@tinycloud/node-sdk 3.8.0-beta.19 → 3.8.0-beta.20

package/README.md

@@ -1,5 +1,11 @@
 # @tinycloud/node-sdk
 
+## Signed SIWE metadata
+
+Set `siweConfig.resources` to `urn:tinycloud:recipients:<base64url>` URI strings to include a recipients declaration in the signed SIWE. The payload uses only unpadded base64url characters (`A–Z`, `a–z`, `0–9`, `_`, `-`). Node-sdk inserts these URIs immediately before the original ReCap resource, which remains last. Ordinary sign-in, external/OpenKey preparation, and bootstrap sessions use the same insertion path; completion and session storage retain the signed message unchanged.
+
+These resources do not add permissions. Other schemes, percent encoding, escape sequences and literal controls are not accepted in this option. The generated statement and ReCap remain unchanged; `siweConfig.statement` does not replace the generated statement. Omitting resources or passing an empty array leaves the prepared message unchanged.
+
 ## `@tinycloud/node-sdk/credential-pending-store`
 
 File-backed pending store for the email-proof flow. It keeps one file per request under `<home>/credentials/`, named by a hash of the request id. The directory is created with mode 0700 and each file with mode 0600. Permissions and ownership are re-checked on every read. Only a `home` that is itself a symlink is refused; ancestors of `home` may be symlinks, but `realpath(home)` must be owned by the current user. Unsafe files are left in place and reported as an error.

package/dist/{TinyCloudNode-DfuhkGz7.d.ts → TinyCloudNode-BRyeZas2.d.ts}

@@ -587,13 +587,13 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     /**
      * Build SIWE overrides from the top-level nonce and siweConfig.
      * - Top-level `nonce` is seeded first so `siweConfig.nonce` wins if both are set.
-     * - statement is prepended to the default statement
-     * - resources are appended to the default resources
+     * - resources are inserted after WASM preparation, before the final ReCap
      * - uri triggers a warning (overwriting delegation target)
      * - all other fields override directly
      * - per-call nonce overrides siweConfig.nonce when provided
      */
     private buildSiweOverrides;
+    private prepareSessionWithResources;
     /**
      * Add an extension to the authorization flow.
      */

package/dist/{TinyCloudNode-DLuN31i0.d.cts → TinyCloudNode-NrmztjDd.d.cts}

@@ -587,13 +587,13 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     /**
      * Build SIWE overrides from the top-level nonce and siweConfig.
      * - Top-level `nonce` is seeded first so `siweConfig.nonce` wins if both are set.
-     * - statement is prepended to the default statement
-     * - resources are appended to the default resources
+     * - resources are inserted after WASM preparation, before the final ReCap
      * - uri triggers a warning (overwriting delegation target)
      * - all other fields override directly
      * - per-call nonce overrides siweConfig.nonce when provided
      */
     private buildSiweOverrides;
+    private prepareSessionWithResources;
     /**
      * Add an extension to the authorization flow.
      */

package/dist/{authority-BHLahKNJ.d.ts → authority-D6JMJwor.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-DfuhkGz7.js';
+import { T as TinyCloudNode } from './TinyCloudNode-BRyeZas2.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/{authority-Bgbd8NGB.d.cts → authority-Z-reu6zL.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-DLuN31i0.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-NrmztjDd.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/core.cjs

