@tinycloud/sdk-core 3.11.0-beta.0 → 3.11.0-beta.1

package/dist/index.cjs

@@ -140,6 +140,8 @@ __export(index_exports, {
   MAX_SECRET_SCOPE_LENGTH: () => import_sdk_services10.MAX_SECRET_SCOPE_LENGTH,
   MAX_SHARE_ARTIFACT_BYTES: () => MAX_SHARE_ARTIFACT_BYTES,
   MAX_SHARE_CONTENT_BYTES: () => MAX_SHARE_CONTENT_BYTES,
+  MAX_SIWE_EXPIRY_MS: () => MAX_SIWE_EXPIRY_MS,
+  MAX_UCAN_EXPIRY_MS: () => MAX_UCAN_EXPIRY_MS,
   ManifestValidationError: () => ManifestValidationError,
   MemorySenderShareKeyStorage: () => MemorySenderShareKeyStorage,
   MemorySenderShareRecordStorage: () => MemorySenderShareRecordStorage,
@@ -259,6 +261,7 @@ __export(index_exports, {
   admitPolicyCredentialV4: () => admitPolicyCredentialV4,
   appSecretScope: () => import_sdk_services10.appSecretScope,
   applyPrefix: () => applyPrefix,
+  assertExpiryWithinTechnicalLimit: () => assertExpiryWithinTechnicalLimit,
   assertSpaceCreationAllowed: () => assertSpaceCreationAllowed,
   authorizationVerdictOf: () => import_sdk_services10.authorizationVerdictOf,
   bootstrapEncryptionNetworkId: () => import_bootstrap4.bootstrapEncryptionNetworkId,
@@ -476,6 +479,7 @@ __export(index_exports, {
   signedObjectIdFor: () => signedObjectIdFor,
   storageUsageState: () => import_sdk_services10.storageUsageState,
   submitHostDelegation: () => submitHostDelegation,
+  technicalExpiryRefusal: () => technicalExpiryRefusal,
   tinyCloudDebugLogger: () => import_sdk_services10.tinyCloudDebugLogger,
   toSignedObjectError: () => toSignedObjectError,
   unauthorizedRecapCapabilities: () => unauthorizedRecapCapabilities,
@@ -11127,15 +11131,27 @@ var SIGNED_READ_URL_MS = 5 * 60 * 1e3;
 var SESSION_MS = 30 * 24 * 60 * 60 * 1e3;
 var SHARE_MS = 7 * 24 * 60 * 60 * 1e3;
 var APP_MS = 30 * 24 * 60 * 60 * 1e3;
-var MAX_MS = 10 * 365 * 24 * 60 * 60 * 1e3;
 var EXPIRY = {
   EPHEMERAL_MS,
   SIGNED_READ_URL_MS,
   SESSION_MS,
   SHARE_MS,
-  APP_MS,
-  MAX_MS
+  APP_MS
 };
+var MAX_SIWE_EXPIRY_MS = 253402300799e3;
+var MAX_UCAN_EXPIRY_MS = 9007199254e3;
+function technicalExpiryRefusal(expiresAt, kind) {
+  const ms2 = Number(expiresAt);
+  const siwe = kind === "siwe";
+  const last = siwe ? "9999-12-31" : "2255-06-05";
+  if (!Number.isFinite(ms2) || ms2 < 0) return `expiry is not a valid date or is too far away to hold; choose one before ${last}`;
+  if (ms2 <= (siwe ? MAX_SIWE_EXPIRY_MS : MAX_UCAN_EXPIRY_MS)) return null;
+  return `expiry is later than ${last}, ${siwe ? "the latest date a TinyCloud signed message can carry" : "the latest date an agent or share delegation can carry (UCAN limit); a delegation signed by the wallet (delegateTo with forceWalletSign: true) can go to 9999-12-31"}; choose an earlier expiry`;
+}
+function assertExpiryWithinTechnicalLimit(expiresAt, kind) {
+  const refusal = technicalExpiryRefusal(expiresAt, kind);
+  if (refusal) throw new Error(refusal);
+}
 var DEFAULT_SIGNED_READ_URL_EXPIRY_MS = EXPIRY.SIGNED_READ_URL_MS;
 
 // src/delegations/SharingService.ts
@@ -16729,7 +16745,10 @@ function checkChangedExpiration(input) {
   if (drift.length > 0) return `altered immutable SIWE fields: ${drift.join(", ")}`;
   if (signed.expirationTime === prepared.expirationTime) return null;
   const expiresAt = parseInstantMs(signed.expirationTime);
-  if (expiresAt === void 0) return "expiry is not a valid timestamp";
+  if (expiresAt === void 0) {
+    const later = Date.parse(signed.expirationTime ?? "");
+    return later > MAX_SIWE_EXPIRY_MS ? technicalExpiryRefusal(later, "siwe") : "expiry is not a valid timestamp";
+  }
   if (expiresAt <= nowMs + CHANGED_EXPIRY_MIN_REMAINING_MS) {
     return "expiry must be more than 60 seconds from now; choose a longer expiry";
   }
@@ -16742,10 +16761,7 @@ function checkChangedExpiration(input) {
   if (maxMs !== void 0 && expiresAt > maxMs) {
     return `expiry is later than the maximum for this request (the latest allowed is ${new Date(maxMs).toISOString()}); choose an earlier expiry`;
   }
-  if (expiresAt > nowMs + EXPIRY.MAX_MS) {
-    return "expiry is more than 10 years away, the longest this SDK accepts; choose a shorter expiry";
-  }
-  return null;
+  return technicalExpiryRefusal(expiresAt, "siwe");
 }
 function extractRecapAttenuations(siwe) {
   const merged = {};