@tinycloud/node-sdk 1.6.0 → 2.0.0

package/dist/index.cjs

@@ -17025,55 +17025,92 @@ var require_utils2 = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  CapabilityKeyRegistry: () => import_sdk_core11.CapabilityKeyRegistry,
-  CapabilityKeyRegistryErrorCodes: () => import_sdk_core11.CapabilityKeyRegistryErrorCodes,
-  DataVaultService: () => import_sdk_core9.DataVaultService,
-  DatabaseHandle: () => import_sdk_core7.DatabaseHandle,
+  AutoApproveSpaceCreationHandler: () => import_sdk_core6.AutoApproveSpaceCreationHandler,
+  CapabilityKeyRegistry: () => import_sdk_core12.CapabilityKeyRegistry,
+  CapabilityKeyRegistryErrorCodes: () => import_sdk_core12.CapabilityKeyRegistryErrorCodes,
+  DataVaultService: () => import_sdk_core10.DataVaultService,
+  DatabaseHandle: () => import_sdk_core8.DatabaseHandle,
   DelegatedAccess: () => DelegatedAccess,
-  DelegationErrorCodes: () => import_sdk_core10.DelegationErrorCodes,
-  DelegationManager: () => import_sdk_core10.DelegationManager,
-  DuckDbAction: () => import_sdk_core8.DuckDbAction,
-  DuckDbDatabaseHandle: () => import_sdk_core8.DuckDbDatabaseHandle,
-  DuckDbService: () => import_sdk_core8.DuckDbService,
+  DelegationErrorCodes: () => import_sdk_core11.DelegationErrorCodes,
+  DelegationManager: () => import_sdk_core11.DelegationManager,
+  DuckDbAction: () => import_sdk_core9.DuckDbAction,
+  DuckDbDatabaseHandle: () => import_sdk_core9.DuckDbDatabaseHandle,
+  DuckDbService: () => import_sdk_core9.DuckDbService,
   FileSessionStorage: () => FileSessionStorage,
-  KVService: () => import_sdk_core6.KVService,
+  KVService: () => import_sdk_core7.KVService,
   MemorySessionStorage: () => MemorySessionStorage,
   NodeUserAuthorization: () => NodeUserAuthorization,
-  PrefixedKVService: () => import_sdk_core6.PrefixedKVService,
+  NodeWasmBindings: () => NodeWasmBindings,
+  PrefixedKVService: () => import_sdk_core7.PrefixedKVService,
   PrivateKeySigner: () => PrivateKeySigner,
-  ProtocolMismatchError: () => import_sdk_core13.ProtocolMismatchError,
-  SQLAction: () => import_sdk_core7.SQLAction,
-  SQLService: () => import_sdk_core7.SQLService,
-  ServiceContext: () => import_sdk_core14.ServiceContext,
-  SharingService: () => import_sdk_core10.SharingService,
-  Space: () => import_sdk_core12.Space,
-  SpaceErrorCodes: () => import_sdk_core12.SpaceErrorCodes,
-  SpaceService: () => import_sdk_core12.SpaceService,
+  ProtocolMismatchError: () => import_sdk_core14.ProtocolMismatchError,
+  SQLAction: () => import_sdk_core8.SQLAction,
+  SQLService: () => import_sdk_core8.SQLService,
+  ServiceContext: () => import_sdk_core15.ServiceContext,
+  SharingService: () => import_sdk_core11.SharingService,
+  SilentNotificationHandler: () => import_sdk_core6.SilentNotificationHandler,
+  Space: () => import_sdk_core13.Space,
+  SpaceErrorCodes: () => import_sdk_core13.SpaceErrorCodes,
+  SpaceService: () => import_sdk_core13.SpaceService,
   TinyCloud: () => import_sdk_core5.TinyCloud,
   TinyCloudNode: () => TinyCloudNode,
-  UnsupportedFeatureError: () => import_sdk_core13.UnsupportedFeatureError,
-  VaultAction: () => import_sdk_core9.VaultAction,
-  VaultHeaders: () => import_sdk_core9.VaultHeaders,
-  VersionCheckError: () => import_sdk_core13.VersionCheckError,
+  UnsupportedFeatureError: () => import_sdk_core14.UnsupportedFeatureError,
+  VaultHeaders: () => import_sdk_core10.VaultHeaders,
+  VaultPublicSpaceKVActions: () => import_sdk_core10.VaultPublicSpaceKVActions,
+  VersionCheckError: () => import_sdk_core14.VersionCheckError,
   WasmKeyProvider: () => WasmKeyProvider,
-  buildSpaceUri: () => import_sdk_core12.buildSpaceUri,
-  checkNodeVersion: () => import_sdk_core13.checkNodeVersion,
-  createCapabilityKeyRegistry: () => import_sdk_core11.createCapabilityKeyRegistry,
-  createSharingService: () => import_sdk_core10.createSharingService,
-  createSpaceService: () => import_sdk_core12.createSpaceService,
-  createVaultCrypto: () => import_sdk_core9.createVaultCrypto,
+  buildSpaceUri: () => import_sdk_core13.buildSpaceUri,
+  checkNodeInfo: () => import_sdk_core14.checkNodeInfo,
+  createCapabilityKeyRegistry: () => import_sdk_core12.createCapabilityKeyRegistry,
+  createSharingService: () => import_sdk_core11.createSharingService,
+  createSpaceService: () => import_sdk_core13.createSpaceService,
+  createVaultCrypto: () => import_sdk_core10.createVaultCrypto,
   createWasmKeyProvider: () => createWasmKeyProvider,
   defaultSignStrategy: () => defaultSignStrategy,
+  defaultSpaceCreationHandler: () => import_sdk_core6.defaultSpaceCreationHandler,
   deserializeDelegation: () => deserializeDelegation,
