@tinycloud/node-sdk 1.5.0 → 1.7.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { ISigner, Bytes, ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ClientSession, TinyCloudSession, Extension, Delegation, IKVService, ISQLService, IDataVaultService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISharingService, CreateDelegationParams, DelegationResult, KeyProvider, JWK } from '@tinycloud/sdk-core';
-export { AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, CreateDelegationParams, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IKVService, IPrefixedKVService, ISQLService, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IngestOptions, InvokeFunction, JWK, KVResponse, KVService, KVServiceConfig, KeyInfo, KeyProvider, KeyType, PersistedSessionData, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, SQLAction, SQLActionType, SQLService, SQLServiceConfig, ServiceContext, ServiceContextConfig, ServiceSession, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignRequest, SignResponse, Space, SpaceConfig, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TinyCloud, TinyCloudConfig, TinyCloudSession, VaultAction, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPutOptions, VersionCheckError, WasmVaultFunctions, buildSpaceUri, checkNodeVersion, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, makePublicSpaceId, parseSpaceUri } from '@tinycloud/sdk-core';
+import { ISigner, Bytes, ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ClientSession, TinyCloudSession, Extension, Delegation, IKVService, ISQLService, IDuckDbService, IDataVaultService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISharingService, CreateDelegationParams, DelegationResult, KeyProvider, JWK } from '@tinycloud/sdk-core';
+export { AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, CreateDelegationParams, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IKVService, IPrefixedKVService, ISQLService, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IngestOptions, InvokeFunction, JWK, KVResponse, KVService, KVServiceConfig, KeyInfo, KeyProvider, KeyType, PersistedSessionData, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, ServiceContext, ServiceContextConfig, ServiceSession, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignRequest, SignResponse, Space, SpaceConfig, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, buildSpaceUri, checkNodeInfo, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, makePublicSpaceId, parseSpaceUri } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { TCWSessionManager } from '@tinycloud/node-sdk-wasm';
 
@@ -292,6 +292,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private _tinyCloudSession?;
     private _address?;
     private _chainId?;
+    private _nodeFeatures;
     constructor(config: NodeUserAuthorizationConfig);
     /**
      * The current active session (web-core compatible).
@@ -302,6 +303,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * Includes spaceId, delegationHeader, and delegationCid.
      */
     get tinyCloudSession(): TinyCloudSession | undefined;
+    get nodeFeatures(): string[];
     /**
      * Add an extension to the authorization flow.
      */
@@ -440,6 +442,8 @@ interface PortableDelegation extends Omit<Delegation, "isRevoked"> {
     host?: string;
     /** Whether the recipient is prevented from creating sub-delegations */
     disableSubDelegation?: boolean;
+    /** Companion delegation for the user's public space (auto-created when includePublicSpace is true) */
+    publicDelegation?: PortableDelegation;
 }
 /**
  * Serialize a PortableDelegation for transport (e.g., over network).
@@ -463,6 +467,7 @@ declare class DelegatedAccess {
     private _serviceContext;
     private _kv;
     private _sql;
+    private _duckdb;
     constructor(session: TinyCloudSession, delegation: PortableDelegation, host: string);
     /**
      * Get the delegation this access was created from.
@@ -484,6 +489,10 @@ declare class DelegatedAccess {
      * SQL operations on the delegated space.
      */
     get sql(): ISQLService;
+    /**
+     * DuckDB operations on the delegated space.
+     */
+    get duckdb(): IDuckDbService;
 }
 
 /**
@@ -562,6 +571,7 @@ declare class TinyCloudNode {
     private _serviceContext?;
     private _kv?;
     private _sql?;
+    private _duckdb?;
     private _vault?;
     /** Cached public KV with proper delegation (set by ensurePublicSpace) */
     private _publicKV?;
@@ -574,6 +584,7 @@ declare class TinyCloudNode {
     private _sharingService;
     private _delegationManager?;
     private _spaceService?;
+    private get nodeFeatures();
     /**
      * Create a new TinyCloudNode instance.
      *
@@ -722,6 +733,10 @@ declare class TinyCloudNode {
      * SQL database operations on this user's space.
      */
     get sql(): ISQLService;
+    /**
+     * DuckDB database operations on this user's space.
+     */
+    get duckdb(): IDuckDbService;
     /**
      * Data Vault operations - client-side encrypted KV storage.
