@tinycloud/server 2.4.0-beta.20

package/README.md

@@ -0,0 +1,51 @@
+# @tinycloud/server
+
+Reusable server and agent helpers for TinyCloud backends.
+
+Servers use a raw Ethereum private key as a stable `did:pkh` identity. OpenKey is
+for browser and human-owner sign-in flows; it is not the backend identity.
+
+```ts
+import {
+  createServerDelegateClient,
+  createServerIdentity,
+  createSiweSession,
+} from "@tinycloud/server";
+
+const identity = await createServerIdentity({
+  privateKey: process.env.TC_SERVER_PRIVATE_KEY!,
+  host: process.env.TC_HOST,
+});
+
+console.log(identity.did);
+
+const delegated = createServerDelegateClient({
+  privateKey: process.env.TC_SERVER_PRIVATE_KEY!,
+  host: process.env.TC_HOST,
+  delegation: ownerDelegation,
+});
+
+const githubToken = await delegated.getSecret("GITHUB_TOKEN", { scope: "githaiku" });
+
+const auth = createSiweSession({ jwtSecret: process.env.TC_SERVER_PRIVATE_KEY! });
+const nonce = auth.issueNonce(ownerAddress);
+const session = await auth.verify(siweMessage, signature);
+const owner = auth.verifyToken(session.token);
+```
+
+For dstack TEEs, derive the server key from the guest-agent client and pass it to
+`createServerIdentity`:
+
+```ts
+import { deriveDstackPrivateKey } from "@tinycloud/server";
+
+const privateKey = await deriveDstackPrivateKey({
+  client: dstackClient,
+  path: "my-app/keys/server",
+  purpose: "server",
+});
+```
+
+`createServerDelegateClient` activates the whole PortableDelegation before
+reading secrets. That keeps both the delegated KV-get and
+`tinycloud.encryption/decrypt` proof in the activation chain.

package/dist/index.cjs

@@ -0,0 +1,333 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  NonceStore: () => NonceStore,
+  ServerAuthError: () => ServerAuthError,
+  createServerDelegateClient: () => createServerDelegateClient,
+  createServerIdentity: () => createServerIdentity,
+  createSiweSession: () => createSiweSession,
+  deriveDstackPrivateKey: () => deriveDstackPrivateKey,
+  isTinyCloudSessionError: () => isTinyCloudSessionError,
+  issueSessionToken: () => issueSessionToken,
+  parseDelegation: () => parseDelegation,
+  parseEncryptedEnvelope: () => parseEncryptedEnvelope,
+  parseSecretPayload: () => parseSecretPayload,
+  readDelegatedSecret: () => readDelegatedSecret,
+  serverDidForPrivateKey: () => serverDidForPrivateKey,
+  verifySessionToken: () => verifySessionToken,
+  verifySiweMessage: () => verifySiweMessage,
+  withSessionRefresh: () => withSessionRefresh
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/identity.ts
+var import_viem = require("viem");
+var import_accounts = require("viem/accounts");
+var import_node_sdk = require("@tinycloud/node-sdk");
+var DEFAULT_HOST = "https://node.tinycloud.xyz";
+async function deriveDstackPrivateKey(options) {
+  const res = await options.client.getKey(options.path, options.purpose);
+  if (!(res.key instanceof Uint8Array) || res.key.length === 0) {
+    throw new Error("dstack getKey returned no key material");
+  }
+  return (0, import_viem.keccak256)(res.key);
+}
+function serverDidForPrivateKey(privateKey) {
+  const account = (0, import_accounts.privateKeyToAccount)(privateKey);
+  return `did:pkh:eip155:1:${account.address}`;
+}
+async function createServerIdentity(options) {
+  const host = options.host ?? DEFAULT_HOST;
+  const node = new import_node_sdk.TinyCloudNode({
+    ...options.nodeConfig,
+    privateKey: options.privateKey,
+    host,
+    prefix: options.prefix,
+    manifest: options.manifest,
+    autoCreateSpace: options.autoCreateSpace ?? false,
+    enablePublicSpace: options.enablePublicSpace ?? false,
+    includeAccountRegistryPermissions: options.includeAccountRegistryPermissions ?? false
+  });
+  await node.signIn();
+  return {
+    node,
+    did: node.did,
+    host,
+    privateKey: options.privateKey
+  };
+}
+var SESSION_ERROR_PATTERN = /\b(session\s+expired|invalid\s+session|token\s+expired|expired\s+credentials?|unauthorized|unauthenticated|sign.?in\s*required)\b|\b401\b(?![\d-])/i;
+function isTinyCloudSessionError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return SESSION_ERROR_PATTERN.test(message);
+}
+async function withSessionRefresh(node, fn) {
+  try {
+    return await fn();
+  } catch (error) {
+    if (isTinyCloudSessionError(error)) {
+      await node.signIn();
+      return fn();
+    }
+    throw error;
+  }
+}
+
+// src/delegated-secrets.ts
+var import_node_sdk2 = require("@tinycloud/node-sdk");
+var import_sdk_core = require("@tinycloud/sdk-core");
+function createServerDelegateClient(options) {
+  const delegation = parseDelegation(options.delegation);
+  let nodePromise;
+  async function getNode() {
+    if (!nodePromise) {
+      if (options.node) {
+        nodePromise = Promise.resolve(options.node);
+        return options.node;
+      }
+      const identityOptions = {
+        privateKey: options.privateKey,
+        host: options.host,
+        prefix: options.prefix,
+        enablePublicSpace: false,
+        includeAccountRegistryPermissions: false,
+        nodeConfig: options.nodeConfig
+      };
+      const created = options.nodeFactory ? options.nodeFactory(identityOptions) : createServerIdentity(identityOptions).then(
+        (identity) => identity.node
+      );
+      nodePromise = created;
+      return created;
+    }
+    return nodePromise;
+  }
+  return {
+    async getSecret(name, secretOptions) {
+      const node = await getNode();
+      return readDelegatedSecret(node, delegation, name, secretOptions);
+    }
+  };
+}
+async function readDelegatedSecret(node, delegation, name, options) {
+  const secretKey = (0, import_sdk_core.resolveSecretPath)(name, options).permissionPaths.vault;
+  const access = await node.useDelegation(delegation);
+  const result = await access.kv.get(secretKey, { raw: true, prefix: "" });
+  if (!result.ok) {
+    const message = result.error?.message ?? `failed to read ${secretKey}`;
+    throw new Error(`delegated secret ${name} KV get failed: ${message}`);
+  }
+  const envelope = parseEncryptedEnvelope(
+    result.data?.data,
+    name
+  );
+  const proofCid = access.restorable?.delegationCid ?? access.delegation.cid;
+  if (!proofCid) {
+    throw new Error(`delegated secret ${name} has no decrypt proof`);
+  }
+  const decrypted = await node.encryption.decryptEnvelope(envelope, { proofs: [proofCid] });
+  if (!decrypted.ok) {
+    throw new Error(`delegated secret ${name} decrypt failed: ${decrypted.error.message}`);
+  }
+  return parseSecretPayload(decrypted.data, name);
+}
+function parseDelegation(delegation) {
+  return typeof delegation === "string" ? (0, import_node_sdk2.deserializeDelegation)(delegation) : delegation;
+}
+function parseEncryptedEnvelope(rawEnvelope, name = "secret") {
+  const parsed = typeof rawEnvelope === "string" ? JSON.parse(rawEnvelope) : rawEnvelope;
+  if (typeof parsed !== "object" || parsed === null || typeof parsed.v !== "number" || typeof parsed.networkId !== "string" || typeof parsed.ciphertext !== "string" || typeof parsed.encryptedSymmetricKey !== "string") {
+    throw new Error(`delegated secret ${name} did not contain an encrypted envelope`);
+  }
+  return parsed;
+}
+function parseSecretPayload(plaintext, name = "secret") {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(plaintext));
+  } catch {
+    throw new Error(`delegated secret ${name} did not contain valid JSON`);
+  }
+  if (typeof parsed.value !== "string") {
+    throw new Error(`delegated secret ${name} did not contain a string value`);
+  }
+  return parsed.value;
+}
+
+// src/siwe-session.ts
+var import_node_crypto = require("crypto");
+var import_viem2 = require("viem");
+var DEFAULT_NONCE_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_SESSION_TTL_SECONDS = 24 * 60 * 60;
+var ServerAuthError = class extends Error {
+};
+var NonceStore = class {
+  constructor(ttlMs = DEFAULT_NONCE_TTL_MS) {
+    this.ttlMs = ttlMs;
+  }
+  nonces = /* @__PURE__ */ new Map();
+  issue(address) {
+    this.sweep();
+    const normalized = (0, import_viem2.getAddress)(address).toLowerCase();
+    const nonce = (0, import_node_crypto.randomBytes)(16).toString("hex");
+    this.nonces.set(this.key(normalized, nonce), {
+      address: normalized,
+      createdAt: Date.now()
+    });
+    return nonce;
+  }
+  validate(address, nonce) {
+    const normalized = (0, import_viem2.getAddress)(address).toLowerCase();
+    const key = this.key(normalized, nonce);
+    const entry = this.nonces.get(key);
+    if (!entry) return false;
+    this.nonces.delete(key);
+    return Date.now() - entry.createdAt <= this.ttlMs;
+  }
+  key(address, nonce) {
+    return `${address}:${nonce}`;
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [key, entry] of this.nonces) {
+      if (now - entry.createdAt > this.ttlMs) this.nonces.delete(key);
+    }
+  }
+};
+async function verifySiweMessage(message, signature) {
+  const lines = message.split("\n");
+  let claimed;
+  try {
+    claimed = (0, import_viem2.getAddress)((lines[1] ?? "").trim());
+  } catch {
+    throw new ServerAuthError("SIWE message is missing a valid address on line 2");
+  }
+  const nonceMatch = message.match(/^Nonce: (.+)$/m);
+  if (!nonceMatch || nonceMatch[1] === void 0) {
+    throw new ServerAuthError("SIWE message is missing a Nonce line");
+  }
+  const nonce = nonceMatch[1].trim();
+  let recovered;
+  try {
+    recovered = await (0, import_viem2.recoverMessageAddress)({ message, signature });
+  } catch (error) {
+    throw new ServerAuthError(
+      `SIWE signature recovery failed: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if ((0, import_viem2.getAddress)(recovered) !== claimed) {
+    throw new ServerAuthError(
+      `SIWE signature does not match message address (recovered ${recovered}, expected ${claimed})`
+    );
+  }