-  makePublicSpaceId: () => import_sdk_core12.makePublicSpaceId,
-  parseSpaceUri: () => import_sdk_core12.parseSpaceUri,
+  makePublicSpaceId: () => import_sdk_core13.makePublicSpaceId,
+  parseSpaceUri: () => import_sdk_core13.parseSpaceUri,
   serializeDelegation: () => serializeDelegation
 });
 module.exports = __toCommonJS(index_exports);
-var import_sdk_core5 = require("@tinycloud/sdk-core");
 
-// src/signers/PrivateKeySigner.ts
+// src/NodeWasmBindings.ts
 var import_node_sdk_wasm = require("@tinycloud/node-sdk-wasm");
+var _NodeWasmBindings = class _NodeWasmBindings {
+  constructor() {
+    this.invoke = import_node_sdk_wasm.invoke;
+    this.prepareSession = import_node_sdk_wasm.prepareSession;
+    this.completeSessionSetup = import_node_sdk_wasm.completeSessionSetup;
+    this.ensureEip55 = import_node_sdk_wasm.ensureEip55;
+    this.makeSpaceId = import_node_sdk_wasm.makeSpaceId;
+    this.createDelegation = import_node_sdk_wasm.createDelegation;
+    this.generateHostSIWEMessage = import_node_sdk_wasm.generateHostSIWEMessage;
+    this.siweToDelegationHeaders = import_node_sdk_wasm.siweToDelegationHeaders;
+    this.protocolVersion = import_node_sdk_wasm.protocolVersion;
+    // Vault crypto
+    this.vault_encrypt = import_node_sdk_wasm.vault_encrypt;
+    this.vault_decrypt = import_node_sdk_wasm.vault_decrypt;
+    this.vault_derive_key = import_node_sdk_wasm.vault_derive_key;
+    this.vault_x25519_from_seed = import_node_sdk_wasm.vault_x25519_from_seed;
+    this.vault_x25519_dh = import_node_sdk_wasm.vault_x25519_dh;
+    this.vault_random_bytes = import_node_sdk_wasm.vault_random_bytes;
+    this.vault_sha256 = import_node_sdk_wasm.vault_sha256;
+    if (!_NodeWasmBindings.panicHookInitialized) {
+      (0, import_node_sdk_wasm.initPanicHook)();
+      _NodeWasmBindings.panicHookInitialized = true;
+    }
+  }
+  createSessionManager() {
+    return new import_node_sdk_wasm.TCWSessionManager();
+  }
+  // No ensureInitialized needed — Node WASM is synchronous
+};
+_NodeWasmBindings.panicHookInitialized = false;
+var NodeWasmBindings = _NodeWasmBindings;
+
+// src/signers/PrivateKeySigner.ts
+var import_node_sdk_wasm2 = require("@tinycloud/node-sdk-wasm");
 var PrivateKeySigner = class {
   /**
    * Create a new PrivateKeySigner.
@@ -17111,7 +17148,7 @@ var PrivateKeySigner = class {
       const pubKeyWithoutPrefix = publicKey.slice(4);
       const hash3 = keccak2563("0x" + pubKeyWithoutPrefix);
       const address = "0x" + hash3.slice(-40);
-      return (0, import_node_sdk_wasm.ensureEip55)(address);
+      return (0, import_node_sdk_wasm2.ensureEip55)(address);
     } catch {
       return "0x" + this.privateKeyHex.slice(0, 40);
     }
@@ -17130,11 +17167,20 @@ var PrivateKeySigner = class {
    */
   async signMessage(message) {
     const messageStr = typeof message === "string" ? message : Buffer.from(message).toString("utf-8");
-    const signature2 = (0, import_node_sdk_wasm.signEthereumMessage)(messageStr, this.privateKeyHex);
+    const signature2 = (0, import_node_sdk_wasm2.signEthereumMessage)(messageStr, this.privateKeyHex);
     return signature2.startsWith("0x") ? signature2 : "0x" + signature2;
   }
 };
 
+// src/TinyCloudNode.ts
+var import_sdk_core3 = require("@tinycloud/sdk-core");
+
+// src/authorization/NodeUserAuthorization.ts
+var import_sdk_core = require("@tinycloud/sdk-core");
+
+// src/authorization/strategies.ts
+var defaultSignStrategy = { type: "auto-sign" };
+
 // src/storage/MemorySessionStorage.ts
 var MemorySessionStorage = class {
   constructor() {
@@ -17206,142 +17252,12 @@ var MemorySessionStorage = class {
   }
 };
 
-// src/storage/FileSessionStorage.ts
-var import_sdk_core = require("@tinycloud/sdk-core");
-var import_fs = require("fs");
-var import_path = require("path");
-var FileSessionStorage = class {
-  /**
-   * Create a new FileSessionStorage.
-   *
-   * @param baseDir - Directory to store session files (default: ~/.tinycloud/sessions)
-   */
-  constructor(baseDir) {
-    this.baseDir = baseDir || this.getDefaultDir();
-    this.ensureDirectoryExists();
-  }
-  /**
-   * Get the default session storage directory.
-   */
-  getDefaultDir() {
-    const home = process.env.HOME || process.env.USERPROFILE || "/tmp";
-    return (0, import_path.join)(home, ".tinycloud", "sessions");
-  }
-  /**
-   * Ensure the storage directory exists.
-   */
-  ensureDirectoryExists() {
-    if (!(0, import_fs.existsSync)(this.baseDir)) {
-      (0, import_fs.mkdirSync)(this.baseDir, { recursive: true });
-    }
-  }
-  /**
-   * Get the file path for an address.
