@tinycloud/node-sdk 3.8.0-beta.20 → 3.8.0-beta.22

package/dist/{TinyCloudNode-NrmztjDd.d.cts → TinyCloudNode-DaD5vJhL.d.cts}

@@ -1191,6 +1191,8 @@ interface DelegateToResult {
 interface RuntimePermissionGrantOptions {
     /** Override expiry. ms-format string ("7d", "1h") or raw milliseconds. */
     expiry?: string | number;
+    /** In-memory key snapshot captured when exact Share-key consent opened. */
+    expectedSessionKey?: Readonly<TinyCloudSession["jwk"]>;
 }
 interface EnsureEncryptionNetworkOptions {
     /**

package/dist/{TinyCloudNode-BRyeZas2.d.ts → TinyCloudNode-k3TbBwwj.d.ts}

@@ -1191,6 +1191,8 @@ interface DelegateToResult {
 interface RuntimePermissionGrantOptions {
     /** Override expiry. ms-format string ("7d", "1h") or raw milliseconds. */
     expiry?: string | number;
+    /** In-memory key snapshot captured when exact Share-key consent opened. */
+    expectedSessionKey?: Readonly<TinyCloudSession["jwk"]>;
 }
 interface EnsureEncryptionNetworkOptions {
     /**

package/dist/{authority-D6JMJwor.d.ts → authority-C_fWaxAu.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-BRyeZas2.js';
+import { T as TinyCloudNode } from './TinyCloudNode-k3TbBwwj.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/{authority-Z-reu6zL.d.cts → authority-DJdbZM6k.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-NrmztjDd.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-DaD5vJhL.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/core.cjs

@@ -1525,8 +1525,8 @@ var NodeUserAuthorization = class {
     this.assertSignInCurrent(generation);
     await this.refreshNamedKeyFeatureForSignIn(address, chainId);
     this.assertSignInCurrent(generation);
-    const keyId = `session-${Date.now()}`;
-    this.sessionManager.renameSessionKeyId(this.activeSessionKeyId, keyId);
+    const keyId = `session-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    this.sessionManager.createSessionKey(keyId);
     this.activeSessionKeyId = keyId;
     const jwkString = this.sessionManager.jwk(keyId);
     if (!jwkString) {
@@ -2960,6 +2960,7 @@ function deserializeDelegation(data) {
 