      * Call `vault.unlock(signer)` after signIn() to derive encryption keys.
@@ -940,6 +955,8 @@ declare class TinyCloudNode {
         expiryMs?: number;
         /** Override space ID (for creating delegations to non-primary spaces like public) */
         spaceIdOverride?: string;
+        /** Include a companion delegation for the user's public space (default: true) */
+        includePublicSpace?: boolean;
     }): Promise<PortableDelegation>;
     /**
      * Use a delegation received from another user.

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { ISigner, Bytes, ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ClientSession, TinyCloudSession, Extension, Delegation, IKVService, ISQLService, IDataVaultService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISharingService, CreateDelegationParams, DelegationResult, KeyProvider, JWK } from '@tinycloud/sdk-core';
-export { AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, CreateDelegationParams, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IKVService, IPrefixedKVService, ISQLService, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IngestOptions, InvokeFunction, JWK, KVResponse, KVService, KVServiceConfig, KeyInfo, KeyProvider, KeyType, PersistedSessionData, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, SQLAction, SQLActionType, SQLService, SQLServiceConfig, ServiceContext, ServiceContextConfig, ServiceSession, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignRequest, SignResponse, Space, SpaceConfig, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TinyCloud, TinyCloudConfig, TinyCloudSession, VaultAction, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPutOptions, VersionCheckError, WasmVaultFunctions, buildSpaceUri, checkNodeVersion, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, makePublicSpaceId, parseSpaceUri } from '@tinycloud/sdk-core';
+import { ISigner, Bytes, ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ClientSession, TinyCloudSession, Extension, Delegation, IKVService, ISQLService, IDuckDbService, IDataVaultService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISharingService, CreateDelegationParams, DelegationResult, KeyProvider, JWK } from '@tinycloud/sdk-core';
+export { AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, CreateDelegationParams, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IKVService, IPrefixedKVService, ISQLService, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IngestOptions, InvokeFunction, JWK, KVResponse, KVService, KVServiceConfig, KeyInfo, KeyProvider, KeyType, PersistedSessionData, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, ServiceContext, ServiceContextConfig, ServiceSession, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignRequest, SignResponse, Space, SpaceConfig, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, buildSpaceUri, checkNodeInfo, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, makePublicSpaceId, parseSpaceUri } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { TCWSessionManager } from '@tinycloud/node-sdk-wasm';
 
@@ -292,6 +292,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private _tinyCloudSession?;
     private _address?;
     private _chainId?;
+    private _nodeFeatures;
     constructor(config: NodeUserAuthorizationConfig);
     /**
      * The current active session (web-core compatible).
@@ -302,6 +303,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * Includes spaceId, delegationHeader, and delegationCid.
      */
     get tinyCloudSession(): TinyCloudSession | undefined;
+    get nodeFeatures(): string[];
     /**
      * Add an extension to the authorization flow.
      */
@@ -440,6 +442,8 @@ interface PortableDelegation extends Omit<Delegation, "isRevoked"> {
     host?: string;
     /** Whether the recipient is prevented from creating sub-delegations */
     disableSubDelegation?: boolean;
+    /** Companion delegation for the user's public space (auto-created when includePublicSpace is true) */
+    publicDelegation?: PortableDelegation;
 }
 /**
  * Serialize a PortableDelegation for transport (e.g., over network).
@@ -463,6 +467,7 @@ declare class DelegatedAccess {
     private _serviceContext;
     private _kv;
     private _sql;
+    private _duckdb;
     constructor(session: TinyCloudSession, delegation: PortableDelegation, host: string);
     /**
      * Get the delegation this access was created from.
@@ -484,6 +489,10 @@ declare class DelegatedAccess {
      * SQL operations on the delegated space.
      */
     get sql(): ISQLService;
+    /**
+     * DuckDB operations on the delegated space.
+     */
+    get duckdb(): IDuckDbService;
 }
 
 /**
@@ -562,6 +571,7 @@ declare class TinyCloudNode {
     private _serviceContext?;
     private _kv?;
     private _sql?;
+    private _duckdb?;
     private _vault?;
     /** Cached public KV with proper delegation (set by ensurePublicSpace) */
     private _publicKV?;
@@ -574,6 +584,7 @@ declare class TinyCloudNode {
     private _sharingService;
     private _delegationManager?;
     private _spaceService?;
+    private get nodeFeatures();
     /**
      * Create a new TinyCloudNode instance.