-   */
-  getFilePath(address) {
-    const normalizedAddress = address.toLowerCase();
-    const filename = `${normalizedAddress.replace("0x", "")}.json`;
-    return (0, import_path.join)(this.baseDir, filename);
-  }
-  /**
-   * Save a session for an address.
-   */
-  async save(address, session) {
-    const filePath = this.getFilePath(address);
-    const data = JSON.stringify(session, null, 2);
-    (0, import_fs.writeFileSync)(filePath, data, "utf-8");
-  }
-  /**
-   * Load a session for an address.
-   */
-  async load(address) {
-    const filePath = this.getFilePath(address);
-    if (!(0, import_fs.existsSync)(filePath)) {
-      return null;
-    }
-    try {
-      const data = (0, import_fs.readFileSync)(filePath, "utf-8");
-      const parsed = JSON.parse(data);
-      const validation = (0, import_sdk_core.validatePersistedSessionData)(parsed);
-      if (!validation.ok) {
-        console.warn(`Invalid session data for ${address}:`, validation.error.message);
-        (0, import_fs.unlinkSync)(filePath);
-        return null;
-      }
-      const session = validation.data;
-      const expiresAt = new Date(session.expiresAt);
-      if (expiresAt < /* @__PURE__ */ new Date()) {
-        (0, import_fs.unlinkSync)(filePath);
-        return null;
-      }
-      return session;
-    } catch (error) {
-      try {
-        (0, import_fs.unlinkSync)(filePath);
-      } catch {
-      }
-      return null;
-    }
-  }
-  /**
-   * Clear a session for an address.
-   */
-  async clear(address) {
-    const filePath = this.getFilePath(address);
-    if ((0, import_fs.existsSync)(filePath)) {
-      (0, import_fs.unlinkSync)(filePath);
-    }
-  }
-  /**
-   * Check if a session exists for an address.
-   */
-  exists(address) {
-    const filePath = this.getFilePath(address);
-    if (!(0, import_fs.existsSync)(filePath)) {
-      return false;
-    }
-    try {
-      const data = (0, import_fs.readFileSync)(filePath, "utf-8");
-      const session = JSON.parse(data);
-      const expiresAt = new Date(session.expiresAt);
-      if (expiresAt < /* @__PURE__ */ new Date()) {
-        (0, import_fs.unlinkSync)(filePath);
-        return false;
-      }
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Check if file system storage is available.
-   */
-  isAvailable() {
-    try {
-      this.ensureDirectoryExists();
-      return (0, import_fs.existsSync)(this.baseDir);
-    } catch {
-      return false;
-    }
-  }
-};
-
 // src/authorization/NodeUserAuthorization.ts
-var import_sdk_core2 = require("@tinycloud/sdk-core");
-var import_node_sdk_wasm2 = require("@tinycloud/node-sdk-wasm");
-
-// src/authorization/strategies.ts
-var defaultSignStrategy = { type: "auto-sign" };
-
-// src/authorization/NodeUserAuthorization.ts
-var _NodeUserAuthorization = class _NodeUserAuthorization {
+var NodeUserAuthorization = class {
   constructor(config) {
     this.extensions = [];
     this._nodeFeatures = [];
-    if (!_NodeUserAuthorization.wasmInitialized) {
-      (0, import_node_sdk_wasm2.initPanicHook)();
-      _NodeUserAuthorization.wasmInitialized = true;
-    }
+    this.wasm = config.wasmBindings;
     this.signer = config.signer;
     this.signStrategy = config.signStrategy ?? defaultSignStrategy;
     this.sessionStorage = config.sessionStorage ?? new MemorySessionStorage();
@@ -17384,9 +17300,10 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
     };
     this.sessionExpirationMs = config.sessionExpirationMs ?? 60 * 60 * 1e3;
     this.autoCreateSpace = config.autoCreateSpace ?? false;
+    this.spaceCreationHandler = config.spaceCreationHandler;
     this.tinycloudHosts = config.tinycloudHosts ?? ["https://node.tinycloud.xyz"];
     this.enablePublicSpace = config.enablePublicSpace ?? true;
-    this.sessionManager = new import_node_sdk_wasm2.TCWSessionManager();
+    this.sessionManager = this.wasm.createSessionManager();
   }
   /**
    * The current active session (web-core compatible).