+  return { address: claimed, nonce };
+}
+function issueSessionToken(address, secret, ttlSeconds = DEFAULT_SESSION_TTL_SECONDS) {
+  const normalized = (0, import_viem2.getAddress)(address);
+  const now = Math.floor(Date.now() / 1e3);
+  const claims = {
+    sub: normalized,
+    address: normalized,
+    iat: now,
+    exp: now + ttlSeconds
+  };
+  return {
+    token: signJwt({ alg: "HS256", typ: "JWT" }, claims, secret),
+    expiresIn: ttlSeconds
+  };
+}
+function verifySessionToken(token, secret) {
+  const claims = verifyJwt(token, secret);
+  if (typeof claims.sub !== "string" || claims.sub === "") {
+    throw new ServerAuthError("session token missing 'sub' claim");
+  }
+  return { address: claims.sub };
+}
+function createSiweSession(options) {
+  const nonceStore = options.nonceStore ?? new NonceStore();
+  const sessionTtlSeconds = options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS;
+  return {
+    issueNonce(address) {
+      return nonceStore.issue(address);
+    },
+    async verify(message, signature) {
+      const verified = await verifySiweMessage(message, signature);
+      if (!nonceStore.validate(verified.address, verified.nonce)) {
+        throw new ServerAuthError("nonce is invalid, expired, or already used");
+      }
+      return issueSessionToken(verified.address, options.jwtSecret, sessionTtlSeconds);
+    },
+    verifyToken(token) {
+      return verifySessionToken(token, options.jwtSecret);
+    }
+  };
+}
+function signJwt(header, payload, secret) {
+  const encodedHeader = base64UrlEncode(JSON.stringify(header));
+  const encodedPayload = base64UrlEncode(JSON.stringify(payload));
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signature = (0, import_node_crypto.createHmac)("sha256", secret).update(signingInput).digest();
+  return `${signingInput}.${base64UrlEncode(signature)}`;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) {
+    throw new ServerAuthError("session token is not a valid JWT");
+  }
+  const signingInput = `${parts[0]}.${parts[1]}`;
+  const expected = (0, import_node_crypto.createHmac)("sha256", secret).update(signingInput).digest();
+  const actual = base64UrlDecode(parts[2]);
+  if (actual.length !== expected.length || !(0, import_node_crypto.timingSafeEqual)(actual, expected)) {
+    throw new ServerAuthError("session token signature verification failed");
+  }
+  const claims = JSON.parse(base64UrlDecode(parts[1]).toString("utf8"));
+  if (typeof claims.exp !== "number" || claims.exp <= Math.floor(Date.now() / 1e3)) {
+    throw new ServerAuthError("session token expired");
+  }
+  return claims;
+}
+function base64UrlEncode(value) {
+  const buffer = typeof value === "string" ? Buffer.from(value, "utf8") : value;
+  return buffer.toString("base64url");
+}
+function base64UrlDecode(value) {
+  return Buffer.from(value, "base64url");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  NonceStore,
+  ServerAuthError,
+  createServerDelegateClient,
+  createServerIdentity,
+  createSiweSession,
+  deriveDstackPrivateKey,
+  isTinyCloudSessionError,
+  issueSessionToken,
+  parseDelegation,
+  parseEncryptedEnvelope,
+  parseSecretPayload,
+  readDelegatedSecret,
+  serverDidForPrivateKey,
+  verifySessionToken,
+  verifySiweMessage,
+  withSessionRefresh
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/identity.ts","../src/delegated-secrets.ts","../src/siwe-session.ts"],"sourcesContent":["export {\n  createServerIdentity,\n  deriveDstackPrivateKey,\n  isTinyCloudSessionError,\n  serverDidForPrivateKey,\n  withSessionRefresh,\n  type CreateServerIdentityOptions,\n  type DeriveDstackPrivateKeyOptions,\n  type DstackKeyClient,\n  type ServerIdentity,\n} from \"./identity.js\";\n\nexport {\n  createServerDelegateClient,\n  parseDelegation,\n  parseEncryptedEnvelope,\n  parseSecretPayload,\n  readDelegatedSecret,\n  type CreateServerDelegateClientOptions,\n  type DelegationInput,\n  type ServerDelegateClient,\n} from \"./delegated-secrets.js\";\n\nexport {\n  NonceStore,\n  ServerAuthError,\n  createSiweSession,\n  issueSessionToken,\n  verifySessionToken,\n  verifySiweMessage,\n  type CreateSiweSessionOptions,\n  type SessionClaims,\n  type SessionToken,\n  type VerifiedSiwe,\n} from \"./siwe-session.js\";\n","import { keccak256, type Hex } from \"viem\";\nimport { privateKeyToAccount } from \"viem/accounts\";\nimport { TinyCloudNode, type Manifest, type TinyCloudNodeConfig } from \"@tinycloud/node-sdk\";\n\nconst DEFAULT_HOST = \"https://node.tinycloud.xyz\";\n\nexport interface DstackKeyClient {\n  getKey(path: string, purpose: string): Promise<{ key: Uint8Array }>;\n}\n\nexport interface DeriveDstackPrivateKeyOptions {\n  client: DstackKeyClient;\n  path: string;\n  purpose: string;\n}\n\nexport async function deriveDstackPrivateKey(\n  options: DeriveDstackPrivateKeyOptions,\n): Promise<Hex> {\n  const res = await options.client.getKey(options.path, options.purpose);\n  if (!(res.key instanceof Uint8Array) || res.key.length === 0) {\n    throw new Error(\"dstack getKey returned no key material\");\n  }\n  return keccak256(res.key);\n}\n\nexport function serverDidForPrivateKey(privateKey: string): string {\n  const account = privateKeyToAccount(privateKey as Hex);\n  return `did:pkh:eip155:1:${account.address}`;\n}\n\nexport interface CreateServerIdentityOptions {\n  privateKey: string;\n  host?: string;\n  prefix?: string;\n  manifest?: Manifest | Manifest[];\n  autoCreateSpace?: boolean;\n  enablePublicSpace?: boolean;\n  includeAccountRegistryPermissions?: boolean;\n  nodeConfig?: Omit<\n    TinyCloudNodeConfig,\n    | \"privateKey\"\n    | \"host\"\n    | \"prefix\"\n    | \"manifest\"\n    | \"autoCreateSpace\"\n    | \"enablePublicSpace\"\n    | \"includeAccountRegistryPermissions\"\n  >;\n}\n\nexport interface ServerIdentity {\n  node: TinyCloudNode;\n  did: string;\n  host: string;\n  privateKey: string;\n}\n\nexport async function createServerIdentity(\n  options: CreateServerIdentityOptions,\n): Promise<ServerIdentity> {\n  const host = options.host ?? DEFAULT_HOST;\n  const node = new TinyCloudNode({\n    ...options.nodeConfig,\n    privateKey: options.privateKey,\n    host,\n    prefix: options.prefix,\n    manifest: options.manifest,\n    autoCreateSpace: options.autoCreateSpace ?? false,\n    enablePublicSpace: options.enablePublicSpace ?? false,\n    includeAccountRegistryPermissions: options.includeAccountRegistryPermissions ?? false,\n  });\n\n  await node.signIn();\n\n  return {\n    node,\n    did: node.did,\n    host,\n    privateKey: options.privateKey,\n  };\n}\n\nconst SESSION_ERROR_PATTERN =\n  /\\b(session\\s+expired|invalid\\s+session|token\\s+expired|expired\\s+credentials?|unauthorized|unauthenticated|sign.?in\\s*required)\\b|\\b401\\b(?![\\d-])/i;\n\nexport function isTinyCloudSessionError(error: unknown): boolean {\n  const message = error instanceof Error ? error.message : String(error);\n  return SESSION_ERROR_PATTERN.test(message);\n}\n\nexport async function withSessionRefresh<T>(\n  node: TinyCloudNode,\n  fn: () => Promise<T>,\n): Promise<T> {\n  try {\n    return await fn();\n  } catch (error) {\n    if (isTinyCloudSessionError(error)) {\n      await node.signIn();\n      return fn();\n    }\n    throw error;\n  }\n}\n","import {\n  TinyCloudNode,\n  deserializeDelegation,\n  type InlineEncryptedEnvelope,\n  type PortableDelegation,\n  type SecretScopeOptions,\n} from \"@tinycloud/node-sdk\";\nimport { resolveSecretPath } from \"@tinycloud/sdk-core\";\nimport type { CreateServerIdentityOptions } from \"./identity.js\";\nimport { createServerIdentity } from \"./identity.js\";\n\ntype KvLike = {\n  get<T = unknown>(\n    key: string,\n    options: { raw: true; prefix: string },\n  ): Promise<{ ok: true; data: T | unknown } | { ok: false; error?: { message?: string } }>;\n};\n\ntype DelegatedAccessLike = {\n  kv: KvLike;\n  delegation: Pick<PortableDelegation, \"cid\">;\n  restorable?: { delegationCid?: string };\n};\n\ntype DecryptResult =\n  | { ok: true; data: Uint8Array }\n  | { ok: false; error: { code?: string; message: string } };\n\ntype EncryptionLike = {\n  decryptEnvelope(\n    envelope: InlineEncryptedEnvelope,\n    capabilityProof: { proofs: string[] },\n  ): Promise<DecryptResult>;\n};\n\ntype TinyCloudNodeLike = {\n  signIn(): Promise<unknown>;\n  useDelegation(delegation: PortableDelegation): Promise<DelegatedAccessLike>;\n  encryption: EncryptionLike;\n};\n\nexport type DelegationInput = PortableDelegation | string;\n\nexport interface ServerDelegateClient {\n  getSecret(name: string, options?: SecretScopeOptions): Promise<string>;\n}\n\nexport interface CreateServerDelegateClientOptions {\n  privateKey: string;\n  host?: string;\n  delegation: DelegationInput;\n  prefix?: string;\n  nodeConfig?: CreateServerIdentityOptions[\"nodeConfig\"];\n  node?: TinyCloudNodeLike;\n  nodeFactory?: (options: CreateServerIdentityOptions) => Promise<TinyCloudNodeLike>;\n}\n\nexport function createServerDelegateClient(\n  options: CreateServerDelegateClientOptions,\n): ServerDelegateClient {\n  const delegation = parseDelegation(options.delegation);\n  let nodePromise: Promise<TinyCloudNodeLike> | undefined;\n\n  async function getNode(): Promise<TinyCloudNodeLike> {\n    if (!nodePromise) {\n      if (options.node) {\n        nodePromise = Promise.resolve(options.node);\n        return options.node;\n      }\n      const identityOptions: CreateServerIdentityOptions = {\n        privateKey: options.privateKey,\n        host: options.host,\n        prefix: options.prefix,\n        enablePublicSpace: false,\n        includeAccountRegistryPermissions: false,\n        nodeConfig: options.nodeConfig,\n      };\n      const created = options.nodeFactory\n        ? options.nodeFactory(identityOptions)\n        : createServerIdentity(identityOptions).then(\n            (identity) => identity.node as unknown