 // src/TinyCloudNode.ts
 var import_siwe2 = require("siwe");
+var import_share_envelope = require("@tinycloud/share-envelope");
 var import_sdk_core11 = require("@tinycloud/sdk-core");
 var import_sdk_services4 = require("@tinycloud/sdk-services");
 var import_requestLog2 = require("@tinycloud/sdk-services/telemetry/requestLog");
@@ -8283,7 +8284,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session || !Array.isArray(permissions) || permissions.length === 0) {
       return false;
     }
-    const expanded = this.expandPermissionEntries(permissions);
+    const expanded = (0, import_sdk_core11.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core11.pkhDid)(session.address, session.chainId));
     if (this.sessionCoversPermissionEntries(session, expanded)) {
       return true;
     }
@@ -8303,7 +8304,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session || !Array.isArray(permissions) || permissions.length === 0) {
       return [];
     }
-    const expanded = this.expandPermissionEntries(permissions);
+    const expanded = (0, import_sdk_core11.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core11.pkhDid)(session.address, session.chainId));
     return this.findRuntimeGrantsForPermissionEntries(expanded, session).map(
       (grant) => grant.delegation
     );
@@ -8478,7 +8479,28 @@ var _TinyCloudNode = class _TinyCloudNode {
         throw new import_sdk_core11.SessionExpiredError(sessionExpiry);
       }
     }
-    const expanded = this.expandPermissionEntries(permissions);
+    const expanded = (0, import_sdk_core11.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core11.pkhDid)(session.address, session.chainId));
+    const bindsShareKey = expanded.some((entry) => entry.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && entry.actions.includes("tinycloud.encryption/key.create"));
+    const captured = bindsShareKey ? { ...session, jwk: { ...options?.expectedSessionKey ?? session.jwk } } : session;
+    const assertCapturedKey = bindsShareKey ? () => {
+      const live = session.jwk;
+      const key = captured.jwk;
+      if (this.currentTinyCloudSession() !== session || session.verificationMethod !== captured.verificationMethod || session.delegationCid !== captured.delegationCid || session.spaceId !== captured.spaceId || session.address !== captured.address || session.chainId !== captured.chainId || live?.kty !== key.kty || live?.crv !== key.crv || live?.x !== key.x || live?.y !== key.y || live?.d !== key.d) {
+        throw new Error("Runtime permission request cancelled because the session key changed.");
+      }
+    } : void 0;
+    const sessionKeyDid = bindsShareKey ? this.sessionDid : void 0;
+    if (bindsShareKey) {
+      const key = captured.jwk;
+      if (key.kty !== "OKP" || key.crv !== "Ed25519" || typeof key.x !== "string") {
+        throw new Error("Runtime permission session key does not match its signed identity.");
+      }
+      const keyDid = (0, import_share_envelope.didKeyFromEd25519PublicKey)(base64UrlDecode(key.x));
+      if (!didPrincipalMatches2(keyDid, sessionKeyDid) || !didPrincipalMatches2(keyDid, captured.verificationMethod) || !didPrincipalMatches2(keyDid, new import_siwe2.SiweMessage(session.siwe).uri)) {
+        throw new Error("Runtime permission session key does not match its signed identity.");
+      }
+      assertCapturedKey();
+    }
     if (this.sessionCoversPermissionEntries(session, expanded)) {
       return [];
     }
@@ -8528,13 +8550,13 @@ var _TinyCloudNode = class _TinyCloudNode {
           return this.wasmBindings.prepareSession({
             abilities,
             ...rawForDelegation.length > 0 ? { rawAbilities: this.permissionsToRawAbilities(rawForDelegation) } : {},
-            address: this.wasmBindings.ensureEip55(session.address),
-            chainId: session.chainId,
+            address: this.wasmBindings.ensureEip55(captured.address),
+            chainId: captured.chainId,
             domain: this.siweDomain,
             issuedAt: now.toISOString(),
             expirationTime: expiresAt.toISOString(),
             spaceId,
-            jwk: session.jwk
+            jwk: captured.jwk
           });
         } catch (error) {
           if (rawForDelegation.some((entry) => this.isRawRevocationPermissionEntry(entry)) && /invalid ReCap resource URI/i.test(error instanceof Error ? error.message : String(error))) {
@@ -8546,8 +8568,13 @@ var _TinyCloudNode = class _TinyCloudNode {
           throw error;
         }
       })();
+      if (bindsShareKey && !didPrincipalMatches2(new import_siwe2.SiweMessage(prepared.siwe).uri, sessionKeyDid)) {
+        throw new Error("Prepared runtime permission targets a different session key.");
+      }
+      assertCapturedKey?.();
       const signature = await this.signer.signMessage(prepared.siwe);
       graph.assertActive();
+      assertCapturedKey?.();
       const delegatedSession = this.wasmBindings.completeSessionSetup({
         ...prepared,
         signature
@@ -8576,18 +8603,19 @@ var _TinyCloudNode = class _TinyCloudNode {
         delegatedSession,
         delegatedEntries,
         spaceId,
-        session,
+        captured,
         expiresAt,
         { siwe: prepared.siwe, signature }
       );
       graph.assertActive();
+      assertCapturedKey?.();
       this.runtimePermissionGrants.push({
         session: {
           delegationHeader: delegatedSession.delegationHeader,
           delegationCid: delegatedSession.delegationCid,
           spaceId,
-          verificationMethod: session.verificationMethod,
-          jwk: session.jwk
+          verificationMethod: captured.verificationMethod,
+          jwk: captured.jwk
         },
         delegation,
         operations: this.permissionOperations(delegatedEntries, spaceId),