@@ -17426,8 +17343,8 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
     }
     const host = this.tinycloudHosts[0];
     const spaceId = targetSpaceId ?? this._tinyCloudSession.spaceId;
-    const peerId = await (0, import_sdk_core2.fetchPeerId)(host, spaceId);
-    const siwe = (0, import_node_sdk_wasm2.generateHostSIWEMessage)({
+    const peerId = await (0, import_sdk_core.fetchPeerId)(host, spaceId);
+    const siwe = this.wasm.generateHostSIWEMessage({
       address: this._address,
       chainId: this._chainId,
       domain: this.domain,
@@ -17436,8 +17353,8 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
       peerId
     });
     const signature2 = await this.signMessage(siwe);
-    const headers = (0, import_node_sdk_wasm2.siweToDelegationHeaders)({ siwe, signature: signature2 });
-    const result = await (0, import_sdk_core2.submitHostDelegation)(host, headers);
+    const headers = this.wasm.siweToDelegationHeaders({ siwe, signature: signature2 });
+    const result = await (0, import_sdk_core.submitHostDelegation)(host, headers);
     return result.success;
   }
   /**
@@ -17461,52 +17378,87 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
     }
     const host = this.tinycloudHosts[0];
     const primarySpaceId = this._tinyCloudSession.spaceId;
-    const result = await (0, import_sdk_core2.activateSessionWithHost)(
+    const result = await (0, import_sdk_core.activateSessionWithHost)(
       host,
       this._tinyCloudSession.delegationHeader
     );
+    const handler = this.spaceCreationHandler ?? (this.autoCreateSpace ? new import_sdk_core.AutoApproveSpaceCreationHandler() : void 0);
+    const creationContext = {
+      spaceId: primarySpaceId,
+      address: this._address,
+      chainId: this._chainId,
+      host
+    };
     if (result.success) {
       const primarySkipped = result.skipped?.includes(primarySpaceId);
       if (!primarySkipped) {
         return;
       }
-      if (!this.autoCreateSpace) {
+      if (!handler) {
+        return;
+      }
+      const confirmed = await handler.confirmSpaceCreation(creationContext);
+      if (!confirmed) {
         return;
       }
-      const created = await this.hostSpace();
-      if (!created) {
-        throw new Error(`Failed to create space: ${primarySpaceId}`);
+      try {
+        const created = await this.hostSpace();
+        if (!created) {
+          const err = new Error(`Failed to create space: ${primarySpaceId}`);
+          handler.onSpaceCreationFailed?.(creationContext, err);
+          throw err;
+        }
+      } catch (error) {
+        handler.onSpaceCreationFailed?.(creationContext, error instanceof Error ? error : new Error(String(error)));
+        throw error;
       }
       await new Promise((resolve) => setTimeout(resolve, 100));
-      const retryResult = await (0, import_sdk_core2.activateSessionWithHost)(
+      const retryResult = await (0, import_sdk_core.activateSessionWithHost)(
         host,
         this._tinyCloudSession.delegationHeader
       );
       if (!retryResult.success) {
-        throw new Error(
+        const err = new Error(
           `Failed to activate session after creating space: ${retryResult.error}`
         );
+        handler.onSpaceCreationFailed?.(creationContext, err);
+        throw err;
       }
+      handler.onSpaceCreated?.(creationContext);
       return;
     }
     if (result.status === 404) {
-      if (!this.autoCreateSpace) {
+      if (!handler) {
         return;
       }
-      const created = await this.hostSpace();
-      if (!created) {
-        throw new Error(`Failed to create space: ${primarySpaceId}`);
+      const confirmed = await handler.confirmSpaceCreation(creationContext);
+      if (!confirmed) {
+        return;
+      }
+      try {
+        const created = await this.hostSpace();
+        if (!created) {
+          const err = new Error(`Failed to create space: ${primarySpaceId}`);
+          handler.onSpaceCreationFailed?.(creationContext, err);
+          throw err;
+        }
+      } catch (error) {
+        handler.onSpaceCreationFailed?.(creationContext, error instanceof Error ? error : new Error(String(error)));
+        throw error;
       }
       await new Promise((resolve) => setTimeout(resolve, 100));
-      const retryResult = await (0, import_sdk_core2.activateSessionWithHost)(
+      const retryResult = await (0, import_sdk_core.activateSessionWithHost)(
         host,
         this._tinyCloudSession.delegationHeader
       );
       if (!retryResult.success) {
-        throw new Error(
+        const err = new Error(
           `Failed to activate session after creating space: ${retryResult.error}`
         );
+        handler.onSpaceCreationFailed?.(creationContext, err);
+        throw err;
       }
+      handler.onSpaceCreated?.(creationContext);
       return;
     }
     throw new Error(`Failed to activate session: ${result.error}`);
@@ -17523,7 +17475,7 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
   async signIn() {
     this._address = await this.signer.getAddress();
     this._chainId = await this.signer.getChainId();
-    const address = (0, import_node_sdk_wasm2.ensureEip55)(this._address);
+    const address = this.wasm.ensureEip55(this._address);
     const chainId = this._chainId;
     const keyId = `session-${Date.now()}`;
     this.sessionManager.renameSessionKeyId("default", keyId);
@@ -17532,10 +17484,10 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
       throw new Error("Failed to create session key");
     }
     const jwk = JSON.parse(jwkString);
-    const spaceId = (0, import_node_sdk_wasm2.makeSpaceId)(address, chainId, this.spacePrefix);
+    const spaceId = this.wasm.makeSpaceId(address, chainId, this.spacePrefix);
     const now = /* @__PURE__ */ new Date();
     const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
-    const prepared = (0, import_node_sdk_wasm2.prepareSession)({
+    const prepared = this.wasm.prepareSession({
       abilities: this.defaultActions,
       address,
       chainId,
@@ -17551,7 +17503,7 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
       message: prepared.siwe,
       type: "siwe"
     });
-    const session = (0, import_node_sdk_wasm2.completeSessionSetup)({
+    const session = this.wasm.completeSessionSetup({
       ...prepared,
       signature: signature2
     });
@@ -17563,7 +17515,7 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
       siwe: prepared.siwe,
       signature: signature2
     };