as TinyCloudNodeLike,\n          );\n      nodePromise = created;\n      return created;\n    }\n    return nodePromise;\n  }\n\n  return {\n    async getSecret(name: string, secretOptions?: SecretScopeOptions): Promise<string> {\n      const node = await getNode();\n      return readDelegatedSecret(node, delegation, name, secretOptions);\n    },\n  };\n}\n\nexport async function readDelegatedSecret(\n  node: TinyCloudNodeLike | TinyCloudNode,\n  delegation: PortableDelegation,\n  name: string,\n  options?: SecretScopeOptions,\n): Promise<string> {\n  const secretKey = resolveSecretPath(name, options).permissionPaths.vault;\n\n  const access = await node.useDelegation(delegation);\n  const result = await access.kv.get<unknown>(secretKey, { raw: true, prefix: \"\" });\n  if (!result.ok) {\n    const message = result.error?.message ?? `failed to read ${secretKey}`;\n    throw new Error(`delegated secret ${name} KV get failed: ${message}`);\n  }\n\n  const envelope = parseEncryptedEnvelope(\n    (result.data as { data?: unknown } | undefined)?.data,\n    name,\n  );\n  const proofCid = access.restorable?.delegationCid ?? access.delegation.cid;\n  if (!proofCid) {\n    throw new Error(`delegated secret ${name} has no decrypt proof`);\n  }\n\n  const decrypted = await node.encryption.decryptEnvelope(envelope, { proofs: [proofCid] });\n  if (!decrypted.ok) {\n    throw new Error(`delegated secret ${name} decrypt failed: ${decrypted.error.message}`);\n  }\n\n  return parseSecretPayload(decrypted.data, name);\n}\n\nexport function parseDelegation(delegation: DelegationInput): PortableDelegation {\n  return typeof delegation === \"string\" ? deserializeDelegation(delegation) : delegation;\n}\n\nexport function parseEncryptedEnvelope(\n  rawEnvelope: unknown,\n  name = \"secret\",\n): InlineEncryptedEnvelope {\n  const parsed = typeof rawEnvelope === \"string\" ? JSON.parse(rawEnvelope) : rawEnvelope;\n  if (\n    typeof parsed !== \"object\" ||\n    parsed === null ||\n    typeof (parsed as Partial<InlineEncryptedEnvelope>).v !== \"number\" ||\n    typeof (parsed as Partial<InlineEncryptedEnvelope>).networkId !== \"string\" ||\n    typeof (parsed as Partial<InlineEncryptedEnvelope>).ciphertext !== \"string\" ||\n    typeof (parsed as Partial<InlineEncryptedEnvelope>).encryptedSymmetricKey !== \"string\"\n  ) {\n    throw new Error(`delegated secret ${name} did not contain an encrypted envelope`);\n  }\n  return parsed as InlineEncryptedEnvelope;\n}\n\nexport function parseSecretPayload(plaintext: Uint8Array, name = \"secret\"): string {\n  let parsed: { value?: unknown };\n  try {\n    parsed = JSON.parse(new TextDecoder().decode(plaintext)) as { value?: unknown };\n  } catch {\n    throw new Error(`delegated secret ${name} did not contain valid JSON`);\n  }\n  if (typeof parsed.value !== \"string\") {\n    throw new Error(`delegated secret ${name} did not contain a string value`);\n  }\n  return parsed.value;\n}\n","import { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { getAddress, recoverMessageAddress, type Hex } from \"viem\";\n\nconst DEFAULT_NONCE_TTL_MS = 5 * 60 * 1000;\nconst DEFAULT_SESSION_TTL_SECONDS = 24 * 60 * 60;\n\ninterface NonceEntry {\n  address: string;\n  createdAt: number;\n}\n\nexport class ServerAuthError extends Error {}\n\nexport class NonceStore {\n  private readonly nonces = new Map<string, NonceEntry>();\n\n  constructor(private readonly ttlMs = DEFAULT_NONCE_TTL_MS) {}\n\n  issue(address: string): string {\n    this.sweep();\n    const normalized = getAddress(address).toLowerCase();\n    const nonce = randomBytes(16).toString(\"hex\");\n    this.nonces.set(this.key(normalized, nonce), {\n      address: normalized,\n      createdAt: Date.now(),\n    });\n    return nonce;\n  }\n\n  validate(address: string, nonce: string): boolean {\n    const normalized = getAddress(address).toLowerCase();\n    const key = this.key(normalized, nonce);\n    const entry = this.nonces.get(key);\n    if (!entry) return false;\n    this.nonces.delete(key);\n    return Date.now() - entry.createdAt <= this.ttlMs;\n  }\n\n  private key(address: string, nonce: string): string {\n    return `${address}:${nonce}`;\n  }\n\n  private sweep(): void {\n    const now = Date.now();\n    for (const [key, entry] of this.nonces) {\n      if (now - entry.createdAt > this.ttlMs) this.nonces.delete(key);\n    }\n  }\n}\n\nexport interface VerifiedSiwe {\n  address: string;\n  nonce: string;\n}\n\nexport async function verifySiweMessage(\n  message: string,\n  signature: string,\n): Promise<VerifiedSiwe> {\n  const lines = message.split(\"\\n\");\n  let claimed: string;\n  try {\n    claimed = getAddress((lines[1] ?? \"\").trim());\n  } catch {\n    throw new ServerAuthError(\"SIWE message is missing a valid address on line 2\");\n  }\n\n  const nonceMatch = message.match(/^Nonce: (.+)$/m);\n  if (!nonceMatch || nonceMatch[1] === undefined) {\n    throw new ServerAuthError(\"SIWE message is missing a Nonce line\");\n  }\n  const nonce = nonceMatch[1].trim();\n\n  let recovered: string;\n  try {\n    recovered = await recoverMessageAddress({ message, signature: signature as Hex });\n  } catch (error) {\n    throw new ServerAuthError(\n      `SIWE signature recovery failed: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n  if (getAddress(recovered) !== claimed) {\n    throw new ServerAuthError(\n      `SIWE signature does not match message address (recovered ${recovered}, expected ${claimed})`,\n    );\n  }\n\n  return { address: claimed, nonce };\n}\n\nexport interface SessionToken {\n  token: string;\n  expiresIn: number;\n}\n\nexport interface SessionClaims {\n  sub: string;\n  address: string;\n  iat: number;\n  exp: number;\n}\n\nexport function issueSessionToken(\n  address: string,\n  secret: string,\n  ttlSeconds = DEFAULT_SESSION_TTL_SECONDS,\n): SessionToken {\n  const normalized = getAddress(address);\n  const now = Math.floor(Date.now() / 1000);\n  const claims: SessionClaims = {\n    sub: normalized,\n    address: normalized,\n    iat: now,\n    exp: now + ttlSeconds,\n  };\n  return {\n    token: signJwt({ alg: \"HS256\", typ: \"JWT\" }, claims, secret),\n    expiresIn: ttlSeconds,\n  };\n}\n\nexport function verifySessionToken(token: string, secret: string): { address: string } {\n  const claims = verifyJwt(token, secret);\n  if (typeof claims.sub !== \"string\" || claims.sub === \"\") {\n    throw new ServerAuthError(\"session token missing 'sub' claim\");\n  }\n  return { address: claims.sub };\n}\n\nexport interface CreateSiweSessionOptions {\n  jwtSecret: string;\n  nonceStore?: NonceStore;\n  sessionTtlSeconds?: number;\n}\n\nexport function createSiweSession(options: CreateSiweSessionOptions) {\n  const nonceStore = options.nonceStore ?? new NonceStore();\n  const sessionTtlSeconds = options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS;\n\n  return {\n    issueNonce(address: string): string {\n      return nonceStore.issue(address);\n    },\n    async verify(message: string, signature: string): Promise<SessionToken> {\n      const verified = await verifySiweMessage(message, signature);\n      if (!nonceStore.validate(verified.address, verified.nonce)) {\n        throw new ServerAuthError(\"nonce is invalid, expired, or already used\");\n      }\n      return issueSessionToken(verified.address, options.jwtSecret, sessionTtlSeconds);\n    },\n    verifyToken(token: string): { address: string } {\n      return verifySessionToken(token, options.jwtSecret);\n    },\n  };\n}\n\nfunction signJwt(header: object, payload: object, secret: string): string {\n  const encodedHeader = base64UrlEncode(JSON.stringify(header));\n  const encodedPayload = base64UrlEncode(JSON.stringify(payload));\n  const signingInput = `${encodedHeader}.${encodedPayload}`;\n  const signature = createHmac(\"sha256\", secret).update(signingInput).digest();\n  return `${signingInput}.${base64UrlEncode(signature)}`;\n}\n\nfunction verifyJwt(token: string, secret: string): SessionClaims {\n  const parts = token.split(\".\");\n  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) {\n    throw new ServerAuthError(\"session token is not a valid JWT\");\n  }\n\n  const signingInput = `${parts[0]}.${parts[1]}`;\n  const expected = createHmac(\"sha256\", secret).update(signingInput).digest();\n  const actual = base64UrlDecode(parts[2]);\n  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {\n    throw new ServerAuthError(\"session token signature verification failed\");\n  }\n\n  const claims = JSON.parse(base64UrlDecode(parts[1]).toString(\"utf8\")) as SessionClaims;\n  if (typeof claims.exp !