@tinycloud/node-sdk 3.6.0-beta.7 → 3.6.0-beta.8

package/dist/index.js

@@ -18694,11 +18694,11 @@ import {
   bootstrapSteps,
   ErrorCodes as ErrorCodes2,
   ENCRYPTION_PERMISSION_SERVICE as ENCRYPTION_PERMISSION_SERVICE2,
-  CaveatedDelegationUnsupportedError,
+  CaveatedDelegationUnsupportedError as CaveatedDelegationUnsupportedError2,
   PermissionNotInManifestError,
   SessionExpiredError,
   canonicalizeRecapCaveats as canonicalizeRecapCaveats2,
-  recapCaveatsEqual,
+  recapCaveatsEqual as recapCaveatsEqual2,
   expandPermissionEntries as expandPermissionEntriesCore,
   isCapabilitySubset as isCapabilitySubset2,
   isExplicitOnlyAction,
@@ -18785,6 +18785,22 @@ import {
   ENCRYPTION
 } from "@tinycloud/sdk-core";
 
+// src/authorization/caveatRefusal.ts
+import {
+  CaveatedDelegationUnsupportedError,
+  recapCaveatsEqual
+} from "@tinycloud/sdk-core";
+function refuseCaveated(input) {
+  const caveated = [input ?? []].flat().flatMap((item) => [item, ...item.permissions ?? []]).filter(({ caveats }) => {
+    try {
+      return caveats === null || !recapCaveatsEqual(caveats, void 0);
+    } catch {
+      return true;
+    }
+  });
+  if (caveated.length) throw new CaveatedDelegationUnsupportedError(caveated);
+}
+
 // src/authorization/strategies.ts
 import { createOpenKeyCallbackSigningStrategy } from "@tinycloud/sdk-core";
 var defaultSignStrategy = { type: "auto-sign" };
@@ -19753,6 +19769,7 @@ var NodeUserAuthorization = class {
     this._lastActivationSkippedSpaceIds = result.status === 404 ? [primarySpaceId] : [];
   }
   async createBootstrapSession(options) {
+    refuseCaveated(options.capabilityRequest.manifests);
     if (!this._address || !this._chainId) {
       throw new Error("Must be signed in before creating bootstrap sessions");
     }
@@ -19854,6 +19871,7 @@ var NodeUserAuthorization = class {
    * @param options - Optional per-call SIWE overrides for this sign-in only
    */
   async signIn(options) {
+    refuseCaveated(this.getCapabilityRequest()?.manifests);
     const generation = this.sessionGeneration;
     const address = canonicalizeAddress(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
@@ -20005,6 +20023,7 @@ var NodeUserAuthorization = class {
    * ```
    */
   async prepareSessionForSigning() {
+    refuseCaveated(this.getCapabilityRequest()?.manifests);
     const address = canonicalizeAddress(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     const keyId = `session-${Date.now()}`;
@@ -20136,6 +20155,7 @@ var NodeUserAuthorization = class {
    * @param options Optional overrides for the OpenKey request.
    */
   async signInWithOpenKey(authorizeFn, options) {
+    refuseCaveated(this.getCapabilityRequest()?.manifests);
     if (options?.host !== void 0) {
       const overrideHost = options.host.trim();
       if (!overrideHost) {
@@ -21345,6 +21365,7 @@ function ownerDelegationPermissions(params) {
     if (!Array.isArray(params.permissions)) {
       throw new Error("Owner delegation permissions are invalid");
     }
+    refuseCaveated(params.permissions);
     permissions.push(...params.permissions.map((permission) => ({
       service: permission.service,
       path: permission.path,
@@ -21719,7 +21740,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         if (!granted?.caveats?.length) {
           return entry;
         }
-        if (entry.caveats !== void 0 && !recapCaveatsEqual(entry.caveats, granted.caveats)) {
+        if (entry.caveats !== void 0 && !recapCaveatsEqual2(entry.caveats, granted.caveats)) {
           throw new Error("Invocation caveats do not match signed ReCap authority.");
         }
         return { ...entry, caveats: cloneRecapCaveats(granted.caveats) };
@@ -22438,6 +22459,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     await this.signInWith(() => this.auth.signInWithOpenKey(authorizeFn, options));
   }
   async signInWith(performSignIn) {
+    refuseCaveated(this.auth?.capabilityRequest?.manifests);
     const epoch = this.sessionEpoch;
     const attempt = ++this.latestSessionAttempt;
     await this.signOutInFlight;
@@ -26360,7 +26382,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         throw new SessionExpiredError(plan.expiredAt ?? sessionExpiry ?? /* @__PURE__ */ new Date(0));
       }
       if (plan.refused === "CAVEATED_AUTHORITY") {
-        throw new CaveatedDelegationUnsupportedError(plan.caveated ?? []);
+        throw new CaveatedDelegationUnsupportedError2(plan.caveated ?? []);