-    const spacesMetadata = this.enablePublicSpace ? { public: (0, import_node_sdk_wasm2.makeSpaceId)(address, chainId, "public") } : void 0;
+    const spacesMetadata = this.enablePublicSpace ? { public: this.wasm.makeSpaceId(address, chainId, "public") } : void 0;
     const tinyCloudSession = {
       address,
       chainId,
@@ -17599,7 +17551,8 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    this._nodeFeatures = await (0, import_sdk_core2.checkNodeVersion)(this.tinycloudHosts[0], (0, import_node_sdk_wasm2.protocolVersion)());
+    const nodeInfo = await (0, import_sdk_core.checkNodeInfo)(this.tinycloudHosts[0], this.wasm.protocolVersion());
+    this._nodeFeatures = nodeInfo.features;
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -17661,7 +17614,7 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
    * ```
    */
   async prepareSessionForSigning() {
-    const address = (0, import_node_sdk_wasm2.ensureEip55)(await this.signer.getAddress());
+    const address = this.wasm.ensureEip55(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     const keyId = `session-${Date.now()}`;
     this.sessionManager.renameSessionKeyId("default", keyId);
@@ -17670,10 +17623,10 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
       throw new Error("Failed to create session key");
     }
     const jwk = JSON.parse(jwkString);
-    const spaceId = (0, import_node_sdk_wasm2.makeSpaceId)(address, chainId, this.spacePrefix);
+    const spaceId = this.wasm.makeSpaceId(address, chainId, this.spacePrefix);
     const now = /* @__PURE__ */ new Date();
     const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
-    const prepared = (0, import_node_sdk_wasm2.prepareSession)({
+    const prepared = this.wasm.prepareSession({
       abilities: this.defaultActions,
       address,
       chainId,
@@ -17703,11 +17656,11 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
    * @param jwk - The JWK from `prepareSessionForSigning()`
    */
   async signInWithPreparedSession(prepared, signature2, keyId, jwk) {
-    const session = (0, import_node_sdk_wasm2.completeSessionSetup)({
+    const session = this.wasm.completeSessionSetup({
       ...prepared,
       signature: signature2
     });
-    const address = (0, import_node_sdk_wasm2.ensureEip55)(await this.signer.getAddress());
+    const address = this.wasm.ensureEip55(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     const clientSession = {
       address,
@@ -17717,7 +17670,7 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
       siwe: prepared.siwe,
       signature: signature2
     };
-    const spacesMetadata = this.enablePublicSpace ? { public: (0, import_node_sdk_wasm2.makeSpaceId)(address, chainId, "public") } : void 0;
+    const spacesMetadata = this.enablePublicSpace ? { public: this.wasm.makeSpaceId(address, chainId, "public") } : void 0;
     const tinyCloudSession = {
       address,
       chainId,
@@ -17757,7 +17710,8 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    this._nodeFeatures = await (0, import_sdk_core2.checkNodeVersion)(this.tinycloudHosts[0], (0, import_node_sdk_wasm2.protocolVersion)());
+    const nodeInfo = await (0, import_sdk_core.checkNodeInfo)(this.tinycloudHosts[0], this.wasm.protocolVersion());
+    this._nodeFeatures = nodeInfo.features;
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -17833,35 +17787,27 @@ var _NodeUserAuthorization = class _NodeUserAuthorization {
     });
   }
 };
-/** Flag to ensure WASM panic hook is only initialized once */
-_NodeUserAuthorization.wasmInitialized = false;
-var NodeUserAuthorization = _NodeUserAuthorization;
-
-// src/TinyCloudNode.ts
-var import_sdk_core4 = require("@tinycloud/sdk-core");
-var import_node_sdk_wasm4 = require("@tinycloud/node-sdk-wasm");
 
 // src/DelegatedAccess.ts
-var import_sdk_core3 = require("@tinycloud/sdk-core");
-var import_node_sdk_wasm3 = require("@tinycloud/node-sdk-wasm");
+var import_sdk_core2 = require("@tinycloud/sdk-core");
 var DelegatedAccess = class {
-  constructor(session, delegation, host) {
+  constructor(session, delegation, host, invoke2) {
     this.session = session;
     this._delegation = delegation;
     this.host = host;
-    this._serviceContext = new import_sdk_core3.ServiceContext({
-      invoke: import_node_sdk_wasm3.invoke,
+    this._serviceContext = new import_sdk_core2.ServiceContext({
+      invoke: invoke2,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [host]
     });
     const prefix = this._delegation.path.replace(/\/$/, "");
-    this._kv = new import_sdk_core3.KVService({ prefix });
+    this._kv = new import_sdk_core2.KVService({ prefix });
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
-    this._sql = new import_sdk_core3.SQLService({});
+    this._sql = new import_sdk_core2.SQLService({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
-    this._duckdb = new import_sdk_core3.DuckDbService({});
+    this._duckdb = new import_sdk_core2.DuckDbService({});
     this._duckdb.initialize(this._serviceContext);
     this._serviceContext.registerService("duckdb", this._duckdb);
     const serviceSession = {
@@ -17968,7 +17914,7 @@ var WasmKeyProvider = class {
    * @returns Array of key IDs
    */
   listKeys() {
-    const keys = this.sessionManager.listSessionKeys();
+    const keys = this.sessionManager.listSessionKeys?.();
     return Array.isArray(keys) ? keys : [];
   }
   /**
@@ -17988,7 +17934,7 @@ function createWasmKeyProvider(sessionManager) {
 
 // src/TinyCloudNode.ts
 var DEFAULT_HOST = "https://node.tinycloud.xyz";
-var _TinyCloudNode = class _TinyCloudNode {
+var TinyCloudNode = class _TinyCloudNode {
   /**
    * Create a new TinyCloudNode instance.
    *
@@ -18017,15 +17963,20 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.auth = null;
     this.tc = null;
     this._chainId = 1;
-    if (!_TinyCloudNode.wasmInitialized) {
-      (0, import_node_sdk_wasm4.initPanicHook)();
-      _TinyCloudNode.wasmInitialized = true;
-    }
     this.config = {
       ...config,
       host: config.host ?? DEFAULT_HOST
     };
-    this.sessionManager = new import_node_sdk_wasm4.TCWSessionManager();
+    if (config.wasmBindings) {
+      this.wasmBindings = config.wasmBindings;
+    } else if (_TinyCloudNode.nodeDefaults) {
+      this.wasmBindings = _TinyCloudNode.nodeDefaults.createWasmBindings();
+    } else {
+      throw new Error(
+        "wasmBindings must be provided in config. Import from '@tinycloud/node-sdk' (not '/core') for automatic Node.js defaults."