== \"number\" || claims.exp <= Math.floor(Date.now() / 1000)) {\n    throw new ServerAuthError(\"session token expired\");\n  }\n  return claims;\n}\n\nfunction base64UrlEncode(value: string | Buffer): string {\n  const buffer = typeof value === \"string\" ? Buffer.from(value, \"utf8\") : value;\n  return buffer.toString(\"base64url\");\n}\n\nfunction base64UrlDecode(value: string): Buffer {\n  return Buffer.from(value, \"base64url\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAAoC;AACpC,sBAAoC;AACpC,sBAAuE;AAEvE,IAAM,eAAe;AAYrB,eAAsB,uBACpB,SACc;AACd,QAAM,MAAM,MAAM,QAAQ,OAAO,OAAO,QAAQ,MAAM,QAAQ,OAAO;AACrE,MAAI,EAAE,IAAI,eAAe,eAAe,IAAI,IAAI,WAAW,GAAG;AAC5D,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,aAAO,uBAAU,IAAI,GAAG;AAC1B;AAEO,SAAS,uBAAuB,YAA4B;AACjE,QAAM,cAAU,qCAAoB,UAAiB;AACrD,SAAO,oBAAoB,QAAQ,OAAO;AAC5C;AA6BA,eAAsB,qBACpB,SACyB;AACzB,QAAM,OAAO,QAAQ,QAAQ;AAC7B,QAAM,OAAO,IAAI,8BAAc;AAAA,IAC7B,GAAG,QAAQ;AAAA,IACX,YAAY,QAAQ;AAAA,IACpB;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,iBAAiB,QAAQ,mBAAmB;AAAA,IAC5C,mBAAmB,QAAQ,qBAAqB;AAAA,IAChD,mCAAmC,QAAQ,qCAAqC;AAAA,EAClF,CAAC;AAED,QAAM,KAAK,OAAO;AAElB,SAAO;AAAA,IACL;AAAA,IACA,KAAK,KAAK;AAAA,IACV;AAAA,IACA,YAAY,QAAQ;AAAA,EACtB;AACF;AAEA,IAAM,wBACJ;AAEK,SAAS,wBAAwB,OAAyB;AAC/D,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,SAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,eAAsB,mBACpB,MACA,IACY;AACZ,MAAI;AACF,WAAO,MAAM,GAAG;AAAA,EAClB,SAAS,OAAO;AACd,QAAI,wBAAwB,KAAK,GAAG;AAClC,YAAM,KAAK,OAAO;AAClB,aAAO,GAAG;AAAA,IACZ;AACA,UAAM;AAAA,EACR;AACF;;;ACxGA,IAAAA,mBAMO;AACP,sBAAkC;AAkD3B,SAAS,2BACd,SACsB;AACtB,QAAM,aAAa,gBAAgB,QAAQ,UAAU;AACrD,MAAI;AAEJ,iBAAe,UAAsC;AACnD,QAAI,CAAC,aAAa;AAChB,UAAI,QAAQ,MAAM;AAChB,sBAAc,QAAQ,QAAQ,QAAQ,IAAI;AAC1C,eAAO,QAAQ;AAAA,MACjB;AACA,YAAM,kBAA+C;AAAA,QACnD,YAAY,QAAQ;AAAA,QACpB,MAAM,QAAQ;AAAA,QACd,QAAQ,QAAQ;AAAA,QAChB,mBAAmB;AAAA,QACnB,mCAAmC;AAAA,QACnC,YAAY,QAAQ;AAAA,MACtB;AACA,YAAM,UAAU,QAAQ,cACpB,QAAQ,YAAY,eAAe,IACnC,qBAAqB,eAAe,EAAE;AAAA,QACpC,CAAC,aAAa,SAAS;AAAA,MACzB;AACJ,oBAAc;AACd,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,MAAc,eAAqD;AACjF,YAAM,OAAO,MAAM,QAAQ;AAC3B,aAAO,oBAAoB,MAAM,YAAY,MAAM,aAAa;AAAA,IAClE;AAAA,EACF;AACF;AAEA,eAAsB,oBACpB,MACA,YACA,MACA,SACiB;AACjB,QAAM,gBAAY,mCAAkB,MAAM,OAAO,EAAE,gBAAgB;AAEnE,QAAM,SAAS,MAAM,KAAK,cAAc,UAAU;AAClD,QAAM,SAAS,MAAM,OAAO,GAAG,IAAa,WAAW,EAAE,KAAK,MAAM,QAAQ,GAAG,CAAC;AAChF,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,OAAO,WAAW,kBAAkB,SAAS;AACpE,UAAM,IAAI,MAAM,oBAAoB,IAAI,mBAAmB,OAAO,EAAE;AAAA,EACtE;AAEA,QAAM,WAAW;AAAA,IACd,OAAO,MAAyC;AAAA,IACjD;AAAA,EACF;AACA,QAAM,WAAW,OAAO,YAAY,iBAAiB,OAAO,WAAW;AACvE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,oBAAoB,IAAI,uBAAuB;AAAA,EACjE;AAEA,QAAM,YAAY,MAAM,KAAK,WAAW,gBAAgB,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACxF,MAAI,CAAC,UAAU,IAAI;AACjB,UAAM,IAAI,MAAM,oBAAoB,IAAI,oBAAoB,UAAU,MAAM,OAAO,EAAE;AAAA,EACvF;AAEA,SAAO,mBAAmB,UAAU,MAAM,IAAI;AAChD;AAEO,SAAS,gBAAgB,YAAiD;AAC/E,SAAO,OAAO,eAAe,eAAW,wCAAsB,UAAU,IAAI;AAC9E;AAEO,SAAS,uBACd,aACA,OAAO,UACkB;AACzB,QAAM,SAAS,OAAO,gBAAgB,WAAW,KAAK,MAAM,WAAW,IAAI;AAC3E,MACE,OAAO,WAAW,YAClB,WAAW,QACX,OAAQ,OAA4C,MAAM,YAC1D,OAAQ,OAA4C,cAAc,YAClE,OAAQ,OAA4C,eAAe,YACnE,OAAQ,OAA4C,0BAA0B,UAC9E;AACA,UAAM,IAAI,MAAM,oBAAoB,IAAI,wCAAwC;AAAA,EAClF;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,WAAuB,OAAO,UAAkB;AACjF,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,MAAM,oBAAoB,IAAI,6BAA6B;AAAA,EACvE;AACA,MAAI,OAAO,OAAO,UAAU,UAAU;AACpC,UAAM,IAAI,MAAM,oBAAoB,IAAI,iCAAiC;AAAA,EAC3E;AACA,SAAO,OAAO;AAChB;;;ACjKA,yBAAyD;AACzD,IAAAC,eAA4D;AAE5D,IAAM,uBAAuB,IAAI,KAAK;AACtC,IAAM,8BAA8B,KAAK,KAAK;AAOvC,IAAM,kBAAN,cAA8B,MAAM;AAAC;AAErC,IAAM,aAAN,MAAiB;AAAA,EAGtB,YAA6B,QAAQ,sBAAsB;AAA9B;AAAA,EAA+B;AAAA,EAF3C,SAAS,oBAAI,IAAwB;AAAA,EAItD,MAAM,SAAyB;AAC7B,SAAK,MAAM;AACX,UAAM,iBAAa,yBAAW,OAAO,EAAE,YAAY;AACnD,UAAM,YAAQ,gCAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,SAAK,OAAO,IAAI,KAAK,IAAI,YAAY,KAAK,GAAG;AAAA,MAC3C,SAAS;AAAA,MACT,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,SAAiB,OAAwB;AAChD,UAAM,iBAAa,yBAAW,OAAO,EAAE,YAAY;AACnD,UAAM,MAAM,KAAK,IAAI,YAAY,KAAK;AACtC,UAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AACjC,QAAI,CAAC,MAAO,QAAO;AACnB,SAAK,OAAO,OAAO,GAAG;AACtB,WAAO,KAAK,IAAI,IAAI,MAAM,aAAa,KAAK;AAAA,EAC9C;AAAA,EAEQ,IAAI,SAAiB,OAAuB;AAClD,WAAO,GAAG,OAAO,IAAI,KAAK;AAAA,EAC5B;AAAA,EAEQ,QAAc;AACpB,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,QAAQ;AACtC,UAAI,MAAM,MAAM,YAAY,KAAK,MAAO,MAAK,OAAO,OAAO,GAAG;AAAA,IAChE;AAAA,EACF;AACF;AAOA,eAAsB,kBACpB,SACA,WACuB;AACvB,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,MAAI;AACJ,MAAI;AACF,kBAAU,0BAAY,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;AAAA,EAC9C,QAAQ;AACN,UAAM,IAAI,gBAAgB,mDAAmD;AAAA,EAC/E;AAEA,QAAM,aAAa,QAAQ,MAAM,gBAAgB;AACjD,MAAI,CAAC,cAAc,WAAW,CAAC,MAAM,QAAW;AAC9C,UAAM,IAAI,gBAAgB,sCAAsC;AAAA,EAClE;AACA,QAAM,QAAQ,WAAW,CAAC,EAAE,KAAK;AAEjC,MAAI;AACJ,MAAI;AACF,gBAAY,UAAM,oCAAsB,EAAE,SAAS,UAA4B,CAAC;AAAA,EAClF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,mCAAmC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC3F;AAAA,EACF;AACA,UAAI,yBAAW,SAAS,MAAM,SAAS;AACrC,UAAM,IAAI;AAAA,MACR,4DAA4D,SAAS,cAAc,OAAO;AAAA,IAC5F;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,SAAS,MAAM;AACnC;AAcO,SAAS,kBACd,SACA,QACA,aAAa,6BACC;AACd,QAAM,iBAAa,yBAAW,OAAO;AACrC,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,SAAwB;AAAA,IAC5B,KAAK;AAAA,IACL,SAAS;AAAA,IACT,KAAK;AAAA,IACL,KAAK,MAAM;AAAA,EACb;AACA,SAAO;AAAA,IACL,OAAO,QAAQ,EAAE,KAAK,SAAS,KAAK,MAAM,GAAG,QAAQ,MAAM;AAAA,IAC3D,WAAW;AAAA,EACb;AACF;AAEO,SAAS,mBAAmB,OAAe,QAAqC;AACrF,QAAM,SAAS,UAAU,OAAO,MAAM;AACtC,MAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,QAAQ,IAAI;AACvD,UAAM,IAAI,gBAAgB,mCAAmC;AAAA,EAC/D;AACA,SAAO,EAAE,SAAS,OAAO,IAAI;AAC/B;AAQO,SAAS,kBAAkB,SAAmC;AACnE,QAAM,aAAa,QAAQ,cAAc,IAAI,WAAW;AACxD,QAAM,oBAAoB,QAAQ,qBAAqB;AAEvD,SAAO;AAAA,IACL,WAAW,SAAyB;AAClC,aAAO,WAAW,MAAM,OAAO;AAAA,IACjC;AAAA,IACA,MAAM,OAAO,SAAiB,WAA0C;AACtE,YAAM,WAAW,MAAM,kBAAkB,SAAS,SAAS;AAC3D,UAAI,CAAC,WAAW,SAAS,SAAS,SAAS,SAAS,KAAK,GAAG;AAC1D,cAAM,IAAI,gBAAgB,4CAA4C;AAAA,MACxE;AACA,aAAO,kBAAkB,SAAS,SAAS,QAAQ,WAAW,iBAAiB;AAAA,IACjF;AAAA,IACA,YAAY,OAAoC;AAC9C,aAAO,mBAAmB,OAAO,QAAQ,SAAS;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,QAAQ,QAAgB,SAAiB,QAAwB;AACxE,QAAM,gBAAgB,gBAAgB,KAAK,UAAU,MAAM,CAAC;AAC5D,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,OAAO,CAAC;AAC9D,QAAM,eAAe,GAAG,aAAa,IAAI,cAAc;AACvD,QAAM,gBAAY,+BAAW,UAAU,MAAM,EAAE,OAAO,YAAY,EAAE,OAAO;AAC3E,SAAO,GAAG,YAAY,IAAI,gBAAgB,SAAS,CAAC;AACtD;AAEA,SAAS,UAAU,OAAe,QAA+B;AAC/D,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;AAC7D,UAAM,IAAI,gBAAgB,kCAAkC;AAAA,EAC9D;AAEA,QAAM,eAAe,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAC5C,QAAM,eAAW,+BAAW,UAAU,MAAM,EAAE,OAAO,YAAY,EAAE,OAAO;AAC1E,QAAM,SAAS,gBAAgB,MAAM,CAAC,CAAC;AACvC,MAAI,OAAO,WAAW,SAAS,UAAU,KAAC,oCAAgB,QAAQ,QAAQ,GAAG;AAC3E,UAAM,IAAI,gBAAgB,6CAA6C;AAAA,EACzE;AAEA,QAAM,SAAS,KAAK,MAAM,gBAAgB,MAAM,CAAC,CAAC,EAAE,SAAS,MAAM,CAAC;AACpE,MAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AACjF,UAAM,IAAI,gBAAgB,uBAAuB;AAAA,EACnD;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAgC;AACvD,QAAM,SAAS,OAAO,UAAU,WAAW,OAAO,KAAK,OAAO,MAAM,IAAI;AACxE,SAAO,OAAO,SAAS,WAAW;AACpC;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,OAAO,WAAW;AACvC;","names":["import_node_sdk","import_viem"]}

package/dist/index.d.cts

@@ -0,0 +1,139 @@
+import { Hex } from 'viem';
+import { Manifest, TinyCloudNodeConfig, TinyCloudNode, PortableDelegation, InlineEncryptedEnvelope, SecretScopeOptions } from '@tinycloud/node-sdk';
+
+interface DstackKeyClient {
+    getKey(path: string, purpose: string): Promise<{
+        key: Uint8Array;
+    }>;
+}
+interface DeriveDstackPrivateKeyOptions {
+    client: DstackKeyClient;
+    path: string;
+    purpose: string;
+}
+declare function deriveDstackPrivateKey(options: DeriveDstackPrivateKeyOptions): Promise<Hex>;
+declare function serverDidForPrivateKey(privateKey: string): string;
+interface CreateServerIdentityOptions {
+    privateKey: string;
+    host?: string;
+    prefix?: string;
+    manifest?: Manifest | Manifest[];
+    autoCreateSpace?: boolean;
+    enablePublicSpace?: boolean;
+    includeAccountRegistryPermissions?: boolean;
+    nodeConfig?: Omit<TinyCloudNodeConfig, "privateKey" | "host" | "prefix" | "manifest" | "autoCreateSpace" | "enablePublicSpace" | "includeAccountRegistryPermissions">;
+}
+interface ServerIdentity {
+    node: TinyCloudNode;
+    did: string;
+    host: string;
+    privateKey: string;
+}
+declare function createServerIdentity(options: CreateServerIdentityOptions): Promise<ServerIdentity>;
+declare function isTinyCloudSessionError(error: unknown): boolean;
+declare function withSessionRefresh<T>(node: TinyCloudNode, fn: () => Promise<T>): Promise<T>;
+
+type KvLike = {
+    get<T = unknown>(key: string, options: {
+        raw: true;
+        prefix: string;
+    }): Promise<{
+        ok: true;
+        data: T | unknown;
+    } | {
+        ok: false;
+        error?: {
+            message?: string;
+        };
+    }>;
+};
+type DelegatedAccessLike = {
+    kv: KvLike;
+    delegation: Pick<PortableDelegation, "cid">;
+    restorable?: {
+        delegationCid?: string;
+    };
+};
+type DecryptResult = {
+    ok: true;
+    data: Uint8Array;
+} | {
+    ok: false;
+    error: {
+        code?: string;
+        message: string;
+    };
+};
+type EncryptionLike = {
+    decryptEnvelope(envelope: InlineEncryptedEnvelope, capabilityProof: {
+        proofs: string[];
+    }): Promise<DecryptResult>;
+};
+type TinyCloudNodeLike = {
+    signIn(): Promise<unknown>;
+    useDelegation(delegation: PortableDelegation): Promise<DelegatedAccessLike>;
+    encryption: EncryptionLike;
+};
+type DelegationInput = PortableDelegation | string;
+interface ServerDelegateClient {
+    getSecret(name: string, options?: SecretScopeOptions): Promise<string>;
+}
+interface CreateServerDelegateClientOptions {
+    privateKey: string;
+    host?: string;
+    delegation: DelegationInput;
+    prefix?: string;
+    nodeConfig?: CreateServerIdentityOptions["nodeConfig"];
+    node?: TinyCloudNodeLike;
+    nodeFactory?: (options: CreateServerIdentityOptions) => Promise<TinyCloudNodeLike>;
+}
+declare function createServerDelegateClient(options: CreateServerDelegateClientOptions): ServerDelegateClient;
+declare function readDelegatedSecret(node: TinyCloudNodeLike | TinyCloudNode, delegation: PortableDelegation, name: string, options?: SecretScopeOptions): Promise<string>;
+declare function parseDelegation(delegation: DelegationInput): PortableDelegation;
+declare function parseEncryptedEnvelope(rawEnvelope: unknown, name?: string): InlineEncryptedEnvelope;
+declare function parseSecretPayload(plaintext: Uint8Array, name?: string): string;
+
+declare class ServerAuthError extends Error {
+}
+declare class NonceStore {
+    private readonly ttlMs;
+    private readonly nonces;
+    constructor(ttlMs?: number);
+    issue(address: string): string;
+    validate(address: string, nonce: string): boolean;
+    private key;
+    private sweep;
+}
+interface VerifiedSiwe {
+    address: string;
