@tinycloud/node-sdk 3.8.0-beta.11 → 3.8.0-beta.14

package/dist/{TinyCloudNode-BVDUdEcf.d.cts → TinyCloudNode-DLuN31i0.d.cts}

@@ -1985,6 +1985,12 @@ declare class TinyCloudNode {
     invokeAny(entries: Parameters<InvokeAnyFunction$1>[1], facts?: Parameters<InvokeAnyFunction$1>[2]): ReturnType<InvokeAnyFunction$1>;
     /** Sign protocol bytes with the established in-memory session key. */
     signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Signs proofless invocations with `session`'s own did:key, for the node's
+     * issued-delegation list and revocation by the delegator. The audience is
+     * this Node's DID; each invocation lives 60 seconds.
+     */
+    private sessionInvocationSignerFor;
     /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
     createUnifiedOwnerRoot(input: UnifiedOwnerRootInput): Promise<UnifiedOwnerRootReceipt>;
     /** Apply only an already-enabled signing policy to the exact credential request. */

package/dist/{TinyCloudNode-jMK_2Uj8.d.ts → TinyCloudNode-DfuhkGz7.d.ts}

@@ -1985,6 +1985,12 @@ declare class TinyCloudNode {
     invokeAny(entries: Parameters<InvokeAnyFunction$1>[1], facts?: Parameters<InvokeAnyFunction$1>[2]): ReturnType<InvokeAnyFunction$1>;
     /** Sign protocol bytes with the established in-memory session key. */
     signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Signs proofless invocations with `session`'s own did:key, for the node's
+     * issued-delegation list and revocation by the delegator. The audience is
+     * this Node's DID; each invocation lives 60 seconds.
+     */
+    private sessionInvocationSignerFor;
     /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
     createUnifiedOwnerRoot(input: UnifiedOwnerRootInput): Promise<UnifiedOwnerRootReceipt>;
     /** Apply only an already-enabled signing policy to the exact credential request. */

package/dist/{WasmKeyProvider-5Ee7fcAw.d.cts → WasmKeyProvider-BKCPRC-c.d.cts}

@@ -106,6 +106,26 @@ declare class FileSessionStorage implements ISessionStorage {
     isAvailable(): boolean;
 }
 
+/**
+ * Whether sign-in at `origin` can be granted named-key abilities for the app
+ * whose manifest `keys_app_id` (or `app_id`) is `keysAppId`.
+ *
+ * "Bound" means the key app id equals the reversed host of the origin, or
+ * extends it with further dot-separated labels: `tinycloud.chat` binds
+ * `chat.tinycloud.tinychat` and `chat.tinycloud.tinychat.worker`. Origins with
+ * no registrable host (`localhost`, `tauri.localhost`, IP addresses) or with
+ * lookalike hosts (`evil-tinycloud.chat`, `tinycloud.chat.evil.com`) are not
+ * bound. `origin` is a URL, an origin string such as `https://tinycloud.chat`,
+ * or a bare SIWE domain such as `tinycloud.chat`; the host (including any
+ * non-default port, which makes the origin unbound) is what is checked.
+ *
+ * This is the check `NodeUserAuthorization` applies when it decides whether a
+ * manifest's `keys` rows are granted at sign-in. A bound origin still needs a
+ * node that lists `encryption-named-keys-v1` in `/info` to actually receive
+ * the row.
+ */
+declare function isAppKeyHostBound(keysAppId: string, origin: string | URL): boolean;
+
 /**
  * WasmKeyProvider - KeyProvider implementation using WASM session manager.
  *
@@ -214,4 +234,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c };
+export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c, isAppKeyHostBound as i };

package/dist/{WasmKeyProvider-5Ee7fcAw.d.ts → WasmKeyProvider-BKCPRC-c.d.ts}

@@ -106,6 +106,26 @@ declare class FileSessionStorage implements ISessionStorage {
     isAvailable(): boolean;
 }
 
+/**
+ * Whether sign-in at `origin` can be granted named-key abilities for the app
+ * whose manifest `keys_app_id` (or `app_id`) is `keysAppId`.
+ *
+ * "Bound" means the key app id equals the reversed host of the origin, or
+ * extends it with further dot-separated labels: `tinycloud.chat` binds
+ * `chat.tinycloud.tinychat` and `chat.tinycloud.tinychat.worker`. Origins with
+ * no registrable host (`localhost`, `tauri.localhost`, IP addresses) or with
+ * lookalike hosts (`evil-tinycloud.chat`, `tinycloud.chat.evil.com`) are not
+ * bound. `origin` is a URL, an origin string such as `https://tinycloud.chat`,
+ * or a bare SIWE domain such as `tinycloud.chat`; the host (including any
+ * non-default port, which makes the origin unbound) is what is checked.
+ *
+ * This is the check `NodeUserAuthorization` applies when it decides whether a
+ * manifest's `keys` rows are granted at sign-in. A bound origin still needs a
+ * node that lists `encryption-named-keys-v1` in `/info` to actually receive
+ * the row.
+ */
+declare function isAppKeyHostBound(keysAppId: string, origin: string | URL): boolean;
+
 /**
  * WasmKeyProvider - KeyProvider implementation using WASM session manager.
  *
@@ -214,4 +234,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c };
+export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c, isAppKeyHostBound as i };