+      );
+    }
+    this.sessionManager = this.wasmBindings.createSessionManager();
     const defaultKeyId = "default";
     let jwkStr = this.sessionManager.jwk(defaultKeyId);
     if (jwkStr) {
@@ -18038,22 +17989,23 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Failed to get session key JWK");
     }
     this.sessionKeyJwk = JSON.parse(jwkStr);
-    this._capabilityRegistry = new import_sdk_core4.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core3.CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({
       sessionManager: this.sessionManager
     });
-    this._sharingService = new import_sdk_core4.SharingService({
+    this.notificationHandler = config.notificationHandler ?? new import_sdk_core3.SilentNotificationHandler();
+    this._sharingService = new import_sdk_core3.SharingService({
       hosts: [this.config.host],
       // session: undefined - not needed for receive()
-      invoke: import_node_sdk_wasm4.invoke,
+      invoke: this.wasmBindings.invoke,
       fetch: globalThis.fetch.bind(globalThis),
       keyProvider: this._keyProvider,
       registry: this._capabilityRegistry,
       // delegationManager: undefined - not needed for receive()
       createKVService: (config2) => {
         const prefix = config2.pathPrefix?.replace(/\/$/, "");
-        const kvService = new import_sdk_core4.KVService({ prefix });
-        const kvContext = new import_sdk_core4.ServiceContext({
+        const kvService = new import_sdk_core3.KVService({ prefix });
+        const kvContext = new import_sdk_core3.ServiceContext({
           invoke: config2.invoke,
           fetch: config2.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config2.hosts
@@ -18063,27 +18015,48 @@ var _TinyCloudNode = class _TinyCloudNode {
         return kvService;
       }
     });
-    if (config.privateKey) {
-      this.signer = new PrivateKeySigner(config.privateKey, this._chainId);
-      const host = this.config.host;
-      const domain = config.domain ?? new URL(host).hostname;
-      this.auth = new NodeUserAuthorization({
-        signer: this.signer,
-        signStrategy: { type: "auto-sign" },
-        sessionStorage: config.sessionStorage ?? new MemorySessionStorage(),
-        domain,
-        spacePrefix: config.prefix,
-        sessionExpirationMs: config.sessionExpirationMs ?? 60 * 60 * 1e3,
-        tinycloudHosts: [host],
-        autoCreateSpace: config.autoCreateSpace,
-        enablePublicSpace: config.enablePublicSpace ?? true
-      });
-      this.tc = new import_sdk_core4.TinyCloud(this.auth);
+    if (config.signer) {
+      this.signer = config.signer;
+      this.setupAuth(config);
+    } else if (config.privateKey) {
+      if (!_TinyCloudNode.nodeDefaults) {
+        throw new Error(
+          "privateKey requires PrivateKeySigner. Either provide a signer in config, or import from '@tinycloud/node-sdk' (not '/core') for automatic Node.js defaults."
+        );
+      }
+      this.signer = _TinyCloudNode.nodeDefaults.createSigner(config.privateKey, this._chainId);
+      this.setupAuth(config);
     }
   }
+  /** @internal Register Node.js-specific defaults (NodeWasmBindings, PrivateKeySigner) */
+  static registerNodeDefaults(defaults) {
+    _TinyCloudNode.nodeDefaults = defaults;
+  }
   get nodeFeatures() {
     return this.auth?.nodeFeatures ?? [];
   }
+  /**
+   * Set up authorization handler and TinyCloud instance.
+   * @internal
+   */
+  setupAuth(config) {
+    const host = this.config.host;
+    const domain = config.domain ?? new URL(host).hostname;
+    this.auth = new NodeUserAuthorization({
+      signer: this.signer,
+      signStrategy: { type: "auto-sign" },
+      wasmBindings: this.wasmBindings,
+      sessionStorage: config.sessionStorage ?? new MemorySessionStorage(),
+      domain,
+      spacePrefix: config.prefix,
+      sessionExpirationMs: config.sessionExpirationMs ?? 60 * 60 * 1e3,
+      tinycloudHosts: [host],
+      autoCreateSpace: config.autoCreateSpace,
+      enablePublicSpace: config.enablePublicSpace ?? true,
+      spaceCreationHandler: config.spaceCreationHandler
+    });
+    this.tc = new import_sdk_core3.TinyCloud(this.auth);
+  }
   /**
    * Get the primary identity DID for this user.
    * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -18145,6 +18118,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         "Cannot signIn() in session-only mode. Provide a privateKey in config to create your own space."
       );
     }
+    await this.wasmBindings.ensureInitialized?.();
     this._address = await this.signer.getAddress();
     this._chainId = await this.signer.getChainId();
     this._kv = void 0;
@@ -18153,6 +18127,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._serviceContext = void 0;
     await this.tc.signIn();
     this.initializeServices();
+    this.notificationHandler.success("Successfully signed in");
   }
   /**
    * Restore a previously established session from stored delegation data.