+    nonce: string;
+}
+declare function verifySiweMessage(message: string, signature: string): Promise<VerifiedSiwe>;
+interface SessionToken {
+    token: string;
+    expiresIn: number;
+}
+interface SessionClaims {
+    sub: string;
+    address: string;
+    iat: number;
+    exp: number;
+}
+declare function issueSessionToken(address: string, secret: string, ttlSeconds?: number): SessionToken;
+declare function verifySessionToken(token: string, secret: string): {
+    address: string;
+};
+interface CreateSiweSessionOptions {
+    jwtSecret: string;
+    nonceStore?: NonceStore;
+    sessionTtlSeconds?: number;
+}
+declare function createSiweSession(options: CreateSiweSessionOptions): {
+    issueNonce(address: string): string;
+    verify(message: string, signature: string): Promise<SessionToken>;
+    verifyToken(token: string): {
+        address: string;
+    };
+};
+
+export { type CreateServerDelegateClientOptions, type CreateServerIdentityOptions, type CreateSiweSessionOptions, type DelegationInput, type DeriveDstackPrivateKeyOptions, type DstackKeyClient, NonceStore, ServerAuthError, type ServerDelegateClient, type ServerIdentity, type SessionClaims, type SessionToken, type VerifiedSiwe, createServerDelegateClient, createServerIdentity, createSiweSession, deriveDstackPrivateKey, isTinyCloudSessionError, issueSessionToken, parseDelegation, parseEncryptedEnvelope, parseSecretPayload, readDelegatedSecret, serverDidForPrivateKey, verifySessionToken, verifySiweMessage, withSessionRefresh };

package/dist/index.d.ts

@@ -0,0 +1,139 @@
+import { Hex } from 'viem';
+import { Manifest, TinyCloudNodeConfig, TinyCloudNode, PortableDelegation, InlineEncryptedEnvelope, SecretScopeOptions } from '@tinycloud/node-sdk';
+
+interface DstackKeyClient {
+    getKey(path: string, purpose: string): Promise<{
+        key: Uint8Array;
+    }>;
+}
+interface DeriveDstackPrivateKeyOptions {
+    client: DstackKeyClient;
+    path: string;
+    purpose: string;
+}
+declare function deriveDstackPrivateKey(options: DeriveDstackPrivateKeyOptions): Promise<Hex>;
+declare function serverDidForPrivateKey(privateKey: string): string;
+interface CreateServerIdentityOptions {
+    privateKey: string;
+    host?: string;
+    prefix?: string;
+    manifest?: Manifest | Manifest[];
+    autoCreateSpace?: boolean;
+    enablePublicSpace?: boolean;
+    includeAccountRegistryPermissions?: boolean;
+    nodeConfig?: Omit<TinyCloudNodeConfig, "privateKey" | "host" | "prefix" | "manifest" | "autoCreateSpace" | "enablePublicSpace" | "includeAccountRegistryPermissions">;
+}
+interface ServerIdentity {
+    node: TinyCloudNode;
+    did: string;
+    host: string;
+    privateKey: string;
+}
+declare function createServerIdentity(options: CreateServerIdentityOptions): Promise<ServerIdentity>;
+declare function isTinyCloudSessionError(error: unknown): boolean;
+declare function withSessionRefresh<T>(node: TinyCloudNode, fn: () => Promise<T>): Promise<T>;
+
+type KvLike = {
+    get<T = unknown>(key: string, options: {
+        raw: true;
+        prefix: string;
+    }): Promise<{
+        ok: true;
+        data: T | unknown;
+    } | {
+        ok: false;
+        error?: {
+            message?: string;
+        };
+    }>;
+};
+type DelegatedAccessLike = {
+    kv: KvLike;
+    delegation: Pick<PortableDelegation, "cid">;
+    restorable?: {
+        delegationCid?: string;
+    };
+};
+type DecryptResult = {
+    ok: true;
+    data: Uint8Array;
+} | {
+    ok: false;
+    error: {
+        code?: string;
+        message: string;
+    };
+};
+type EncryptionLike = {
+    decryptEnvelope(envelope: InlineEncryptedEnvelope, capabilityProof: {
+        proofs: string[];
+    }): Promise<DecryptResult>;
+};
+type TinyCloudNodeLike = {
+    signIn(): Promise<unknown>;
+    useDelegation(delegation: PortableDelegation): Promise<DelegatedAccessLike>;
+    encryption: EncryptionLike;
+};
+type DelegationInput = PortableDelegation | string;
+interface ServerDelegateClient {
+    getSecret(name: string, options?: SecretScopeOptions): Promise<string>;
+}
+interface CreateServerDelegateClientOptions {
+    privateKey: string;
+    host?: string;
+    delegation: DelegationInput;
+    prefix?: string;
+    nodeConfig?: CreateServerIdentityOptions["nodeConfig"];
+    node?: TinyCloudNodeLike;
+    nodeFactory?: (options: CreateServerIdentityOptions) => Promise<TinyCloudNodeLike>;
+}
+declare function createServerDelegateClient(options: CreateServerDelegateClientOptions): ServerDelegateClient;
+declare function readDelegatedSecret(node: TinyCloudNodeLike | TinyCloudNode, delegation: PortableDelegation, name: string, options?: SecretScopeOptions): Promise<string>;
+declare function parseDelegation(delegation: DelegationInput): PortableDelegation;
+declare function parseEncryptedEnvelope(rawEnvelope: unknown, name?: string): InlineEncryptedEnvelope;
+declare function parseSecretPayload(plaintext: Uint8Array, name?: string): string;
+
+declare class ServerAuthError extends Error {
+}
+declare class NonceStore {
+    private readonly ttlMs;
+    private readonly nonces;
+    constructor(ttlMs?: number);
+    issue(address: string): string;
+    validate(address: string, nonce: string): boolean;
+    private key;
+    private sweep;
+}
+interface VerifiedSiwe {
+    address: string;
+    nonce: string;
+}
+declare function verifySiweMessage(message: string, signature: string): Promise<VerifiedSiwe>;
+interface SessionToken {
+    token: string;
+    expiresIn: number;
+}
+interface SessionClaims {
+    sub: string;
+    address: string;
+    iat: number;
+    exp: number;
+}
+declare function issueSessionToken(address: string, secret: string, ttlSeconds?: number): SessionToken;
+declare function verifySessionToken(token: string, secret: string): {
+    address: string;
+};
+interface CreateSiweSessionOptions {
+    jwtSecret: string;
+    nonceStore?: NonceStore;
+    sessionTtlSeconds?: number;
+}
+declare function createSiweSession(options: CreateSiweSessionOptions): {
+    issueNonce(address: string): string;
+    verify(message: string, signature: string): Promise<SessionToken>;
+    verifyToken(token: string): {
+        address: string;
+    };
+};
+
+export { type CreateServerDelegateClientOptions, type CreateServerIdentityOptions, type CreateSiweSessionOptions, type DelegationInput, type DeriveDstackPrivateKeyOptions, type DstackKeyClient, NonceStore, ServerAuthError, type ServerDelegateClient, type ServerIdentity, type SessionClaims, type SessionToken, type VerifiedSiwe, createServerDelegateClient, createServerIdentity, createSiweSession, deriveDstackPrivateKey, isTinyCloudSessionError, issueSessionToken, parseDelegation, parseEncryptedEnvelope, parseSecretPayload, readDelegatedSecret, serverDidForPrivateKey, verifySessionToken, verifySiweMessage, withSessionRefresh };

package/dist/index.js

@@ -0,0 +1,293 @@
+// src/identity.ts
+import { keccak256 } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { TinyCloudNode } from "@tinycloud/node-sdk";
+var DEFAULT_HOST = "https://node.tinycloud.xyz";
+async function deriveDstackPrivateKey(options) {
+  const res = await options.client.getKey(options.path, options.purpose);
+  if (!(res.key instanceof Uint8Array) || res.key.length === 0) {
+    throw new Error("dstack getKey returned no key material");
+  }
+  return keccak256(res.key);
+}
+function serverDidForPrivateKey(privateKey) {
+  const account = privateKeyToAccount(privateKey);
+  return `did:pkh:eip155:1:${account.address}`;
+}
+async function createServerIdentity(options) {
+  const host = options.host ?? DEFAULT_HOST;
+  const node = new TinyCloudNode({
+    ...options.nodeConfig,
+    privateKey: options.privateKey,
+    host,
+    prefix: options.prefix,
+    manifest: options.manifest,
+    autoCreateSpace: options.autoCreateSpace ?? false,
+    enablePublicSpace: options.enablePublicSpace ?? false,
+    includeAccountRegistryPermissions: options.includeAccountRegistryPermissions ?? false
+  });
+  await node.signIn();
+  return {
+    node,
+    did: node.did,
+    host,
+    privateKey: options.privateKey
+  };
+}
+var SESSION_ERROR_PATTERN = /\b(session\s+expired|invalid\s+session|token\s+expired|expired\s+credentials?|unauthorized|unauthenticated|sign.?in\s*required)\b|\b401\b(?![\d-])/i;
+function isTinyCloudSessionError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return SESSION_ERROR_PATTERN.test(message);
+}
+async function withSessionRefresh(node, fn) {
+  try {
+    return await fn();
+  } catch (error) {
+    if (isTinyCloudSessionError(error)) {
+      await node.signIn();
+      return fn();
+    }
+    throw error;
+  }
+}
+
+// src/delegated-secrets.ts
+import {
+  deserializeDelegation
+} from "@tinycloud/node-sdk";
+import { resolveSecretPath } from "@tinycloud/sdk-core";
+function createServerDelegateClient(options) {
+  const delegation = parseDelegation(options.delegation);
+  let nodePromise;
+  async function getNode() {
+    if (!nodePromise) {
+      if (options.node) {
+        nodePromise = Promise.resolve(options.node);
+        return options.node;
+      }
+      const identityOptions = {
+        privateKey: options.privateKey,
+        host: options.host,
+        prefix: options.prefix,
+        enablePublicSpace: false,
+        includeAccountRegistryPermissions: false,
+        nodeConfig: options.nodeConfig
+      };
+      const created = options.nodeFactory ? options.nodeFactory(identityOptions) : createServerIdentity(identityOptions).then(
+        (identity) => identity.node
+      );
+      nodePromise = created;
+      return created;
+    }
+    return nodePromise;
+  }
+  return {
+    async getSecret(name, secretOptions) {
+      const node = await getNode();
+      return readDelegatedSecret(node, delegation, name, secretOptions);
+    }
+  };
+}
+async function readDelegatedSecret(node, delegation, name, options) {
