACTION2 = ENCRYPTION3.DECRYPT;
+var NETWORK_CREATE_ACTION2 = ENCRYPTION2.NETWORK_CREATE;
+var DECRYPT_ACTION2 = ENCRYPTION2.DECRYPT;
 var BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
 var BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
 var ACCEPTED_MARKER_VERSIONS = [BOOTSTRAP_COMPLETION_MARKER_VERSION];
@@ -21409,7 +21394,7 @@ function ownerDelegationPermissions(params) {
     }
     if (permission.service === ENCRYPTION_PERMISSION_SERVICE2) {
       try {
-        parseNetworkId3(permission.path);
+        parseNetworkId2(permission.path);
       } catch {
         throw new Error("Owner delegation encryption permission requires a canonical network URN");
       }
@@ -21432,8 +21417,6 @@ function ownerPermissionsToAbilities(permissions) {
   return { abilities, rawAbilities };
 }
 var TERMINAL_DELEGATION_REQUIRES_SESSION_KEY = "disableSubDelegation requires a session-key delegation to a did:key (not did:pkh); use the session-key DID or drop the flag";
-var DECRYPT_GRANT_MAX_EXPIRY_MS = 60 * 60 * 1e3;
-var SECRET_GET_GRANT_EXPIRY_MS = 59 * 60 * 1e3;
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
@@ -23342,7 +23325,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       return;
     }
     for (const networkId of this.requestedEncryptionNetworkIds()) {
-      const parsed = parseNetworkId3(networkId);
+      const parsed = parseNetworkId2(networkId);
       if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
         continue;
       }
@@ -25161,7 +25144,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) throw new Error("Owner session is required");
     const ownerDid = pkhDid2(session.address, session.chainId);
     for (const permission of permissions) {
-      if (permission.service === ENCRYPTION_PERMISSION_SERVICE2 && !principalDidEquals3(parseNetworkId3(permission.path).ownerDid, ownerDid)) {
+      if (permission.service === ENCRYPTION_PERMISSION_SERVICE2 && !principalDidEquals3(parseNetworkId2(permission.path).ownerDid, ownerDid)) {
         throw new Error("Owner delegation cannot grant a foreign encryption network");
       }
     }
@@ -25523,7 +25506,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return existing;
       }
     }
-    const parsed = parseNetworkId3(networkId);
+    const parsed = parseNetworkId2(networkId);
     if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
       throw new Error(
         `Cannot create encryption network ${networkId}: owner ${parsed.ownerDid} does not match signed-in DID ${this.did}`
@@ -25556,7 +25539,6 @@ var _TinyCloudNode = class _TinyCloudNode {
         getManifest: () => this.manifest,
         hasPermissions: (permissions) => this.hasRuntimePermissions(permissions),
         grantPermissions: (additional) => this.grantRuntimePermissions(additional),
-        grantGetPermissions: (additional) => this.grantRuntimePermissions(additional, { expiry: SECRET_GET_GRANT_EXPIRY_MS }),
         uncoveredEntries: (permissions) => permissions.filter((entry) => !this.hasRuntimePermissions([entry])),
         canEscalate: () => this.signer !== void 0 && this.tc !== void 0,
         getEncryptionNetworkId: () => this.getEncryptionNetworkIdForSpace(resolvedSpace),
@@ -25905,13 +25887,6 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     }
     const expanded = this.expandPermissionEntries(permissions);
-    const requestsDecrypt = includesDecrypt(expanded);
-    const requestedExpiryMs = requestsDecrypt && options?.expiry === void 0 ? DECRYPT_GRANT_MAX_EXPIRY_MS : resolveExpiryMs(options?.expiry);
-    if (requestsDecrypt && requestedExpiryMs > DECRYPT_GRANT_MAX_EXPIRY_MS) {
-      throw Object.assign(new Error("decrypt grants last at most one hour"), {
-        code: "DECRYPT_EXPIRY_TOO_LONG"
-      });
-    }
     if (this.sessionCoversPermissionEntries(session, expanded)) {
       return [];
     }
@@ -25942,6 +25917,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       bySpace.set(session.spaceId, []);
     }
     const now = /* @__PURE__ */ new Date();
+    const requestedExpiryMs = resolveExpiryMs(options?.expiry);
     let expiresAt = new Date(now.getTime() + requestedExpiryMs);
     if (sessionExpiry !== void 0 && sessionExpiry < expiresAt) {
       expiresAt = sessionExpiry;
@@ -27992,9 +27968,9 @@ import {
 import {
   EncryptionService as EncryptionService2,
   DecryptTransportResponseError as DecryptTransportResponseError2,
-  parseNetworkId as parseNetworkId4,
+  parseNetworkId as parseNetworkId3,
   buildNetworkId,
-  isNetworkId as isNetworkId2,
+  isNetworkId,
   networkDiscoveryKey,
   NetworkIdError,
   ENCRYPTION_NETWORK_URN_PREFIX,
@@ -30713,7 +30689,7 @@ export {
   installTinyCloudDebugGlobals,
   isCapabilitySubset4 as isCapabilitySubset,
   isEvmAddress,
-  isNetworkId2 as isNetworkId,
+  isNetworkId,
   isStorageFullError2 as isStorageFullError,
   loadManifest,
   logoutPrincipalDigest,
@@ -30723,7 +30699,7 @@ export {
   openWrappedKey,
   parseCanonicalNetworkId,
   parseExpiry2 as parseExpiry,
-  parseNetworkId4 as parseNetworkId,
+  parseNetworkId3 as parseNetworkId,
   parsePkhDid,
   parseSecretCatalogKey,
   parseSpaceUri3 as parseSpaceUri,