      *
@@ -722,6 +733,10 @@ declare class TinyCloudNode {
      * SQL database operations on this user's space.
      */
     get sql(): ISQLService;
+    /**
+     * DuckDB database operations on this user's space.
+     */
+    get duckdb(): IDuckDbService;
     /**
      * Data Vault operations - client-side encrypted KV storage.
      * Call `vault.unlock(signer)` after signIn() to derive encryption keys.
@@ -940,6 +955,8 @@ declare class TinyCloudNode {
         expiryMs?: number;
         /** Override space ID (for creating delegations to non-primary spaces like public) */
         spaceIdOverride?: string;
+        /** Include a companion delegation for the user's public space (default: true) */
+        includePublicSpace?: boolean;
     }): Promise<PortableDelegation>;
     /**
      * Use a delegation received from another user.

package/dist/index.js

@@ -13756,9 +13756,9 @@ var init_lib20 = __esm({
   }
 });
 
-// ../../node_modules/aes-js/index.js
+// ../../node_modules/@ethersproject/json-wallets/node_modules/aes-js/index.js
 var require_aes_js = __commonJS({
-  "../../node_modules/aes-js/index.js"(exports, module) {
+  "../../node_modules/@ethersproject/json-wallets/node_modules/aes-js/index.js"(exports, module) {
     "use strict";
     (function(root) {
       function checkInt(value) {
@@ -17292,7 +17292,7 @@ import {
   fetchPeerId,
   submitHostDelegation,
   activateSessionWithHost,
-  checkNodeVersion
+  checkNodeInfo
 } from "@tinycloud/sdk-core";
 import {
   TCWSessionManager as SessionManager,
@@ -17313,6 +17313,7 @@ var defaultSignStrategy = { type: "auto-sign" };
 var _NodeUserAuthorization = class _NodeUserAuthorization {
   constructor(config) {
     this.extensions = [];
+    this._nodeFeatures = [];
     if (!_NodeUserAuthorization.wasmInitialized) {
       initPanicHook();
       _NodeUserAuthorization.wasmInitialized = true;
@@ -17342,6 +17343,17 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
           "tinycloud.sql/export"
         ]
       },
+      duckdb: {
+        "": [
+          "tinycloud.duckdb/read",
+          "tinycloud.duckdb/write",
+          "tinycloud.duckdb/admin",
+          "tinycloud.duckdb/describe",
+          "tinycloud.duckdb/export",
+          "tinycloud.duckdb/import",
+          "tinycloud.duckdb/execute"
+        ]
+      },
       capabilities: {
         "": ["tinycloud.capabilities/read"]
       }
@@ -17365,6 +17377,9 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
   get tinyCloudSession() {
     return this._tinyCloudSession;
   }
+  get nodeFeatures() {
+    return this._nodeFeatures;
+  }
   /**
    * Add an extension to the authorization flow.
    */
@@ -17560,7 +17575,8 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    await checkNodeVersion(this.tinycloudHosts[0], protocolVersion());
+    const nodeInfo = await checkNodeInfo(this.tinycloudHosts[0], protocolVersion());
+    this._nodeFeatures = nodeInfo.features;
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -17718,7 +17734,8 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    await checkNodeVersion(this.tinycloudHosts[0], protocolVersion());
+    const nodeInfo = await checkNodeInfo(this.tinycloudHosts[0], protocolVersion());
+    this._nodeFeatures = nodeInfo.features;
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -17804,13 +17821,16 @@ import {
   activateSessionWithHost as activateSessionWithHost2,
   KVService as KVService2,
   SQLService as SQLService2,
+  DuckDbService as DuckDbService2,
   DataVaultService,
   createVaultCrypto,
   ServiceContext as ServiceContext2,
   DelegationManager,
   SpaceService,
   CapabilityKeyRegistry,
-  SharingService
+  SharingService,
+  UnsupportedFeatureError,
+  makePublicSpaceId
 } from "@tinycloud/sdk-core";
 import {
   TCWSessionManager as SessionManager2,
@@ -17833,6 +17853,7 @@ import {
 import {
   KVService,
   SQLService,
+  DuckDbService,
   ServiceContext
 } from "@tinycloud/sdk-core";
 import { invoke } from "@tinycloud/node-sdk-wasm";
@@ -17853,6 +17874,9 @@ var DelegatedAccess = class {
     this._sql = new SQLService({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
+    this._duckdb = new DuckDbService({});
+    this._duckdb.initialize(this._serviceContext);
+    this._serviceContext.registerService("duckdb", this._duckdb);
     const serviceSession = {
       delegationHeader: session.delegationHeader,
       delegationCid: session.delegationCid,
@@ -17892,6 +17916,12 @@ var DelegatedAccess = class {
   get sql() {
     return this._sql;
   }
+  /**
+   * DuckDB operations on the delegated space.