package/dist/{authority-i22vHbbp.d.ts → authority-BHLahKNJ.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-jMK_2Uj8.js';
+import { T as TinyCloudNode } from './TinyCloudNode-DfuhkGz7.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/{authority-DJ-PE4Xo.d.cts → authority-Bgbd8NGB.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-BVDUdEcf.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-DLuN31i0.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/core.cjs

@@ -111,6 +111,7 @@ __export(core_exports, {
   getNodeReplicationLoaders: () => getNodeReplicationLoaders,
   getTinyCloudDebugLogs: () => import_sdk_core13.getTinyCloudDebugLogs,
   installTinyCloudDebugGlobals: () => import_sdk_core13.installTinyCloudDebugGlobals,
+  isAppKeyHostBound: () => isAppKeyHostBound,
   isCapabilitySubset: () => import_sdk_core14.isCapabilitySubset,
   isEvmAddress: () => import_sdk_core13.isEvmAddress,
   loadManifest: () => import_sdk_core14.loadManifest,
@@ -374,6 +375,18 @@ function appKeyHostBinding(domain, appId) {
   const reversed = labels.reverse().join(".");
   return appId === reversed || appId.startsWith(`${reversed}.`);
 }
+function isAppKeyHostBound(keysAppId, origin) {
+  if (typeof origin === "string" && !origin.includes("://")) {
+    return appKeyHostBinding(origin, keysAppId);
+  }
+  let url;
+  try {
+    url = typeof origin === "string" ? new URL(origin) : origin;
+  } catch {
+    return false;
+  }
+  return appKeyHostBinding(url.host, keysAppId);
+}
 
 // src/replication/authority-sign-in.ts
 var import_sdk_core2 = require("@tinycloud/sdk-core");
@@ -6518,6 +6531,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       invoke: graph.invoke,
       invokeAny: graph.invokeAny,
       signOwnerRevocation: this.signer ? (cid) => this.signOwnerRevocation(cid) : void 0,
+      sessionInvocationSigner: this.sessionInvocationSignerFor(input.serviceSession),
       fetch: graph.fetch
     });
     const keyProvider = new WasmKeyProvider({ sessionManager: input.manager });
@@ -6733,6 +6747,31 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
     return signBytesWithJwk(bytes, session.jwk);
   }
+  /**
+   * Signs proofless invocations with `session`'s own did:key, for the node's
+   * issued-delegation list and revocation by the delegator. The audience is
+   * this Node's DID; each invocation lives 60 seconds.
+   */
+  sessionInvocationSignerFor(session) {
+    return {
+      did: () => session.verificationMethod.split("#", 1)[0],
+      sign: async (attenuation) => {
+        const now = Math.floor(Date.now() / 1e3);
+        const invocation = await (0, import_sdk_core11.signCompactUcanAuthorization)({
+          issuerDid: session.verificationMethod.split("#", 1)[0],
+          audienceDid: await this.fetchNodeId(),
+          attenuation,
+          facts: [{}],
+          proofs: [],
+          notBefore: now,
+          expiresAt: now + 60,
+          nonce: `urn:uuid:${crypto.randomUUID()}`,
+          sign: (bytes) => signBytesWithJwk(bytes, session.jwk)
+        });
+        return invocation.authorization;
+      }
+    };
+  }
   /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
   async createUnifiedOwnerRoot(input) {
     const ownerDid = this.credentialHolderDid;
@@ -7440,6 +7479,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       invoke: graph.invoke,
       invokeAny: graph.invokeAny,
       signOwnerRevocation: this.signer ? (cid) => this.signOwnerRevocation(cid) : void 0,
+      sessionInvocationSigner: this.sessionInvocationSignerFor(serviceSession),
       fetch: graph.fetch
     });
     this._spaceService = new import_sdk_core11.SpaceService({
@@ -10325,6 +10365,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   getNodeReplicationLoaders,
   getTinyCloudDebugLogs,
   installTinyCloudDebugGlobals,
+  isAppKeyHostBound,
   isCapabilitySubset,
   isEvmAddress,
   loadManifest,