@tinycloud/node-sdk 3.8.0-beta.11 → 3.8.0-beta.14

package/dist/encryption-keys.d.cts

@@ -1,6 +1,6 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-BVDUdEcf.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-DLuN31i0.cjs';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';

package/dist/encryption-keys.d.ts

@@ -1,6 +1,6 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-jMK_2Uj8.js';
+import { T as TinyCloudNode } from './TinyCloudNode-DfuhkGz7.js';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';

package/dist/index.cjs

@@ -17968,6 +17968,7 @@ __export(src_exports, {
   hexDecode: () => import_sdk_core22.hexDecode,
   hexEncode: () => import_sdk_core22.hexEncode,
   installTinyCloudDebugGlobals: () => import_sdk_core16.installTinyCloudDebugGlobals,
+  isAppKeyHostBound: () => isAppKeyHostBound,
   isCapabilitySubset: () => import_sdk_core17.isCapabilitySubset,
   isEvmAddress: () => import_sdk_core16.isEvmAddress,
   isNetworkId: () => import_sdk_core22.isNetworkId,
@@ -18862,6 +18863,18 @@ function appKeyHostBinding(domain, appId) {
   const reversed = labels.reverse().join(".");
   return appId === reversed || appId.startsWith(`${reversed}.`);
 }
+function isAppKeyHostBound(keysAppId, origin) {
+  if (typeof origin === "string" && !origin.includes("://")) {
+    return appKeyHostBinding(origin, keysAppId);
+  }
+  let url;
+  try {
+    url = typeof origin === "string" ? new URL(origin) : origin;
+  } catch {
+    return false;
+  }
+  return appKeyHostBinding(url.host, keysAppId);
+}
 
 // src/authorization/NodeUserAuthorization.ts
 init_authority_sign_in();
@@ -24342,6 +24355,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       invoke: graph.invoke,
       invokeAny: graph.invokeAny,
       signOwnerRevocation: this.signer ? (cid) => this.signOwnerRevocation(cid) : void 0,
+      sessionInvocationSigner: this.sessionInvocationSignerFor(input.serviceSession),
       fetch: graph.fetch
     });
     const keyProvider = new WasmKeyProvider({ sessionManager: input.manager });
@@ -24557,6 +24571,31 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
     return signBytesWithJwk(bytes, session.jwk);
   }
+  /**
+   * Signs proofless invocations with `session`'s own did:key, for the node's
+   * issued-delegation list and revocation by the delegator. The audience is
+   * this Node's DID; each invocation lives 60 seconds.
+   */
+  sessionInvocationSignerFor(session) {
+    return {
+      did: () => session.verificationMethod.split("#", 1)[0],
+      sign: async (attenuation) => {
+        const now = Math.floor(Date.now() / 1e3);
+        const invocation = await (0, import_sdk_core10.signCompactUcanAuthorization)({
+          issuerDid: session.verificationMethod.split("#", 1)[0],
+          audienceDid: await this.fetchNodeId(),
+          attenuation,
+          facts: [{}],
+          proofs: [],
+          notBefore: now,
+          expiresAt: now + 60,
+          nonce: `urn:uuid:${crypto.randomUUID()}`,
+          sign: (bytes) => signBytesWithJwk(bytes, session.jwk)
+        });
+        return invocation.authorization;
+      }
+    };
+  }
   /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
   async createUnifiedOwnerRoot(input) {
     const ownerDid = this.credentialHolderDid;
@@ -25264,6 +25303,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       invoke: graph.invoke,
       invokeAny: graph.invokeAny,
       signOwnerRevocation: this.signer ? (cid) => this.signOwnerRevocation(cid) : void 0,
+      sessionInvocationSigner: this.sessionInvocationSignerFor(serviceSession),
       fetch: graph.fetch
     });
     this._spaceService = new import_sdk_core10.SpaceService({
@@ -30904,6 +30944,7 @@ function sqliteReplicaStorage(options) {
   hexDecode,
   hexEncode,
   installTinyCloudDebugGlobals,
+  isAppKeyHostBound,
   isCapabilitySubset,
   isEvmAddress,
   isNetworkId,