+   */
+  get duckdb() {
+    return this._duckdb;
+  }
 };
 
 // src/keys/WasmKeyProvider.ts
@@ -18064,6 +18094,9 @@ var _TinyCloudNode = class _TinyCloudNode {
       this.tc = new TinyCloud(this.auth);
     }
   }
+  get nodeFeatures() {
+    return this.auth?.nodeFeatures ?? [];
+  }
   /**
    * Get the primary identity DID for this user.
    * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -18129,6 +18162,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._chainId = await this.signer.getChainId();
     this._kv = void 0;
     this._sql = void 0;
+    this._duckdb = void 0;
     this._serviceContext = void 0;
     await this.tc.signIn();
     this.initializeServices();
@@ -18145,6 +18179,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   async restoreSession(sessionData) {
     this._kv = void 0;
     this._sql = void 0;
+    this._duckdb = void 0;
     this._serviceContext = void 0;
     if (sessionData.address) {
       this._address = sessionData.address;
@@ -18163,6 +18198,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._sql = new SQLService2({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
+    this._duckdb = new DuckDbService2({});
+    this._duckdb.initialize(this._serviceContext);
+    this._serviceContext.registerService("duckdb", this._duckdb);
     const serviceSession = {
       delegationHeader: sessionData.delegationHeader,
       delegationCid: sessionData.delegationCid,
@@ -18238,9 +18276,17 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._kv = new KVService2({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
-    this._sql = new SQLService2({});
-    this._sql.initialize(this._serviceContext);
-    this._serviceContext.registerService("sql", this._sql);
+    const features = this.nodeFeatures;
+    if (features.length === 0 || features.includes("sql")) {
+      this._sql = new SQLService2({});
+      this._sql.initialize(this._serviceContext);
+      this._serviceContext.registerService("sql", this._sql);
+    }
+    if (features.length === 0 || features.includes("duckdb")) {
+      this._duckdb = new DuckDbService2({});
+      this._duckdb.initialize(this._serviceContext);
+      this._serviceContext.registerService("duckdb", this._duckdb);
+    }
     const serviceSession = {
       delegationHeader: session.delegationHeader,
       delegationCid: session.delegationCid,
@@ -18320,7 +18366,14 @@ var _TinyCloudNode = class _TinyCloudNode {
           "tinycloud.sql/read",
           "tinycloud.sql/write",
           "tinycloud.sql/admin",
-          "tinycloud.sql/*"
+          "tinycloud.sql/*",
+          "tinycloud.duckdb/read",
+          "tinycloud.duckdb/write",
+          "tinycloud.duckdb/admin",
+          "tinycloud.duckdb/describe",
+          "tinycloud.duckdb/export",
+          "tinycloud.duckdb/import",
+          "tinycloud.duckdb/*"
         ],
         expiry: this.getSessionExpiry(),
         isRevoked: false,
@@ -18343,7 +18396,14 @@ var _TinyCloudNode = class _TinyCloudNode {
               "tinycloud.sql/read",
               "tinycloud.sql/write",
               "tinycloud.sql/admin",
-              "tinycloud.sql/*"
+              "tinycloud.sql/*",
+              "tinycloud.duckdb/read",
+              "tinycloud.duckdb/write",
+              "tinycloud.duckdb/admin",
+              "tinycloud.duckdb/describe",
+              "tinycloud.duckdb/export",
+              "tinycloud.duckdb/import",
+              "tinycloud.duckdb/*"
             ],
             expiry: this.getSessionExpiry(),
             isRevoked: false,
@@ -18509,10 +18569,27 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   get sql() {
     if (!this._sql) {
+      const features = this.nodeFeatures;
+      if (features.length > 0 && !features.includes("sql")) {
+        throw new UnsupportedFeatureError("sql", this.config.host, features);
+      }
       throw new Error("Not signed in. Call signIn() first.");
     }
     return this._sql;
   }
+  /**
+   * DuckDB database operations on this user's space.
