@tinycloud/node-sdk 3.8.0 → 3.8.1-beta.1

package/dist/encryption-keys.d.cts

@@ -1,6 +1,6 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-DaD5vJhL.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-BhWBbCay.cjs';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';

package/dist/encryption-keys.d.ts

@@ -1,6 +1,6 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-k3TbBwwj.js';
+import { T as TinyCloudNode } from './TinyCloudNode-BjJJIifr.js';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';

package/dist/index.cjs

@@ -26332,7 +26332,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (existingGrants.length > 0) {
       return existingGrants.map((grant) => grant.delegation);
     }
-    if (!this.signer) {
+    if (!this.signer && options?.signMessage === void 0) {
       throw new Error(
         "grantRuntimePermissions requires wallet mode with a signer or privateKey."
       );
@@ -26396,7 +26396,13 @@ var _TinyCloudNode = class _TinyCloudNode {
         throw new Error("Prepared runtime permission targets a different session key.");
       }
       assertCapturedKey?.();
-      const signature2 = await this.signer.signMessage(prepared.siwe);
+      if (options?.signMessage !== void 0) {
+        this.assertRuntimeGrantMessage(prepared.siwe, session);
+      }
+      const signature2 = options?.signMessage !== void 0 ? await options.signMessage(prepared.siwe) : await this.signer.signMessage(prepared.siwe);
+      if (options?.signMessage !== void 0 && !await (0, import_sdk_core10.verifyEip191MessageSignature)(prepared.siwe, signature2, session.address)) {
+        throw new Error("The signature does not match the account that owns this session.");
+      }
       graph.assertActive();
       assertCapturedKey?.();
       const delegatedSession = this.wasmBindings.completeSessionSetup({
@@ -27214,6 +27220,25 @@ var _TinyCloudNode = class _TinyCloudNode {
   expandPermissionEntries(permissions) {
     return (0, import_sdk_core10.expandPermissionEntries)(permissions);
   }
+  /**
+   * Checks the SIWE text a caller-supplied signer is asked to sign: it must be in canonical form (parsing and
+   * re-serializing it gives the same bytes) and name the session's account and chain. The caller then checks the
+   * signature against these exact bytes.
+   */
+  assertRuntimeGrantMessage(siwe, session) {
+    let parsed;
+    try {
+      parsed = new import_siwe2.SiweMessage(siwe);
+    } catch {
+      throw new Error("The prepared sign-in message is not a valid SIWE message.");
+    }
+    if (parsed.prepareMessage() !== siwe) {
+      throw new Error("The prepared sign-in message is not in canonical form.");
+    }
+    if (parsed.chainId !== session.chainId || (0, import_sdk_core10.canonicalizeAddress)(parsed.address) !== (0, import_sdk_core10.canonicalizeAddress)(session.address)) {
+      throw new Error("The prepared sign-in message is for a different account or chain than this session.");
+    }
+  }
   /**
    * The current WASM child-delegation APIs accept action-only maps. Refuse any
    * constrained branch rather than signing a broader action-only child UCAN.