+  const secretKey = resolveSecretPath(name, options).permissionPaths.vault;
+  const access = await node.useDelegation(delegation);
+  const result = await access.kv.get(secretKey, { raw: true, prefix: "" });
+  if (!result.ok) {
+    const message = result.error?.message ?? `failed to read ${secretKey}`;
+    throw new Error(`delegated secret ${name} KV get failed: ${message}`);
+  }
+  const envelope = parseEncryptedEnvelope(
+    result.data?.data,
+    name
+  );
+  const proofCid = access.restorable?.delegationCid ?? access.delegation.cid;
+  if (!proofCid) {
+    throw new Error(`delegated secret ${name} has no decrypt proof`);
+  }
+  const decrypted = await node.encryption.decryptEnvelope(envelope, { proofs: [proofCid] });
+  if (!decrypted.ok) {
+    throw new Error(`delegated secret ${name} decrypt failed: ${decrypted.error.message}`);
+  }
+  return parseSecretPayload(decrypted.data, name);
+}
+function parseDelegation(delegation) {
+  return typeof delegation === "string" ? deserializeDelegation(delegation) : delegation;
+}
+function parseEncryptedEnvelope(rawEnvelope, name = "secret") {
+  const parsed = typeof rawEnvelope === "string" ? JSON.parse(rawEnvelope) : rawEnvelope;
+  if (typeof parsed !== "object" || parsed === null || typeof parsed.v !== "number" || typeof parsed.networkId !== "string" || typeof parsed.ciphertext !== "string" || typeof parsed.encryptedSymmetricKey !== "string") {
+    throw new Error(`delegated secret ${name} did not contain an encrypted envelope`);
+  }
+  return parsed;
+}
+function parseSecretPayload(plaintext, name = "secret") {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(plaintext));
+  } catch {
+    throw new Error(`delegated secret ${name} did not contain valid JSON`);
+  }
+  if (typeof parsed.value !== "string") {
+    throw new Error(`delegated secret ${name} did not contain a string value`);
+  }
+  return parsed.value;
+}
+
+// src/siwe-session.ts
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { getAddress, recoverMessageAddress } from "viem";
+var DEFAULT_NONCE_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_SESSION_TTL_SECONDS = 24 * 60 * 60;
+var ServerAuthError = class extends Error {
+};
+var NonceStore = class {
+  constructor(ttlMs = DEFAULT_NONCE_TTL_MS) {
+    this.ttlMs = ttlMs;
+  }
+  nonces = /* @__PURE__ */ new Map();
+  issue(address) {
+    this.sweep();
+    const normalized = getAddress(address).toLowerCase();
+    const nonce = randomBytes(16).toString("hex");
+    this.nonces.set(this.key(normalized, nonce), {
+      address: normalized,
+      createdAt: Date.now()
+    });
+    return nonce;
+  }
+  validate(address, nonce) {
+    const normalized = getAddress(address).toLowerCase();
+    const key = this.key(normalized, nonce);
+    const entry = this.nonces.get(key);
+    if (!entry) return false;
+    this.nonces.delete(key);
+    return Date.now() - entry.createdAt <= this.ttlMs;
+  }
+  key(address, nonce) {
+    return `${address}:${nonce}`;
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [key, entry] of this.nonces) {
+      if (now - entry.createdAt > this.ttlMs) this.nonces.delete(key);
+    }
+  }
+};
+async function verifySiweMessage(message, signature) {
+  const lines = message.split("\n");
+  let claimed;
+  try {
+    claimed = getAddress((lines[1] ?? "").trim());
+  } catch {
+    throw new ServerAuthError("SIWE message is missing a valid address on line 2");
+  }
+  const nonceMatch = message.match(/^Nonce: (.+)$/m);
+  if (!nonceMatch || nonceMatch[1] === void 0) {
+    throw new ServerAuthError("SIWE message is missing a Nonce line");
+  }
+  const nonce = nonceMatch[1].trim();
+  let recovered;
+  try {
+    recovered = await recoverMessageAddress({ message, signature });
+  } catch (error) {
+    throw new ServerAuthError(
+      `SIWE signature recovery failed: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (getAddress(recovered) !== claimed) {
+    throw new ServerAuthError(
+      `SIWE signature does not match message address (recovered ${recovered}, expected ${claimed})`
+    );
+  }
+  return { address: claimed, nonce };
+}
+function issueSessionToken(address, secret, ttlSeconds = DEFAULT_SESSION_TTL_SECONDS) {
+  const normalized = getAddress(address);
+  const now = Math.floor(Date.now() / 1e3);
+  const claims = {
+    sub: normalized,
+    address: normalized,
+    iat: now,
+    exp: now + ttlSeconds
+  };
+  return {
+    token: signJwt({ alg: "HS256", typ: "JWT" }, claims, secret),
+    expiresIn: ttlSeconds
+  };
+}
+function verifySessionToken(token, secret) {
+  const claims = verifyJwt(token, secret);
+  if (typeof claims.sub !== "string" || claims.sub === "") {
+    throw new ServerAuthError("session token missing 'sub' claim");
+  }
+  return { address: claims.sub };
+}
+function createSiweSession(options) {
+  const nonceStore = options.nonceStore ?? new NonceStore();
+  const sessionTtlSeconds = options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS;
+  return {
+    issueNonce(address) {
+      return nonceStore.issue(address);
+    },
+    async verify(message, signature) {
+      const verified = await verifySiweMessage(message, signature);
+      if (!nonceStore.validate(verified.address, verified.nonce)) {
+        throw new ServerAuthError("nonce is invalid, expired, or already used");
+      }
+      return issueSessionToken(verified.address, options.jwtSecret, sessionTtlSeconds);
+    },
+    verifyToken(token) {
+      return verifySessionToken(token, options.jwtSecret);
+    }
+  };
+}
+function signJwt(header, payload, secret) {
+  const encodedHeader = base64UrlEncode(JSON.stringify(header));
+  const encodedPayload = base64UrlEncode(JSON.stringify(payload));
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signature = createHmac("sha256", secret).update(signingInput).digest();
+  return `${signingInput}.${base64UrlEncode(signature)}`;
+}
+function verifyJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) {
+    throw new ServerAuthError("session token is not a valid JWT");
+  }
+  const signingInput = `${parts[0]}.${parts[1]}`;
+  const expected = createHmac("sha256", secret).update(signingInput).digest();
+  const actual = base64UrlDecode(parts[2]);
+  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+    throw new ServerAuthError("session token signature verification failed");
+  }
+  const claims = JSON.parse(base64UrlDecode(parts[1]).toString("utf8"));
+  if (typeof claims.exp !== "number" || claims.exp <= Math.floor(Date.now() / 1e3)) {
+    throw new ServerAuthError("session token expired");
+  }
+  return claims;
+}
+function base64UrlEncode(value) {
+  const buffer = typeof value === "string" ? Buffer.from(value, "utf8") : value;
+  return buffer.toString("base64url");
+}
+function base64UrlDecode(value) {
+  return Buffer.from(value, "base64url");
+}
+export {
+  NonceStore,
+  ServerAuthError,
+  createServerDelegateClient,
+  createServerIdentity,
+  createSiweSession,
+  deriveDstackPrivateKey,
+  isTinyCloudSessionError,
+  issueSessionToken,
+  parseDelegation,
+  parseEncryptedEnvelope,
+  parseSecretPayload,
+  readDelegatedSecret,
+  serverDidForPrivateKey,
+  verifySessionToken,
+  verifySiweMessage,
+  withSessionRefresh
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/identity.ts","../src/delegated-secrets.ts","../src/siwe-session.ts"],"sourcesContent":["import { keccak256, type Hex } from \"viem\";\nimport { privateKeyToAccount } from \"viem/accounts\";\nimport { TinyCloudNode, type Manifest, type TinyCloudNodeConfig } from \"@tinycloud/node-sdk\";\n\nconst DEFAULT_HOST = \"https://node.tinycloud.xyz\";\n\nexport interface DstackKeyClient {\n  getKey(path: string, purpose: string): Promise<{ key: Uint8Array }>;\n}\n\nexport interface DeriveDstackPrivateKeyOptions {\n  client: DstackKeyClient;\n  path: string;\n  purpose: string;\n}\n\nexport async function deriveDstackPrivateKey(\n  options: DeriveDstackPrivateKeyOptions,\n): Promise<Hex> {\n  const res = await options.client.getKey(options.path, options.purpose);\n  if (!(res.key instanceof Uint8Array) || res.key.length === 0) {\n    throw new Error(\"dstack getKey returned no key material\");\n  }\n  return keccak256(res.key);\n}\n\nexport function serverDidForPrivateKey(privateKey: string): string {\n  const account = privateKeyToAccount(privateKey as Hex);\n  return `did:pkh:eip155:1:${account.address}`;\n}\n\nexport interface CreateServerIdentityOptions {\n  privateKey: string;\n  host?: string;\n  prefix?: string;\n  manifest?: Manifest | Manifest[];\n  autoCreateSpace?: boolean;\n  enablePublicSpace?: boolean;\n  includeAccountRegistryPermissions?: boolean;\n  nodeConfig?: Omit<\n    TinyCloudNodeConfig,\n    | \"privateKey\"\n    | \"host\"\n    | \"prefix\"\n    | \"manifest\"\n    | \"autoCreateSpace\"\n    | \"enablePublicSpace\"\n    | \"includeAccountRegistryPermissions\"\n  >;\n}\n\nexport interface ServerIdentity {\n  node: TinyCloudNode;\n  did: string;\n  host: string;\n  privateKey: string;\n}\n\nexport async function createServerIdentity(\n  options: CreateServerIdentityOptions,\n): Promise<ServerIdentity> {\n  const host = options.host ?? DEFAULT_HOST;\n  const node = new TinyCloudNode({\n    ...options.nodeConfig,\n    privateKey: options.privateKey,\n    host,\n    prefix: options.prefix,\n    manifest: options.manifest,\n    autoCreateSpace: options.autoCreateSpace ?? false,\n    enablePublicSpace: options.enablePublicSpace ?? false,\n    includeAccountRegistryPermissions: options.includeAccountRegistryPermissions ?? false,\n  });\n\n  await node.signIn();\n\n  return {\n    node,\n    did: node.did,\n    host,\n    privateKey: options.privateKey,\n  };\n}\n\nconst SESSION_ERROR_PATTERN =\n  /\\b(session\\s+expired|invalid\\s+session|token\\s+expired|expired\\s+credentials?