@tinycloud/node-sdk 3.8.0-beta.14 → 3.8.0-beta.15

package/dist/index.js

@@ -18738,10 +18738,12 @@ import {
   ENCRYPTION_PERMISSION_SERVICE as ENCRYPTION_PERMISSION_SERVICE2,
   CaveatedDelegationUnsupportedError as CaveatedDelegationUnsupportedError2,
   PermissionNotInManifestError,
+  ManifestValidationError as ManifestValidationError2,
   SessionExpiredError,
   canonicalizeRecapCaveats as canonicalizeRecapCaveats2,
   recapCaveatsEqual as recapCaveatsEqual2,
   expandPermissionEntries as expandPermissionEntriesCore,
+  expandDelegationPermissionEntries,
   isCapabilitySubset as isCapabilitySubset2,
   isExplicitOnlyAction,
   parseRecapCapabilities,
@@ -26731,7 +26733,19 @@ var _TinyCloudNode = class _TinyCloudNode {
         "delegateTo requires a non-empty permissions array"
       );
     }
-    const expandedEntries = this.expandPermissionEntries(permissions);
+    const expandedEntries = expandDelegationPermissionEntries(permissions);
+    const namedKeyEntries = expandedEntries.filter((entry) => entry.service === ENCRYPTION_PERMISSION_SERVICE2 && entry.path.includes("/"));
+    if (namedKeyEntries.length > 0) {
+      if (expandedEntries.some((entry) => entry.service === ENCRYPTION_PERMISSION_SERVICE2 && !entry.path.includes("/"))) {
+        throw new ManifestValidationError2("named-key delegation cannot include bare-network permissions");
+      }
+      if (options?.forceWalletSign) {
+        throw new ManifestValidationError2("named-key delegation requires a signed session grant");
+      }
+      const granted = this.projectSignedRecapCapabilities(session.siwe);
+      const { subset, missing } = this.signedCapabilitySubset(namedKeyEntries, granted);
+      if (!subset) throw new PermissionNotInManifestError(missing, granted);
+    }
     const now = /* @__PURE__ */ new Date();
     const expiryMs = resolveExpiryMs(options?.expiry);
     const expirationTime = new Date(now.getTime() + expiryMs);
@@ -28334,7 +28348,7 @@ import {
   CaveatedDelegationUnsupportedError as CaveatedDelegationUnsupportedError3,
   PermissionNotInManifestError as PermissionNotInManifestError2,
   SessionExpiredError as SessionExpiredError2,
-  ManifestValidationError as ManifestValidationError2,
+  ManifestValidationError as ManifestValidationError3,
   composeManifestRequest as composeManifestRequest2,
   resolveManifest as resolveManifest2,
   validateManifest,
@@ -30999,7 +31013,7 @@ export {
   InvalidRestoredSessionError,
   KVService4 as KVService,
   MAX_SECRET_SCOPE_LENGTH,
-  ManifestValidationError2 as ManifestValidationError,
+  ManifestValidationError3 as ManifestValidationError,
   MemorySessionStorage,
   NETWORK_NAME_PATTERN,
   NetworkIdError,