@@ -18164,6 +18139,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @param sessionData - The stored delegation data from the browser flow
    */
   async restoreSession(sessionData) {
+    await this.wasmBindings.ensureInitialized?.();
     this._kv = void 0;
     this._sql = void 0;
     this._duckdb = void 0;
@@ -18174,18 +18150,18 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (sessionData.chainId) {
       this._chainId = sessionData.chainId;
     }
-    this._serviceContext = new import_sdk_core4.ServiceContext({
-      invoke: import_node_sdk_wasm4.invoke,
+    this._serviceContext = new import_sdk_core3.ServiceContext({
+      invoke: this.wasmBindings.invoke,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [this.config.host]
     });
-    this._kv = new import_sdk_core4.KVService({});
+    this._kv = new import_sdk_core3.KVService({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
-    this._sql = new import_sdk_core4.SQLService({});
+    this._sql = new import_sdk_core3.SQLService({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
-    this._duckdb = new import_sdk_core4.DuckDbService({});
+    this._duckdb = new import_sdk_core3.DuckDbService({});
     this._duckdb.initialize(this._serviceContext);
     this._serviceContext.registerService("duckdb", this._duckdb);
     const serviceSession = {
@@ -18196,6 +18172,43 @@ var _TinyCloudNode = class _TinyCloudNode {
       jwk: sessionData.jwk
     };
     this._serviceContext.setSession(serviceSession);
+    const wasm = this.wasmBindings;
+    const vaultCrypto = (0, import_sdk_core3.createVaultCrypto)({
+      vault_encrypt: wasm.vault_encrypt,
+      vault_decrypt: wasm.vault_decrypt,
+      vault_derive_key: wasm.vault_derive_key,
+      vault_x25519_from_seed: wasm.vault_x25519_from_seed,
+      vault_x25519_dh: wasm.vault_x25519_dh,
+      vault_random_bytes: wasm.vault_random_bytes,
+      vault_sha256: wasm.vault_sha256
+    });
+    const self2 = this;
+    this._vault = new import_sdk_core3.DataVaultService({
+      spaceId: sessionData.spaceId,
+      crypto: vaultCrypto,
+      tc: {
+        kv: this._kv,
+        ensurePublicSpace: async () => {
+          try {
+            await self2.ensurePublicSpace();
+            return { ok: true, data: void 0 };
+          } catch (error) {
+            return { ok: false, error: { code: "STORAGE_ERROR", message: error instanceof Error ? error.message : String(error), service: "vault" } };
+          }
+        },
+        get publicKV() {
+          return self2._publicKV ?? self2.tc.publicKV;
+        },
+        readPublicSpace: (host, spaceId, key2) => import_sdk_core3.TinyCloud.readPublicSpace(host, spaceId, key2),
+        makePublicSpaceId: import_sdk_core3.TinyCloud.makePublicSpaceId,
+        did: this.did,
+        address: sessionData.address ?? this._address ?? "",
+        chainId: sessionData.chainId ?? this._chainId,
+        hosts: [this.config.host]
+      }
+    });
+    this._vault.initialize(this._serviceContext);
+    this._serviceContext.registerService("vault", this._vault);
     this.initializeV2Services(serviceSession);
   }
   /**
@@ -18230,19 +18243,63 @@ var _TinyCloudNode = class _TinyCloudNode {
     const prefix = options?.prefix ?? "default";
     const host = this.config.host;
     const domain = new URL(host).hostname;
-    this.signer = new PrivateKeySigner(privateKey);
+    if (!_TinyCloudNode.nodeDefaults) {
+      throw new Error(
+        "connectWallet() requires PrivateKeySigner. Use connectSigner() instead, or import from '@tinycloud/node-sdk' (not '/core') for automatic Node.js defaults."
+      );
+    }
+    this.signer = _TinyCloudNode.nodeDefaults.createSigner(privateKey);
     this.auth = new NodeUserAuthorization({
       signer: this.signer,
       signStrategy: { type: "auto-sign" },
+      wasmBindings: this.wasmBindings,
       sessionStorage: options?.sessionStorage ?? this.config.sessionStorage ?? new MemorySessionStorage(),
       domain,
       spacePrefix: prefix,
       sessionExpirationMs: this.config.sessionExpirationMs ?? 60 * 60 * 1e3,
       tinycloudHosts: [host],
       autoCreateSpace: this.config.autoCreateSpace,
-      enablePublicSpace: this.config.enablePublicSpace ?? true
+      enablePublicSpace: this.config.enablePublicSpace ?? true,
+      spaceCreationHandler: this.config.spaceCreationHandler
     });
-    this.tc = new import_sdk_core4.TinyCloud(this.auth);
+    this.tc = new import_sdk_core3.TinyCloud(this.auth);
+    this.config.prefix = prefix;
+  }
+  /**
+   * Connect any ISigner to upgrade from session-only mode to wallet mode.
+   *
+   * Same as connectWallet() but accepts any ISigner implementation instead
+   * of a raw private key string. Use this for browser wallets, hardware wallets,
+   * or custom signing backends.
+   *
+   * Note: This does NOT automatically sign in. Call signIn() after connecting.