       }
       throw new PermissionNotInManifestError(plan.missing ?? [], plan.granted ?? []);
     }
@@ -26401,7 +26423,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   planDerivation(expandedEntries, session, effectiveExpiration, nowMs) {
     const caveatedRequest = expandedEntries.filter(
-      (entry) => !recapCaveatsEqual(entry.caveats, void 0)
+      (entry) => !recapCaveatsEqual2(entry.caveats, void 0)
     );
     if (caveatedRequest.length > 0) {
       return { refused: "CAVEATED_AUTHORITY", caveated: caveatedRequest };
@@ -26764,10 +26786,10 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   assertDelegationCaveatsPreservable(entries) {
     const caveated = entries.filter(
-      (entry) => !recapCaveatsEqual(entry.caveats, void 0)
+      (entry) => !recapCaveatsEqual2(entry.caveats, void 0)
     );
     if (caveated.length > 0) {
-      throw new CaveatedDelegationUnsupportedError(caveated);
+      throw new CaveatedDelegationUnsupportedError2(caveated);
     }
   }
   /**
@@ -26779,7 +26801,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   assertRuntimeGrantCaveatsPreservable(entries, requestedOperations, grant) {
     const caveated = this.caveatedRuntimeGrantEntries(entries, requestedOperations, grant);
     if (caveated.length > 0) {
-      throw new CaveatedDelegationUnsupportedError(caveated);
+      throw new CaveatedDelegationUnsupportedError2(caveated);
     }
   }
   /**
@@ -26796,7 +26818,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         const requested = requestedOperations[operationIndex++];
         if (!requested) continue;
         const constrained = grant.operations.find(
-          (granted) => this.operationCovers(granted, requested) && !recapCaveatsEqual(granted.caveats, void 0)
+          (granted) => this.operationCovers(granted, requested) && !recapCaveatsEqual2(granted.caveats, void 0)
         );
         if (constrained) {
           caveated.push({
@@ -26813,7 +26835,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   assertPortableDelegationCaveatsPreservable(delegation) {
     const entries = [];
     const add3 = (service, space, path, actions, caveats) => {
-      if (recapCaveatsEqual(caveats, void 0)) return;
+      if (recapCaveatsEqual2(caveats, void 0)) return;
       entries.push({
         service: service.startsWith("tinycloud.") ? service : `tinycloud.${service}`,
         space,
@@ -26833,7 +26855,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       add3(resource.service, resource.space, resource.path, resource.actions, resource.caveats);
     }
     if (entries.length > 0) {
-      throw new CaveatedDelegationUnsupportedError(entries);
+      throw new CaveatedDelegationUnsupportedError2(entries);
     }
   }
   shortServiceName(service) {
@@ -27159,7 +27181,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (granted.service !== requested.service || !this.actionContains(granted.action, requested.action)) {
       return false;
     }
-    if (requested.caveats !== void 0 && !recapCaveatsEqual(granted.caveats, requested.caveats)) {
+    if (requested.caveats !== void 0 && !recapCaveatsEqual2(granted.caveats, requested.caveats)) {
       return false;
     }
     if (granted.resource !== void 0 || requested.resource !== void 0) {
@@ -27584,6 +27606,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   async createSubDelegation(parentDelegation, params) {
     this.assertPortableDelegationCaveatsPreservable(parentDelegation);
+    refuseCaveated(params.resources);
     if (!this.signer) {
       throw new Error("Cannot createSubDelegation() in session-only mode. Requires wallet mode.");
     }
@@ -27923,7 +27946,7 @@ import {
   DEFAULT_MANIFEST_SPACE as DEFAULT_MANIFEST_SPACE2,
   DEFAULT_MANIFEST_VERSION,
   VAULT_PERMISSION_SERVICE,
-  CaveatedDelegationUnsupportedError as CaveatedDelegationUnsupportedError2,
+  CaveatedDelegationUnsupportedError as CaveatedDelegationUnsupportedError3,
   PermissionNotInManifestError as PermissionNotInManifestError2,
   SessionExpiredError as SessionExpiredError2,
   ManifestValidationError,
@@ -30561,7 +30584,7 @@ export {
   BOOTSTRAP_COMPLETION_MARKER_VERSION,
   CapabilityKeyRegistry2 as CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
-  CaveatedDelegationUnsupportedError2 as CaveatedDelegationUnsupportedError,
+  CaveatedDelegationUnsupportedError3 as CaveatedDelegationUnsupportedError,
   DECRYPT_ACTION3 as DECRYPT_ACTION,
   DECRYPT_FACT_TYPE,
   DECRYPT_RESULT_TYPE,