+   */
+  get duckdb() {
+    if (!this._duckdb) {
+      const features = this.nodeFeatures;
+      if (features.length > 0 && !features.includes("duckdb")) {
+        throw new UnsupportedFeatureError("duckdb", this.config.host, features);
+      }
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    return this._duckdb;
+  }
   /**
    * Data Vault operations - client-side encrypted KV storage.
    * Call `vault.unlock(signer)` after signIn() to derive encryption keys.
@@ -18870,12 +18947,16 @@ var _TinyCloudNode = class _TinyCloudNode {
     const abilities = {};
     const kvActions = params.actions.filter((a) => a.startsWith("tinycloud.kv/"));
     const sqlActions = params.actions.filter((a) => a.startsWith("tinycloud.sql/"));
+    const duckdbActions = params.actions.filter((a) => a.startsWith("tinycloud.duckdb/"));
     if (kvActions.length > 0) {
       abilities.kv = { [params.path]: kvActions };
     }
     if (sqlActions.length > 0) {
       abilities.sql = { [params.path]: sqlActions };
     }
+    if (duckdbActions.length > 0) {
+      abilities.duckdb = { [params.path]: duckdbActions };
+    }
     const now = /* @__PURE__ */ new Date();
     const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
     const expirationTime = new Date(now.getTime() + expiryMs);
@@ -18902,7 +18983,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!activateResult.success) {
       throw new Error(`Failed to activate delegation: ${activateResult.error}`);
     }
-    return {
+    const result = {
       cid: delegationSession.delegationCid,
       delegationHeader: delegationSession.delegationHeader,
       spaceId: params.spaceIdOverride ?? session.spaceId,
@@ -18915,6 +18996,52 @@ var _TinyCloudNode = class _TinyCloudNode {
       chainId: session.chainId,
       host: this.config.host
     };
+    const hasKvActions = params.actions.some((a) => a.startsWith("tinycloud.kv/"));
+    if (hasKvActions && params.includePublicSpace !== false) {
+      const publicSpaceId = makePublicSpaceId(
+        ensureEip553(session.address),
+        session.chainId
+      );
+      const publicAbilities = {
+        kv: { "": ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/metadata"] }
+      };
+      const publicPrepared = prepareSession2({
+        abilities: publicAbilities,
+        address: ensureEip553(session.address),
+        chainId: session.chainId,
+        domain: new URL(this.config.host).hostname,
+        issuedAt: now.toISOString(),
+        expirationTime: expirationTime.toISOString(),
+        spaceId: publicSpaceId,
+        delegateUri: params.delegateDID,
+        parents: [session.delegationCid]
+      });
+      const publicSignature = await this.signer.signMessage(publicPrepared.siwe);
+      const publicSession = completeSessionSetup2({
+        ...publicPrepared,
+        signature: publicSignature
+      });
+      const publicActivateResult = await activateSessionWithHost2(
+        this.config.host,
+        publicSession.delegationHeader
+      );
+      if (publicActivateResult.success) {
+        result.publicDelegation = {
+          cid: publicSession.delegationCid,
+          delegationHeader: publicSession.delegationHeader,
+          spaceId: publicSpaceId,
+          path: "",
+          actions: ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/metadata"],
+          disableSubDelegation: params.disableSubDelegation ?? false,
+          expiry: expirationTime,
+          delegateDID: params.delegateDID,
+          ownerAddress: session.address,
+          chainId: session.chainId,
+          host: this.config.host
+        };
+      }
+    }
+    return result;
   }
   /**
    * Use a delegation received from another user.
