@tinycloud/node-sdk 3.8.0-beta.14 → 3.8.0-beta.16

package/dist/core.cjs

@@ -1101,7 +1101,8 @@ var NodeUserAuthorization = class {
         return true;
       }
       const parsed = entry.path.includes("/") ? (0, import_resource.parseEncryptionResource)(entry.path) : { ...(0, import_sdk_services2.parseNetworkId)(entry.path), kind: "network" };
-      if (parsed.kind !== "network") {
+      const sharePrefix = parsed.kind === "prefix" && parsed.network === "default" && parsed.prefix === "share" && entry.actions.length === 1 && entry.actions[0] === DECRYPT_ACTION && didPrincipalMatches(parsed.ownerDid, currentDid);
+      if (parsed.kind !== "network" && !sharePrefix) {
         throw new import_sdk_core5.ManifestValidationError("named keys go in manifest.keys");
       }
       for (const action of entry.actions) {
@@ -7306,7 +7307,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           graph.assertActive();
           const signed = await this.signRawNetworkAuthorization({
             targetNode: input.targetNode,
-            networkId: input.networkId,
+            networkId: input.body.keyPath === void 0 ? input.networkId : `${input.networkId}/${input.body.keyPath}`,
             action: DECRYPT_ACTION2,
             facts: input.facts
           }, { graph, session });
@@ -8896,7 +8897,19 @@ var _TinyCloudNode = class _TinyCloudNode {
         "delegateTo requires a non-empty permissions array"
       );
     }
-    const expandedEntries = this.expandPermissionEntries(permissions);
+    const expandedEntries = (0, import_sdk_core11.expandDelegationPermissionEntries)(permissions);
+    const namedKeyEntries = expandedEntries.filter((entry) => entry.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && entry.path.includes("/"));
+    if (namedKeyEntries.length > 0) {
+      if (expandedEntries.some((entry) => entry.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && !entry.path.includes("/"))) {
+        throw new import_sdk_core11.ManifestValidationError("named-key delegation cannot include bare-network permissions");
+      }
+      if (options?.forceWalletSign) {
+        throw new import_sdk_core11.ManifestValidationError("named-key delegation requires a signed session grant");
+      }
+      const granted = this.projectSignedRecapCapabilities(session.siwe);
+      const { subset, missing } = this.signedCapabilitySubset(namedKeyEntries, granted);
+      if (!subset) throw new import_sdk_core11.PermissionNotInManifestError(missing, granted);
+    }
     const now = /* @__PURE__ */ new Date();
     const expiryMs = resolveExpiryMs(options?.expiry);
     const expirationTime = new Date(now.getTime() + expiryMs);