@tinycloud/node-sdk 3.8.0-beta.13 → 3.8.0-beta.15

package/dist/{TinyCloudNode-BVDUdEcf.d.cts → TinyCloudNode-DLuN31i0.d.cts}

@@ -1985,6 +1985,12 @@ declare class TinyCloudNode {
     invokeAny(entries: Parameters<InvokeAnyFunction$1>[1], facts?: Parameters<InvokeAnyFunction$1>[2]): ReturnType<InvokeAnyFunction$1>;
     /** Sign protocol bytes with the established in-memory session key. */
     signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Signs proofless invocations with `session`'s own did:key, for the node's
+     * issued-delegation list and revocation by the delegator. The audience is
+     * this Node's DID; each invocation lives 60 seconds.
+     */
+    private sessionInvocationSignerFor;
     /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
     createUnifiedOwnerRoot(input: UnifiedOwnerRootInput): Promise<UnifiedOwnerRootReceipt>;
     /** Apply only an already-enabled signing policy to the exact credential request. */

package/dist/{TinyCloudNode-jMK_2Uj8.d.ts → TinyCloudNode-DfuhkGz7.d.ts}

@@ -1985,6 +1985,12 @@ declare class TinyCloudNode {
     invokeAny(entries: Parameters<InvokeAnyFunction$1>[1], facts?: Parameters<InvokeAnyFunction$1>[2]): ReturnType<InvokeAnyFunction$1>;
     /** Sign protocol bytes with the established in-memory session key. */
     signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Signs proofless invocations with `session`'s own did:key, for the node's
+     * issued-delegation list and revocation by the delegator. The audience is
+     * this Node's DID; each invocation lives 60 seconds.
+     */
+    private sessionInvocationSignerFor;
     /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
     createUnifiedOwnerRoot(input: UnifiedOwnerRootInput): Promise<UnifiedOwnerRootReceipt>;
     /** Apply only an already-enabled signing policy to the exact credential request. */

package/dist/{authority-i22vHbbp.d.ts → authority-BHLahKNJ.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-jMK_2Uj8.js';
+import { T as TinyCloudNode } from './TinyCloudNode-DfuhkGz7.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/{authority-DJ-PE4Xo.d.cts → authority-Bgbd8NGB.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-BVDUdEcf.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-DLuN31i0.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/core.cjs

@@ -6531,6 +6531,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       invoke: graph.invoke,
       invokeAny: graph.invokeAny,
       signOwnerRevocation: this.signer ? (cid) => this.signOwnerRevocation(cid) : void 0,
+      sessionInvocationSigner: this.sessionInvocationSignerFor(input.serviceSession),
       fetch: graph.fetch
     });
     const keyProvider = new WasmKeyProvider({ sessionManager: input.manager });
@@ -6746,6 +6747,31 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
     return signBytesWithJwk(bytes, session.jwk);
   }
+  /**
+   * Signs proofless invocations with `session`'s own did:key, for the node's
+   * issued-delegation list and revocation by the delegator. The audience is
+   * this Node's DID; each invocation lives 60 seconds.
+   */
+  sessionInvocationSignerFor(session) {
+    return {
+      did: () => session.verificationMethod.split("#", 1)[0],
+      sign: async (attenuation) => {
+        const now = Math.floor(Date.now() / 1e3);
+        const invocation = await (0, import_sdk_core11.signCompactUcanAuthorization)({
+          issuerDid: session.verificationMethod.split("#", 1)[0],
+          audienceDid: await this.fetchNodeId(),
+          attenuation,
+          facts: [{}],
+          proofs: [],
+          notBefore: now,
+          expiresAt: now + 60,
+          nonce: `urn:uuid:${crypto.randomUUID()}`,
+          sign: (bytes) => signBytesWithJwk(bytes, session.jwk)
+        });
+        return invocation.authorization;
+      }
+    };
+  }
   /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
   async createUnifiedOwnerRoot(input) {
     const ownerDid = this.credentialHolderDid;
@@ -7453,6 +7479,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       invoke: graph.invoke,
       invokeAny: graph.invokeAny,
       signOwnerRevocation: this.signer ? (cid) => this.signOwnerRevocation(cid) : void 0,
+      sessionInvocationSigner: this.sessionInvocationSignerFor(serviceSession),
       fetch: graph.fetch
     });
     this._spaceService = new import_sdk_core11.SpaceService({
@@ -8869,7 +8896,19 @@ var _TinyCloudNode = class _TinyCloudNode {
         "delegateTo requires a non-empty permissions array"
       );
     }
-    const expandedEntries = this.expandPermissionEntries(permissions);
+    const expandedEntries = (0, import_sdk_core11.expandDelegationPermissionEntries)(permissions);
+    const namedKeyEntries = expandedEntries.filter((entry) => entry.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && entry.path.includes("/"));
+    if (namedKeyEntries.length > 0) {
+      if (expandedEntries.some((entry) => entry.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && !entry.path.includes("/"))) {
+        throw new import_sdk_core11.ManifestValidationError("named-key delegation cannot include bare-network permissions");
+      }
+      if (options?.forceWalletSign) {
+        throw new import_sdk_core11.ManifestValidationError("named-key delegation requires a signed session grant");
+      }
+      const granted = this.projectSignedRecapCapabilities(session.siwe);
+      const { subset, missing } = this.signedCapabilitySubset(namedKeyEntries, granted);
+      if (!subset) throw new import_sdk_core11.PermissionNotInManifestError(missing, granted);
+    }
     const now = /* @__PURE__ */ new Date();
     const expiryMs = resolveExpiryMs(options?.expiry);
     const expirationTime = new Date(now.getTime() + expiryMs);