|unauthorized|unauthenticated|sign.?in\\s*required)\\b|\\b401\\b(?![\\d-])/i;\n\nexport function isTinyCloudSessionError(error: unknown): boolean {\n  const message = error instanceof Error ? error.message : String(error);\n  return SESSION_ERROR_PATTERN.test(message);\n}\n\nexport async function withSessionRefresh<T>(\n  node: TinyCloudNode,\n  fn: () => Promise<T>,\n): Promise<T> {\n  try {\n    return await fn();\n  } catch (error) {\n    if (isTinyCloudSessionError(error)) {\n      await node.signIn();\n      return fn();\n    }\n    throw error;\n  }\n}\n","import {\n  TinyCloudNode,\n  deserializeDelegation,\n  type InlineEncryptedEnvelope,\n  type PortableDelegation,\n  type SecretScopeOptions,\n} from \"@tinycloud/node-sdk\";\nimport { resolveSecretPath } from \"@tinycloud/sdk-core\";\nimport type { CreateServerIdentityOptions } from \"./identity.js\";\nimport { createServerIdentity } from \"./identity.js\";\n\ntype KvLike = {\n  get<T = unknown>(\n    key: string,\n    options: { raw: true; prefix: string },\n  ): Promise<{ ok: true; data: T | unknown } | { ok: false; error?: { message?: string } }>;\n};\n\ntype DelegatedAccessLike = {\n  kv: KvLike;\n  delegation: Pick<PortableDelegation, \"cid\">;\n  restorable?: { delegationCid?: string };\n};\n\ntype DecryptResult =\n  | { ok: true; data: Uint8Array }\n  | { ok: false; error: { code?: string; message: string } };\n\ntype EncryptionLike = {\n  decryptEnvelope(\n    envelope: InlineEncryptedEnvelope,\n    capabilityProof: { proofs: string[] },\n  ): Promise<DecryptResult>;\n};\n\ntype TinyCloudNodeLike = {\n  signIn(): Promise<unknown>;\n  useDelegation(delegation: PortableDelegation): Promise<DelegatedAccessLike>;\n  encryption: EncryptionLike;\n};\n\nexport type DelegationInput = PortableDelegation | string;\n\nexport interface ServerDelegateClient {\n  getSecret(name: string, options?: SecretScopeOptions): Promise<string>;\n}\n\nexport interface CreateServerDelegateClientOptions {\n  privateKey: string;\n  host?: string;\n  delegation: DelegationInput;\n  prefix?: string;\n  nodeConfig?: CreateServerIdentityOptions[\"nodeConfig\"];\n  node?: TinyCloudNodeLike;\n  nodeFactory?: (options: CreateServerIdentityOptions) => Promise<TinyCloudNodeLike>;\n}\n\nexport function createServerDelegateClient(\n  options: CreateServerDelegateClientOptions,\n): ServerDelegateClient {\n  const delegation = parseDelegation(options.delegation);\n  let nodePromise: Promise<TinyCloudNodeLike> | undefined;\n\n  async function getNode(): Promise<TinyCloudNodeLike> {\n    if (!nodePromise) {\n      if (options.node) {\n        nodePromise = Promise.resolve(options.node);\n        return options.node;\n      }\n      const identityOptions: CreateServerIdentityOptions = {\n        privateKey: options.privateKey,\n        host: options.host,\n        prefix: options.prefix,\n        enablePublicSpace: false,\n        includeAccountRegistryPermissions: false,\n        nodeConfig: options.nodeConfig,\n      };\n      const created = options.nodeFactory\n        ? options.nodeFactory(identityOptions)\n        : createServerIdentity(identityOptions).then(\n            (identity) => identity.node as unknown as TinyCloudNodeLike,\n          );\n      nodePromise = created;\n      return created;\n    }\n    return nodePromise;\n  }\n\n  return {\n    async getSecret(name: string, secretOptions?: SecretScopeOptions): Promise<string> {\n      const node = await getNode();\n      return readDelegatedSecret(node, delegation, name, secretOptions);\n    },\n  };\n}\n\nexport async function readDelegatedSecret(\n  node: TinyCloudNodeLike | TinyCloudNode,\n  delegation: PortableDelegation,\n  name: string,\n  options?: SecretScopeOptions,\n): Promise<string> {\n  const secretKey = resolveSecretPath(name, options).permissionPaths.vault;\n\n  const access = await node.useDelegation(delegation);\n  const result = await access.kv.get<unknown>(secretKey, { raw: true, prefix: \"\" });\n  if (!result.ok) {\n    const message = result.error?.message ?? `failed to read ${secretKey}`;\n    throw new Error(`delegated secret ${name} KV get failed: ${message}`);\n  }\n\n  const envelope = parseEncryptedEnvelope(\n    (result.data as { data?: unknown } | undefined)?.data,\n    name,\n  );\n  const proofCid = access.restorable?.delegationCid ?? access.delegation.cid;\n  if (!proofCid) {\n    throw new Error(`delegated secret ${name} has no decrypt proof`);\n  }\n\n  const decrypted = await node.encryption.decryptEnvelope(envelope, { proofs: [proofCid] });\n  if (!decrypted.ok) {\n    throw new Error(`delegated secret ${name} decrypt failed: ${decrypted.error.message}`);\n  }\n\n  return parseSecretPayload(decrypted.data, name);\n}\n\nexport function parseDelegation(delegation: DelegationInput): PortableDelegation {\n  return typeof delegation === \"string\" ? deserializeDelegation(delegation) : delegation;\n}\n\nexport function parseEncryptedEnvelope(\n  rawEnvelope: unknown,\n  name = \"secret\",\n): InlineEncryptedEnvelope {\n  const parsed = typeof rawEnvelope === \"string\" ? JSON.parse(rawEnvelope) : rawEnvelope;\n  if (\n    typeof parsed !== \"object\" ||\n    parsed === null ||\n    typeof (parsed as Partial<InlineEncryptedEnvelope>).v !== \"number\" ||\n    typeof (parsed as Partial<InlineEncryptedEnvelope>).networkId !== \"string\" ||\n    typeof (parsed as Partial<InlineEncryptedEnvelope>).ciphertext !== \"string\" ||\n    typeof (parsed as Partial<InlineEncryptedEnvelope>).encryptedSymmetricKey !== \"string\"\n  ) {\n    throw new Error(`delegated secret ${name} did not contain an encrypted envelope`);\n  }\n  return parsed as InlineEncryptedEnvelope;\n}\n\nexport function parseSecretPayload(plaintext: Uint8Array, name = \"secret\"): string {\n  let parsed: { value?: unknown };\n  try {\n    parsed = JSON.parse(new TextDecoder().decode(plaintext)) as { value?: unknown };\n  } catch {\n    throw new Error(`delegated secret ${name} did not contain valid JSON`);\n  }\n  if (typeof parsed.value !== \"string\") {\n    throw new Error(`delegated secret ${name} did not contain a string value`);\n  }\n  return parsed.value;\n}\n","import { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { getAddress, recoverMessageAddress, type Hex } from \"viem\";\n\nconst DEFAULT_NONCE_TTL_MS = 5 * 60 * 1000;\nconst DEFAULT_SESSION_TTL_SECONDS = 24 * 60 * 60;\n\ninterface NonceEntry {\n  address: string;\n  createdAt: number;\n}\n\nexport class ServerAuthError extends Error {}\n\nexport class NonceStore {\n  private readonly nonces = new Map<string, NonceEntry>();\n\n  constructor(private readonly ttlMs = DEFAULT_NONCE_TTL_MS) {}\n\n  issue(address: string): string {\n    this.sweep();\n    const normalized = getAddress(address).toLowerCase();\n    const nonce = randomBytes(16).toString(\"hex\");\n    this.nonces.set(this.key(normalized, nonce), {\n      address: normalized,\n      createdAt: Date.now(),\n    });\n    return nonce;\n  }\n\n  validate(address: string, nonce: string): boolean {\n    const normalized = getAddress(address).toLowerCase();\n    const key = this.key(normalized, nonce);\n    const entry = this.nonces.get(key);\n    if (!entry) return false;\n    this.nonces.delete(key);\n    return Date.now() - entry.createdAt <= this.ttlMs;\n  }\n\n  private key(address: string, nonce: string): string {\n    return `${address}:${nonce}`;\n  }\n\n  private sweep(): void {\n    const now = Date.now();\n    for (const [key, entry] of this.nonces) {\n      if (now - entry.createdAt > this.ttlMs) this.nonces.delete(key);\n    }\n  }\n}\n\nexport interface VerifiedSiwe {\n  address: string;\n  nonce: string;\n}\n\nexport async function verifySiweMessage(\n  message: string,\n  signature: string,\n): Promise<VerifiedSiwe> {\n  const lines = message.split(\"\\n\");\n  let claimed: string;\n  try {\n    claimed = getAddress((lines[1] ?? \"\").trim());\n  } catch {\n    throw new ServerAuthError(\"SIWE message is missing a valid address on line 2\");\n  }\n\n  const nonceMatch = message.match(/^Nonce: (.+)$/m);\n  if (!nonceMatch || nonceMatch[1] === undefined) {\n    throw new ServerAuthError(\"SIWE message is missing a Nonce line\");\n  }\n  const nonce = nonceMatch[1].trim();\n\n  let recovered: string;\n  try {\n    recovered = await recoverMessageAddress({ message, signature: signature as Hex });\n  } catch (error) {\n    throw new ServerAuthError(\n      `SIWE signature recovery failed: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n  if (getAddress(recovered) !== claimed) {\n    throw new ServerAuthError(\n      `SIWE signature does not match message address (recovered ${recovered}, expected ${claimed})`,\n    );\n  }\n\n  return { address: claimed, nonce };\n}\n\nexport interface SessionToken {\n  token: string;\n  expiresIn: number;\n}\n\nexport interface SessionClaims {\n  sub: string;\n  address: string;\n  iat: number;\n  exp: number;\n}\n\nexport function issueSessionToken(\n  address: string,\n  secret: string,\n  ttlSeconds = DEFAULT_SESSION_TTL_SECONDS,\n): SessionToken {\n  const normalized = getAddress(address);\n  const now = Math.floor(Date.now() / 1000);\n  const claims: SessionClaims = {\n    sub: normalized,\n    address: normalized,\n    iat: now,\n    exp: now + ttlSeconds,\n  };\n  return {\n    token: signJwt({ alg: \"HS256\", typ: \"JWT\" }, claims, secret),\n    expiresIn: ttlSeconds,\n  };\n}\n\nexport function verifySessionToken(token: string, secret: string): { address: string } {\n  const claims = verifyJwt(token, secret);\n  if (typeof claims.sub !