@@ -1145,8 +1145,7 @@ var NodeUserAuthorization = class {
   /**
    * Build SIWE overrides from the top-level nonce and siweConfig.
    * - Top-level `nonce` is seeded first so `siweConfig.nonce` wins if both are set.
-   * - statement is prepended to the default statement
-   * - resources are appended to the default resources
+   * - resources are inserted after WASM preparation, before the final ReCap
    * - uri triggers a warning (overwriting delegation target)
    * - all other fields override directly
    * - per-call nonce overrides siweConfig.nonce when provided
@@ -1164,9 +1163,6 @@ var NodeUserAuthorization = class {
     if (statement) {
       overrides.statement = this.statement ? `${statement} ${this.statement}` : statement;
     }
-    if (resources && resources.length > 0) {
-      overrides.resources = resources;
-    }
     if (uri) {
       console.warn(
         "[tinycloud] siweConfig.uri is overwriting the delegation target URI. This may break delegation chain validation if the URI does not match the session key DID."
@@ -1178,6 +1174,29 @@ var NodeUserAuthorization = class {
     }
     return overrides;
   }
+  prepareSessionWithResources(params) {
+    const resources = this.siweConfig?.resources;
+    if (resources?.some((resource) => typeof resource !== "string" || !/^urn:tinycloud:recipients:[A-Za-z0-9_-]+$/.test(resource))) {
+      throw new Error("SIWE metadata resources must be base64url recipients URIs");
+    }
+    const prepared = this.wasm.prepareSession(params);
+    if (!resources?.length) return prepared;
+    const recapLines = /^- urn:recap:[^\r\n]+$/gim;
+    const recaps = prepared.siwe.match(recapLines);
+    const recap = recaps?.[0];
+    if (recaps?.length !== 1 || !prepared.siwe.endsWith(recap)) {
+      throw new Error("Prepared SIWE must end with exactly one ReCap");
+    }
+    const insertedLines = resources.map((resource) => `- ${resource}`);
+    const siwe = prepared.siwe.slice(0, -recap.length) + insertedLines.join("\n") + "\n" + recap;
+    const expectedFields = (0, import_sdk_core5.extractImmutableSiweFields)(prepared.siwe);
+    expectedFields.nonRecapResources = [expectedFields.nonRecapResources, ...insertedLines].filter(Boolean).join("\n");
+    const actualRecaps = siwe.match(recapLines);
+    if (actualRecaps?.length !== 1 || actualRecaps[0] !== recap || (0, import_sdk_core5.diffImmutableSiweFields)(expectedFields, (0, import_sdk_core5.extractImmutableSiweFields)(siwe)).length) {
+      throw new Error("SIWE metadata insertion changed the prepared message");
+    }
+    return { ...prepared, siwe };
+  }
   /**
    * Add an extension to the authorization flow.
    */
@@ -1425,7 +1444,7 @@ var NodeUserAuthorization = class {
       spaceAbilities[spaceId] = (0, import_sdk_core5.resourceCapabilitiesToAbilitiesMap)(resources);
     }
     const abilities = spaceAbilities[options.spaceId] ?? (0, import_sdk_core5.resourceCapabilitiesToAbilitiesMap)([]);
-    const prepared = this.wasm.prepareSession({
+    const prepared = this.prepareSessionWithResources({
       abilities,
       spaceAbilities,
       ...options.rawAbilities !== void 0 ? { rawAbilities: options.rawAbilities } : {},
@@ -1518,7 +1537,7 @@ var NodeUserAuthorization = class {
     const spaceId = capabilityPlan.spaceId;
     const now = /* @__PURE__ */ new Date();
     const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
-    const prepared = this.wasm.prepareSession({
+    const prepared = this.prepareSessionWithResources({
       abilities: capabilityPlan.abilities,
       ...capabilityPlan.spaceAbilities !== void 0 ? { spaceAbilities: capabilityPlan.spaceAbilities } : {},
       ...capabilityPlan.rawAbilities !== void 0 ? { rawAbilities: capabilityPlan.rawAbilities } : {},
@@ -1664,7 +1683,7 @@ var NodeUserAuthorization = class {
     const spaceId = capabilityPlan.spaceId;
     const now = /* @__PURE__ */ new Date();
     const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
-    const prepared = this.wasm.prepareSession({
+    const prepared = this.prepareSessionWithResources({
       abilities: capabilityPlan.abilities,
       ...capabilityPlan.spaceAbilities !== void 0 ? { spaceAbilities: capabilityPlan.spaceAbilities } : {},
       ...capabilityPlan.rawAbilities !== void 0 ? { rawAbilities: capabilityPlan.rawAbilities } : {},