@tinycloud/node-sdk 3.8.0-beta.20 → 3.8.0-beta.22

package/dist/encryption-keys.d.cts

@@ -1,6 +1,6 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-NrmztjDd.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-DaD5vJhL.cjs';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';

package/dist/encryption-keys.d.ts

@@ -1,6 +1,6 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-BRyeZas2.js';
+import { T as TinyCloudNode } from './TinyCloudNode-k3TbBwwj.js';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';

package/dist/index.cjs

@@ -18814,6 +18814,7 @@ function deserializeDelegation(data) {
 
 // src/TinyCloudNode.ts
 var import_siwe2 = require("siwe");
+var import_share_envelope = require("@tinycloud/share-envelope");
 
 // src/replication/module-registry.ts
 var nodeLoaders;
@@ -20039,8 +20040,8 @@ var NodeUserAuthorization = class {
     this.assertSignInCurrent(generation);
     await this.refreshNamedKeyFeatureForSignIn(address, chainId);
     this.assertSignInCurrent(generation);
-    const keyId = `session-${Date.now()}`;
-    this.sessionManager.renameSessionKeyId(this.activeSessionKeyId, keyId);
+    const keyId = `session-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    this.sessionManager.createSessionKey(keyId);
     this.activeSessionKeyId = keyId;
     const jwkString = this.sessionManager.jwk(keyId);
     if (!jwkString) {
@@ -26107,7 +26108,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session || !Array.isArray(permissions) || permissions.length === 0) {
       return false;
     }
-    const expanded = this.expandPermissionEntries(permissions);
+    const expanded = (0, import_sdk_core10.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core10.pkhDid)(session.address, session.chainId));
     if (this.sessionCoversPermissionEntries(session, expanded)) {
       return true;
     }
@@ -26127,7 +26128,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session || !Array.isArray(permissions) || permissions.length === 0) {
       return [];
     }
-    const expanded = this.expandPermissionEntries(permissions);
+    const expanded = (0, import_sdk_core10.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core10.pkhDid)(session.address, session.chainId));
     return this.findRuntimeGrantsForPermissionEntries(expanded, session).map(
       (grant) => grant.delegation
     );
@@ -26302,7 +26303,28 @@ var _TinyCloudNode = class _TinyCloudNode {
         throw new import_sdk_core10.SessionExpiredError(sessionExpiry);
       }
     }
-    const expanded = this.expandPermissionEntries(permissions);
+    const expanded = (0, import_sdk_core10.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core10.pkhDid)(session.address, session.chainId));
+    const bindsShareKey = expanded.some((entry) => entry.service === import_sdk_core10.ENCRYPTION_PERMISSION_SERVICE && entry.actions.includes("tinycloud.encryption/key.create"));
+    const captured = bindsShareKey ? { ...session, jwk: { ...options?.expectedSessionKey ?? session.jwk } } : session;
+    const assertCapturedKey = bindsShareKey ? () => {
+      const live = session.jwk;
+      const key2 = captured.jwk;
+      if (this.currentTinyCloudSession() !== session || session.verificationMethod !== captured.verificationMethod || session.delegationCid !== captured.delegationCid || session.spaceId !== captured.spaceId || session.address !== captured.address || session.chainId !== captured.chainId || live?.kty !== key2.kty || live?.crv !== key2.crv || live?.x !== key2.x || live?.y !== key2.y || live?.d !== key2.d) {
+        throw new Error("Runtime permission request cancelled because the session key changed.");
+      }
+    } : void 0;
+    const sessionKeyDid = bindsShareKey ? this.sessionDid : void 0;
+    if (bindsShareKey) {
+      const key2 = captured.jwk;
+      if (key2.kty !== "OKP" || key2.crv !== "Ed25519" || typeof key2.x !== "string") {
+        throw new Error("Runtime permission session key does not match its signed identity.");
+      }
+      const keyDid = (0, import_share_envelope.didKeyFromEd25519PublicKey)(base64UrlDecode(key2.x));
+      if (!didPrincipalMatches2(keyDid, sessionKeyDid) || !didPrincipalMatches2(keyDid, captured.verificationMethod) || !didPrincipalMatches2(keyDid, new import_siwe2.SiweMessage(session.siwe).uri)) {
+        throw new Error("Runtime permission session key does not match its signed identity.");
+      }
+      assertCapturedKey();
+    }
     if (this.sessionCoversPermissionEntries(session, expanded)) {
       return [];
     }
@@ -26352,13 +26374,13 @@ var _TinyCloudNode = class _TinyCloudNode {
           return this.wasmBindings.prepareSession({
             abilities,
             ...rawForDelegation.length > 0 ? { rawAbilities: this.permissionsToRawAbilities(rawForDelegation) } : {},
-            address: this.wasmBindings.ensureEip55(session.address),
-            chainId: session.chainId,
+            address: this.wasmBindings.ensureEip55(captured.address),
+            chainId: captured.chainId,
             domain: this.siweDomain,
             issuedAt: now.toISOString(),
             expirationTime: expiresAt.toISOString(),
             spaceId,
-            jwk: session.jwk
+            jwk: captured.jwk
           });
         } catch (error) {
           if (rawForDelegation.some((entry) => this.isRawRevocationPermissionEntry(entry)) && /invalid ReCap resource URI/i.test(error instanceof Error ? error.message : String(error))) {
@@ -26370,8 +26392,13 @@ var _TinyCloudNode = class _TinyCloudNode {
           throw error;
         }
       })();
+      if (bindsShareKey && !didPrincipalMatches2(new import_siwe2.SiweMessage(prepared.siwe).uri, sessionKeyDid)) {
+        throw new Error("Prepared runtime permission targets a different session key.");
+      }
+      assertCapturedKey?.();
       const signature2 = await this.signer.signMessage(prepared.siwe);
       graph.assertActive();
+      assertCapturedKey?.();
       const delegatedSession = this.wasmBindings.completeSessionSetup({
         ...prepared,
         signature: signature2
@@ -26400,18 +26427,19 @@ var _TinyCloudNode = class _TinyCloudNode {
         delegatedSession,
         delegatedEntries,
         spaceId,
-        session,
+        captured,
         expiresAt,
         { siwe: prepared.siwe, signature: signature2 }
       );
       graph.assertActive();
+      assertCapturedKey?.();
       this.runtimePermissionGrants.push({
         session: {
           delegationHeader: delegatedSession.delegationHeader,
           delegationCid: delegatedSession.delegationCid,
           spaceId,
-          verificationMethod: session.verificationMethod,
-          jwk: session.jwk
+          verificationMethod: captured.verificationMethod,
+          jwk: captured.jwk
         },
         delegation,
         operations: this.permissionOperations(delegatedEntries, spaceId),