@@ -18964,12 +19091,16 @@ var _TinyCloudNode = class _TinyCloudNode {
     const abilities = {};
     const kvActions = delegation.actions.filter((a) => a.startsWith("tinycloud.kv/"));
     const sqlActions = delegation.actions.filter((a) => a.startsWith("tinycloud.sql/"));
+    const duckdbActions = delegation.actions.filter((a) => a.startsWith("tinycloud.duckdb/"));
     if (kvActions.length > 0) {
       abilities.kv = { [delegation.path]: kvActions };
     }
     if (sqlActions.length > 0) {
       abilities.sql = { [delegation.path]: sqlActions };
     }
+    if (duckdbActions.length > 0) {
+      abilities.duckdb = { [delegation.path]: duckdbActions };
+    }
     const now = /* @__PURE__ */ new Date();
     const maxExpiry = new Date(now.getTime() + 60 * 60 * 1e3);
     const expirationTime = delegation.expiry < maxExpiry ? delegation.expiry : maxExpiry;
@@ -19051,12 +19182,16 @@ var _TinyCloudNode = class _TinyCloudNode {
     const abilities = {};
     const kvActions = params.actions.filter((a) => a.startsWith("tinycloud.kv/"));
     const sqlActions = params.actions.filter((a) => a.startsWith("tinycloud.sql/"));
+    const duckdbActions = params.actions.filter((a) => a.startsWith("tinycloud.duckdb/"));
     if (kvActions.length > 0) {
       abilities.kv = { [params.path]: kvActions };
     }
     if (sqlActions.length > 0) {
       abilities.sql = { [params.path]: sqlActions };
     }
+    if (duckdbActions.length > 0) {
+      abilities.duckdb = { [params.path]: duckdbActions };
+    }
     const targetHost = parentDelegation.host ?? this.config.host;
     const prepared = prepareSession2({
       abilities,
@@ -19119,7 +19254,8 @@ function deserializeDelegation(data) {
 // src/index.ts
 import { KVService as KVService3, PrefixedKVService } from "@tinycloud/sdk-core";
 import { SQLService as SQLService3, SQLAction, DatabaseHandle } from "@tinycloud/sdk-core";
-import { DataVaultService as DataVaultService2, VaultAction, VaultHeaders, createVaultCrypto as createVaultCrypto2 } from "@tinycloud/sdk-core";
+import { DuckDbService as DuckDbService3, DuckDbDatabaseHandle, DuckDbAction } from "@tinycloud/sdk-core";
+import { DataVaultService as DataVaultService2, VaultHeaders, VaultPublicSpaceKVActions, createVaultCrypto as createVaultCrypto2 } from "@tinycloud/sdk-core";
 import {
   DelegationManager as DelegationManager2,
   SharingService as SharingService2,
@@ -19137,13 +19273,14 @@ import {
   createSpaceService,
   parseSpaceUri,
   buildSpaceUri,
-  makePublicSpaceId,
+  makePublicSpaceId as makePublicSpaceId2,
   Space
 } from "@tinycloud/sdk-core";
 import {
   ProtocolMismatchError,
   VersionCheckError,
-  checkNodeVersion as checkNodeVersion2
+  UnsupportedFeatureError as UnsupportedFeatureError2,
+  checkNodeInfo as checkNodeInfo2
 } from "@tinycloud/sdk-core";
 import { ServiceContext as ServiceContext3 } from "@tinycloud/sdk-core";
 export {
@@ -19154,6 +19291,9 @@ export {
   DelegatedAccess,
   DelegationErrorCodes,
   DelegationManager2 as DelegationManager,
+  DuckDbAction,
+  DuckDbDatabaseHandle,
+  DuckDbService3 as DuckDbService,
   FileSessionStorage,
   KVService3 as KVService,
   MemorySessionStorage,
@@ -19170,12 +19310,13 @@ export {
   SpaceService2 as SpaceService,
   TinyCloud2 as TinyCloud,
   TinyCloudNode,
-  VaultAction,
+  UnsupportedFeatureError2 as UnsupportedFeatureError,
   VaultHeaders,
+  VaultPublicSpaceKVActions,
   VersionCheckError,
   WasmKeyProvider,
   buildSpaceUri,
-  checkNodeVersion2 as checkNodeVersion,
+  checkNodeInfo2 as checkNodeInfo,
   createCapabilityKeyRegistry,
   createSharingService,
   createSpaceService,
@@ -19183,7 +19324,7 @@ export {
   createWasmKeyProvider,
   defaultSignStrategy,
   deserializeDelegation,
-  makePublicSpaceId,
+  makePublicSpaceId2 as makePublicSpaceId,
   parseSpaceUri,
   serializeDelegation
 };