@tinycloud/node-sdk 3.8.0-beta.11 → 3.8.0-beta.13

package/dist/{WasmKeyProvider-5Ee7fcAw.d.cts → WasmKeyProvider-BKCPRC-c.d.cts}

@@ -106,6 +106,26 @@ declare class FileSessionStorage implements ISessionStorage {
     isAvailable(): boolean;
 }
 
+/**
+ * Whether sign-in at `origin` can be granted named-key abilities for the app
+ * whose manifest `keys_app_id` (or `app_id`) is `keysAppId`.
+ *
+ * "Bound" means the key app id equals the reversed host of the origin, or
+ * extends it with further dot-separated labels: `tinycloud.chat` binds
+ * `chat.tinycloud.tinychat` and `chat.tinycloud.tinychat.worker`. Origins with
+ * no registrable host (`localhost`, `tauri.localhost`, IP addresses) or with
+ * lookalike hosts (`evil-tinycloud.chat`, `tinycloud.chat.evil.com`) are not
+ * bound. `origin` is a URL, an origin string such as `https://tinycloud.chat`,
+ * or a bare SIWE domain such as `tinycloud.chat`; the host (including any
+ * non-default port, which makes the origin unbound) is what is checked.
+ *
+ * This is the check `NodeUserAuthorization` applies when it decides whether a
+ * manifest's `keys` rows are granted at sign-in. A bound origin still needs a
+ * node that lists `encryption-named-keys-v1` in `/info` to actually receive
+ * the row.
+ */
+declare function isAppKeyHostBound(keysAppId: string, origin: string | URL): boolean;
+
 /**
  * WasmKeyProvider - KeyProvider implementation using WASM session manager.
  *
@@ -214,4 +234,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c };
+export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c, isAppKeyHostBound as i };

package/dist/{WasmKeyProvider-5Ee7fcAw.d.ts → WasmKeyProvider-BKCPRC-c.d.ts}

@@ -106,6 +106,26 @@ declare class FileSessionStorage implements ISessionStorage {
     isAvailable(): boolean;
 }
 
+/**
+ * Whether sign-in at `origin` can be granted named-key abilities for the app
+ * whose manifest `keys_app_id` (or `app_id`) is `keysAppId`.
+ *
+ * "Bound" means the key app id equals the reversed host of the origin, or
+ * extends it with further dot-separated labels: `tinycloud.chat` binds
+ * `chat.tinycloud.tinychat` and `chat.tinycloud.tinychat.worker`. Origins with
+ * no registrable host (`localhost`, `tauri.localhost`, IP addresses) or with
+ * lookalike hosts (`evil-tinycloud.chat`, `tinycloud.chat.evil.com`) are not
+ * bound. `origin` is a URL, an origin string such as `https://tinycloud.chat`,
+ * or a bare SIWE domain such as `tinycloud.chat`; the host (including any
+ * non-default port, which makes the origin unbound) is what is checked.
+ *
+ * This is the check `NodeUserAuthorization` applies when it decides whether a
+ * manifest's `keys` rows are granted at sign-in. A bound origin still needs a
+ * node that lists `encryption-named-keys-v1` in `/info` to actually receive
+ * the row.
+ */
+declare function isAppKeyHostBound(keysAppId: string, origin: string | URL): boolean;
+
 /**
  * WasmKeyProvider - KeyProvider implementation using WASM session manager.
  *
@@ -214,4 +234,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c };
+export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c, isAppKeyHostBound as i };

package/dist/core.cjs

@@ -111,6 +111,7 @@ __export(core_exports, {
   getNodeReplicationLoaders: () => getNodeReplicationLoaders,
   getTinyCloudDebugLogs: () => import_sdk_core13.getTinyCloudDebugLogs,
   installTinyCloudDebugGlobals: () => import_sdk_core13.installTinyCloudDebugGlobals,
+  isAppKeyHostBound: () => isAppKeyHostBound,
   isCapabilitySubset: () => import_sdk_core14.isCapabilitySubset,
   isEvmAddress: () => import_sdk_core13.isEvmAddress,
   loadManifest: () => import_sdk_core14.loadManifest,
@@ -374,6 +375,18 @@ function appKeyHostBinding(domain, appId) {
   const reversed = labels.reverse().join(".");
   return appId === reversed || appId.startsWith(`${reversed}.`);
 }
+function isAppKeyHostBound(keysAppId, origin) {
+  if (typeof origin === "string" && !origin.includes("://")) {
+    return appKeyHostBinding(origin, keysAppId);
+  }
+  let url;
+  try {
+    url = typeof origin === "string" ? new URL(origin) : origin;
+  } catch {
+    return false;
+  }
+  return appKeyHostBinding(url.host, keysAppId);
+}
 
 // src/replication/authority-sign-in.ts
 var import_sdk_core2 = require("@tinycloud/sdk-core");
@@ -10325,6 +10338,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   getNodeReplicationLoaders,
   getTinyCloudDebugLogs,
   installTinyCloudDebugGlobals,
+  isAppKeyHostBound,
   isCapabilitySubset,
   isEvmAddress,
   loadManifest,