== \"string\" || claims.sub === \"\") {\n    throw new ServerAuthError(\"session token missing 'sub' claim\");\n  }\n  return { address: claims.sub };\n}\n\nexport interface CreateSiweSessionOptions {\n  jwtSecret: string;\n  nonceStore?: NonceStore;\n  sessionTtlSeconds?: number;\n}\n\nexport function createSiweSession(options: CreateSiweSessionOptions) {\n  const nonceStore = options.nonceStore ?? new NonceStore();\n  const sessionTtlSeconds = options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS;\n\n  return {\n    issueNonce(address: string): string {\n      return nonceStore.issue(address);\n    },\n    async verify(message: string, signature: string): Promise<SessionToken> {\n      const verified = await verifySiweMessage(message, signature);\n      if (!nonceStore.validate(verified.address, verified.nonce)) {\n        throw new ServerAuthError(\"nonce is invalid, expired, or already used\");\n      }\n      return issueSessionToken(verified.address, options.jwtSecret, sessionTtlSeconds);\n    },\n    verifyToken(token: string): { address: string } {\n      return verifySessionToken(token, options.jwtSecret);\n    },\n  };\n}\n\nfunction signJwt(header: object, payload: object, secret: string): string {\n  const encodedHeader = base64UrlEncode(JSON.stringify(header));\n  const encodedPayload = base64UrlEncode(JSON.stringify(payload));\n  const signingInput = `${encodedHeader}.${encodedPayload}`;\n  const signature = createHmac(\"sha256\", secret).update(signingInput).digest();\n  return `${signingInput}.${base64UrlEncode(signature)}`;\n}\n\nfunction verifyJwt(token: string, secret: string): SessionClaims {\n  const parts = token.split(\".\");\n  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) {\n    throw new ServerAuthError(\"session token is not a valid JWT\");\n  }\n\n  const signingInput = `${parts[0]}.${parts[1]}`;\n  const expected = createHmac(\"sha256\", secret).update(signingInput).digest();\n  const actual = base64UrlDecode(parts[2]);\n  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {\n    throw new ServerAuthError(\"session token signature verification failed\");\n  }\n\n  const claims = JSON.parse(base64UrlDecode(parts[1]).toString(\"utf8\")) as SessionClaims;\n  if (typeof claims.exp !== \"number\" || claims.exp <= Math.floor(Date.now() / 1000)) {\n    throw new ServerAuthError(\"session token expired\");\n  }\n  return claims;\n}\n\nfunction base64UrlEncode(value: string | Buffer): string {\n  const buffer = typeof value === \"string\" ? Buffer.from(value, \"utf8\") : value;\n  return buffer.toString(\"base64url\");\n}\n\nfunction base64UrlDecode(value: string): Buffer {\n  return Buffer.from(value, \"base64url\");\n}\n"],"mappings":";AAAA,SAAS,iBAA2B;AACpC,SAAS,2BAA2B;AACpC,SAAS,qBAA8D;AAEvE,IAAM,eAAe;AAYrB,eAAsB,uBACpB,SACc;AACd,QAAM,MAAM,MAAM,QAAQ,OAAO,OAAO,QAAQ,MAAM,QAAQ,OAAO;AACrE,MAAI,EAAE,IAAI,eAAe,eAAe,IAAI,IAAI,WAAW,GAAG;AAC5D,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,SAAO,UAAU,IAAI,GAAG;AAC1B;AAEO,SAAS,uBAAuB,YAA4B;AACjE,QAAM,UAAU,oBAAoB,UAAiB;AACrD,SAAO,oBAAoB,QAAQ,OAAO;AAC5C;AA6BA,eAAsB,qBACpB,SACyB;AACzB,QAAM,OAAO,QAAQ,QAAQ;AAC7B,QAAM,OAAO,IAAI,cAAc;AAAA,IAC7B,GAAG,QAAQ;AAAA,IACX,YAAY,QAAQ;AAAA,IACpB;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,iBAAiB,QAAQ,mBAAmB;AAAA,IAC5C,mBAAmB,QAAQ,qBAAqB;AAAA,IAChD,mCAAmC,QAAQ,qCAAqC;AAAA,EAClF,CAAC;AAED,QAAM,KAAK,OAAO;AAElB,SAAO;AAAA,IACL;AAAA,IACA,KAAK,KAAK;AAAA,IACV;AAAA,IACA,YAAY,QAAQ;AAAA,EACtB;AACF;AAEA,IAAM,wBACJ;AAEK,SAAS,wBAAwB,OAAyB;AAC/D,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,SAAO,sBAAsB,KAAK,OAAO;AAC3C;AAEA,eAAsB,mBACpB,MACA,IACY;AACZ,MAAI;AACF,WAAO,MAAM,GAAG;AAAA,EAClB,SAAS,OAAO;AACd,QAAI,wBAAwB,KAAK,GAAG;AAClC,YAAM,KAAK,OAAO;AAClB,aAAO,GAAG;AAAA,IACZ;AACA,UAAM;AAAA,EACR;AACF;;;ACxGA;AAAA,EAEE;AAAA,OAIK;AACP,SAAS,yBAAyB;AAkD3B,SAAS,2BACd,SACsB;AACtB,QAAM,aAAa,gBAAgB,QAAQ,UAAU;AACrD,MAAI;AAEJ,iBAAe,UAAsC;AACnD,QAAI,CAAC,aAAa;AAChB,UAAI,QAAQ,MAAM;AAChB,sBAAc,QAAQ,QAAQ,QAAQ,IAAI;AAC1C,eAAO,QAAQ;AAAA,MACjB;AACA,YAAM,kBAA+C;AAAA,QACnD,YAAY,QAAQ;AAAA,QACpB,MAAM,QAAQ;AAAA,QACd,QAAQ,QAAQ;AAAA,QAChB,mBAAmB;AAAA,QACnB,mCAAmC;AAAA,QACnC,YAAY,QAAQ;AAAA,MACtB;AACA,YAAM,UAAU,QAAQ,cACpB,QAAQ,YAAY,eAAe,IACnC,qBAAqB,eAAe,EAAE;AAAA,QACpC,CAAC,aAAa,SAAS;AAAA,MACzB;AACJ,oBAAc;AACd,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,MAAc,eAAqD;AACjF,YAAM,OAAO,MAAM,QAAQ;AAC3B,aAAO,oBAAoB,MAAM,YAAY,MAAM,aAAa;AAAA,IAClE;AAAA,EACF;AACF;AAEA,eAAsB,oBACpB,MACA,YACA,MACA,SACiB;AACjB,QAAM,YAAY,kBAAkB,MAAM,OAAO,EAAE,gBAAgB;AAEnE,QAAM,SAAS,MAAM,KAAK,cAAc,UAAU;AAClD,QAAM,SAAS,MAAM,OAAO,GAAG,IAAa,WAAW,EAAE,KAAK,MAAM,QAAQ,GAAG,CAAC;AAChF,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,OAAO,WAAW,kBAAkB,SAAS;AACpE,UAAM,IAAI,MAAM,oBAAoB,IAAI,mBAAmB,OAAO,EAAE;AAAA,EACtE;AAEA,QAAM,WAAW;AAAA,IACd,OAAO,MAAyC;AAAA,IACjD;AAAA,EACF;AACA,QAAM,WAAW,OAAO,YAAY,iBAAiB,OAAO,WAAW;AACvE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,oBAAoB,IAAI,uBAAuB;AAAA,EACjE;AAEA,QAAM,YAAY,MAAM,KAAK,WAAW,gBAAgB,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACxF,MAAI,CAAC,UAAU,IAAI;AACjB,UAAM,IAAI,MAAM,oBAAoB,IAAI,oBAAoB,UAAU,MAAM,OAAO,EAAE;AAAA,EACvF;AAEA,SAAO,mBAAmB,UAAU,MAAM,IAAI;AAChD;AAEO,SAAS,gBAAgB,YAAiD;AAC/E,SAAO,OAAO,eAAe,WAAW,sBAAsB,UAAU,IAAI;AAC9E;AAEO,SAAS,uBACd,aACA,OAAO,UACkB;AACzB,QAAM,SAAS,OAAO,gBAAgB,WAAW,KAAK,MAAM,WAAW,IAAI;AAC3E,MACE,OAAO,WAAW,YAClB,WAAW,QACX,OAAQ,OAA4C,MAAM,YAC1D,OAAQ,OAA4C,cAAc,YAClE,OAAQ,OAA4C,eAAe,YACnE,OAAQ,OAA4C,0BAA0B,UAC9E;AACA,UAAM,IAAI,MAAM,oBAAoB,IAAI,wCAAwC;AAAA,EAClF;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,WAAuB,OAAO,UAAkB;AACjF,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,MAAM,oBAAoB,IAAI,6BAA6B;AAAA,EACvE;AACA,MAAI,OAAO,OAAO,UAAU,UAAU;AACpC,UAAM,IAAI,MAAM,oBAAoB,IAAI,iCAAiC;AAAA,EAC3E;AACA,SAAO,OAAO;AAChB;;;ACjKA,SAAS,YAAY,aAAa,uBAAuB;AACzD,SAAS,YAAY,6BAAuC;AAE5D,IAAM,uBAAuB,IAAI,KAAK;AACtC,IAAM,8BAA8B,KAAK,KAAK;AAOvC,IAAM,kBAAN,cAA8B,MAAM;AAAC;AAErC,IAAM,aAAN,MAAiB;AAAA,EAGtB,YAA6B,QAAQ,sBAAsB;AAA9B;AAAA,EAA+B;AAAA,EAF3C,SAAS,oBAAI,IAAwB;AAAA,EAItD,MAAM,SAAyB;AAC7B,SAAK,MAAM;AACX,UAAM,aAAa,WAAW,OAAO,EAAE,YAAY;AACnD,UAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,SAAK,OAAO,IAAI,KAAK,IAAI,YAAY,KAAK,GAAG;AAAA,MAC3C,SAAS;AAAA,MACT,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,SAAiB,OAAwB;AAChD,UAAM,aAAa,WAAW,OAAO,EAAE,YAAY;AACnD,UAAM,MAAM,KAAK,IAAI,YAAY,KAAK;AACtC,UAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AACjC,QAAI,CAAC,MAAO,QAAO;AACnB,SAAK,OAAO,OAAO,GAAG;AACtB,WAAO,KAAK,IAAI,IAAI,MAAM,aAAa,KAAK;AAAA,EAC9C;AAAA,EAEQ,IAAI,SAAiB,OAAuB;AAClD,WAAO,GAAG,OAAO,IAAI,KAAK;AAAA,EAC5B;AAAA,EAEQ,QAAc;AACpB,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,QAAQ;AACtC,UAAI,MAAM,MAAM,YAAY,KAAK,MAAO,MAAK,OAAO,OAAO,GAAG;AAAA,IAChE;AAAA,EACF;AACF;AAOA,eAAsB,kBACpB,SACA,WACuB;AACvB,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,MAAI;AACJ,MAAI;AACF,cAAU,YAAY,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;AAAA,EAC9C,QAAQ;AACN,UAAM,IAAI,gBAAgB,mDAAmD;AAAA,EAC/E;AAEA,QAAM,aAAa,QAAQ,MAAM,gBAAgB;AACjD,MAAI,CAAC,cAAc,WAAW,CAAC,MAAM,QAAW;AAC9C,UAAM,IAAI,gBAAgB,sCAAsC;AAAA,EAClE;AACA,QAAM,QAAQ,WAAW,CAAC,EAAE,KAAK;AAEjC,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,sBAAsB,EAAE,SAAS,UAA4B,CAAC;AAAA,EAClF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,mCAAmC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC3F;AAAA,EACF;AACA,MAAI,WAAW,SAAS,MAAM,SAAS;AACrC,UAAM,IAAI;AAAA,MACR,4DAA4D,SAAS,cAAc,OAAO;AAAA,IAC5F;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,SAAS,MAAM;AACnC;AAcO,SAAS,kBACd,SACA,QACA,aAAa,6BACC;AACd,QAAM,aAAa,WAAW,OAAO;AACrC,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,SAAwB;AAAA,IAC5B,KAAK;AAAA,IACL,SAAS;AAAA,IACT,KAAK;AAAA,IACL,KAAK,MAAM;AAAA,EACb;AACA,SAAO;AAAA,IACL,OAAO,QAAQ,EAAE,KAAK,SAAS,KAAK,MAAM,GAAG,QAAQ,MAAM;AAAA,IAC3D,WAAW;AAAA,EACb;AACF;AAEO,SAAS,mBAAmB,OAAe,QAAqC;AACrF,QAAM,SAAS,UAAU,OAAO,MAAM;AACtC,MAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,QAAQ,IAAI;AACvD,UAAM,IAAI,gBAAgB,mCAAmC;AAAA,EAC/D;AACA,SAAO,EAAE,SAAS,OAAO,IAAI;AAC/B;AAQO,SAAS,kBAAkB,SAAmC;AACnE,QAAM,aAAa,QAAQ,cAAc,IAAI,WAAW;AACxD,QAAM,oBAAoB,QAAQ,qBAAqB;AAEvD,SAAO;AAAA,IACL,WAAW,SAAyB;AAClC,aAAO,WAAW,MAAM,OAAO;AAAA,IACjC;AAAA,IACA,MAAM,OAAO,SAAiB,WAA0C;AACtE,YAAM,WAAW,MAAM,kBAAkB,SAAS,SAAS;AAC3D,UAAI,CAAC,WAAW,SAAS,SAAS,SAAS,SAAS,KAAK,GAAG;AAC1D,cAAM,IAAI,gBAAgB,4CAA4C;AAAA,MACxE;AACA,aAAO,kBAAkB,SAAS,SAAS,QAAQ,WAAW,iBAAiB;AAAA,IACjF;AAAA,IACA,YAAY,OAAoC;AAC9C,aAAO,mBAAmB,OAAO,QAAQ,SAAS;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,QAAQ,QAAgB,SAAiB,QAAwB;AACxE,QAAM,gBAAgB,gBAAgB,KAAK,UAAU,MAAM,CAAC;AAC5D,QAAM,iBAAiB,gBAAgB,KAAK,UAAU,OAAO,CAAC;AAC9D,QAAM,eAAe,GAAG,aAAa,IAAI,cAAc;AACvD,QAAM,YAAY,WAAW,UAAU,MAAM,EAAE,OAAO,YAAY,EAAE,OAAO;AAC3E,SAAO,GAAG,YAAY,IAAI,gBAAgB,SAAS,CAAC;AACtD;AAEA,SAAS,UAAU,OAAe,QAA+B;AAC/D,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;AAC7D,UAAM,IAAI,gBAAgB,kCAAkC;AAAA,EAC9D;AAEA,QAAM,eAAe,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAC5C,QAAM,WAAW,WAAW,UAAU,MAAM,EAAE,OAAO,YAAY,EAAE,OAAO;AAC1E,QAAM,SAAS,gBAAgB,MAAM,CAAC,CAAC;AACvC,MAAI,OAAO,WAAW,SAAS,UAAU,CAAC,gBAAgB,QAAQ,QAAQ,GAAG;AAC3E,UAAM,IAAI,gBAAgB,6CAA6C;AAAA,EACzE;AAEA,QAAM,SAAS,KAAK,MAAM,gBAAgB,MAAM,CAAC,CAAC,EAAE,SAAS,MAAM,CAAC;AACpE,MAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AACjF,UAAM,IAAI,gBAAgB,uBAAuB;AAAA,EACnD;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAgC;AACvD,QAAM,SAAS,OAAO,UAAU,WAAW,OAAO,KAAK,OAAO,MAAM,IAAI;AACxE,SAAO,OAAO,SAAS,WAAW;AACpC;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,OAAO,KAAK,OAAO,WAAW;AACvC;","names":[]}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@tinycloud/server",
+  "version": "2.4.0-beta.20",
+  "description": "Reusable TinyCloud server and agent integration helpers",
+  "author": "TinyCloud, Inc.",
+  "license": "EGPL",
+  "type": "module",
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "clean": "rm -rf dist",
+    "test": "bun test src/"
+  },
+  "dependencies": {
+    "@tinycloud/node-sdk": "2.4.0-beta.19",
+    "@tinycloud/sdk-core": "2.4.0-beta.19",
+    "viem": "^2.21.53"
+  },
+  "devDependencies": {
+    "@types/node": "^20",
+    "tsup": "^8.0.0",
+    "typescript": "^5.9.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/tinycloudlabs/web-sdk"
+  }
+}