+   *
+   * @param signer - Any ISigner implementation
+   * @param options - Optional configuration
+   * @param options.prefix - Space name prefix (defaults to "default")
+   */
+  connectSigner(signer, options) {
+    if (this.signer) {
+      throw new Error("Signer already connected. Cannot connect another signer.");
+    }
+    const prefix = options?.prefix ?? "default";
+    const host = this.config.host;
+    const domain = new URL(host).hostname;
+    this.signer = signer;
+    this.auth = new NodeUserAuthorization({
+      signer: this.signer,
+      signStrategy: { type: "auto-sign" },
+      wasmBindings: this.wasmBindings,
+      sessionStorage: options?.sessionStorage ?? this.config.sessionStorage ?? new MemorySessionStorage(),
+      domain,
+      spacePrefix: prefix,
+      sessionExpirationMs: this.config.sessionExpirationMs ?? 60 * 60 * 1e3,
+      tinycloudHosts: [host],
+      autoCreateSpace: this.config.autoCreateSpace,
+      enablePublicSpace: this.config.enablePublicSpace ?? true,
+      spaceCreationHandler: this.config.spaceCreationHandler
+    });
+    this.tc = new import_sdk_core3.TinyCloud(this.auth);
     this.config.prefix = prefix;
   }
   /**
@@ -18254,23 +18311,23 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       return;
     }
-    this.tc.initializeServices(import_node_sdk_wasm4.invoke, [this.config.host]);
-    this._serviceContext = new import_sdk_core4.ServiceContext({
-      invoke: import_node_sdk_wasm4.invoke,
+    this.tc.initializeServices(this.wasmBindings.invoke, [this.config.host]);
+    this._serviceContext = new import_sdk_core3.ServiceContext({
+      invoke: this.wasmBindings.invoke,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [this.config.host]
     });
-    this._kv = new import_sdk_core4.KVService({});
+    this._kv = new import_sdk_core3.KVService({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
     const features = this.nodeFeatures;
     if (features.length === 0 || features.includes("sql")) {
-      this._sql = new import_sdk_core4.SQLService({});
+      this._sql = new import_sdk_core3.SQLService({});
       this._sql.initialize(this._serviceContext);
       this._serviceContext.registerService("sql", this._sql);
     }
     if (features.length === 0 || features.includes("duckdb")) {
-      this._duckdb = new import_sdk_core4.DuckDbService({});
+      this._duckdb = new import_sdk_core3.DuckDbService({});
       this._duckdb.initialize(this._serviceContext);
       this._serviceContext.registerService("duckdb", this._duckdb);
     }
@@ -18283,17 +18340,18 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     this._serviceContext.setSession(serviceSession);
     this.tc.serviceContext.setSession(serviceSession);
-    const vaultCrypto = (0, import_sdk_core4.createVaultCrypto)({
-      vault_encrypt: import_node_sdk_wasm4.vault_encrypt,
-      vault_decrypt: import_node_sdk_wasm4.vault_decrypt,
-      vault_derive_key: import_node_sdk_wasm4.vault_derive_key,
-      vault_x25519_from_seed: import_node_sdk_wasm4.vault_x25519_from_seed,
-      vault_x25519_dh: import_node_sdk_wasm4.vault_x25519_dh,
-      vault_random_bytes: import_node_sdk_wasm4.vault_random_bytes,
-      vault_sha256: import_node_sdk_wasm4.vault_sha256
+    const wasm = this.wasmBindings;
+    const vaultCrypto = (0, import_sdk_core3.createVaultCrypto)({
+      vault_encrypt: wasm.vault_encrypt,
+      vault_decrypt: wasm.vault_decrypt,
+      vault_derive_key: wasm.vault_derive_key,
+      vault_x25519_from_seed: wasm.vault_x25519_from_seed,
+      vault_x25519_dh: wasm.vault_x25519_dh,
+      vault_random_bytes: wasm.vault_random_bytes,
+      vault_sha256: wasm.vault_sha256
     });
     const self2 = this;
-    this._vault = new import_sdk_core4.DataVaultService({
+    this._vault = new import_sdk_core3.DataVaultService({
       spaceId: session.spaceId,
       crypto: vaultCrypto,
       tc: {
@@ -18309,8 +18367,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         get publicKV() {
           return self2._publicKV ?? self2.tc.publicKV;
         },
-        readPublicSpace: (host, spaceId, key2) => import_sdk_core4.TinyCloud.readPublicSpace(host, spaceId, key2),
-        makePublicSpaceId: import_sdk_core4.TinyCloud.makePublicSpaceId,
+        readPublicSpace: (host, spaceId, key2) => import_sdk_core3.TinyCloud.readPublicSpace(host, spaceId, key2),
+        makePublicSpaceId: import_sdk_core3.TinyCloud.makePublicSpaceId,
         did: this.did,
         address: this._address,
         chainId: this._chainId,
@@ -18326,7 +18384,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @internal
    */
   initializeV2Services(serviceSession) {
-    this._capabilityRegistry = new import_sdk_core4.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core3.CapabilityKeyRegistry();
     const tcSession = this.auth?.tinyCloudSession;
     if (tcSession && this._address) {
       const sessionKey = {
@@ -18400,23 +18458,23 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       this._capabilityRegistry.registerKey(sessionKey, delegations);
     }
-    this._delegationManager = new import_sdk_core4.DelegationManager({
+    this._delegationManager = new import_sdk_core3.DelegationManager({
       hosts: [this.config.host],
       session: serviceSession,
-      invoke: import_node_sdk_wasm4.invoke,
+      invoke: this.wasmBindings.invoke,
       fetch: globalThis.fetch.bind(globalThis)
     });
-    this._spaceService = new import_sdk_core4.SpaceService({
+    this._spaceService = new import_sdk_core3.SpaceService({
       hosts: [this.config.host],
       session: serviceSession,
-      invoke: import_node_sdk_wasm4.invoke,
+      invoke: this.wasmBindings.invoke,
       fetch: globalThis.fetch.bind(globalThis),
       capabilityRegistry: this._capabilityRegistry,
       userDid: this.did,
       createKVService: (spaceId) => {
-        const kvService = new import_sdk_core4.KVService({});
+        const kvService = new import_sdk_core3.KVService({});
         if (this._serviceContext) {
-          const spaceScopedContext = new import_sdk_core4.ServiceContext({
+          const spaceScopedContext = new import_sdk_core3.ServiceContext({
             invoke: this._serviceContext.invoke,
             fetch: this._serviceContext.fetch,
             hosts: this._serviceContext.hosts
@@ -18470,7 +18528,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegationManager: this._delegationManager,
       sessionExpiry: this.getSessionExpiry(),
       // WASM-based delegation creation (preferred - no server roundtrip)
-      createDelegationWasm: (params) => this.createDelegationWrapper(params)
+      createDelegationWasm: (params) => this.createDelegationWrapper(params),
+      // Root delegation for long-lived share links (bypasses session expiry)
+      // In node-sdk we have direct signer access, so no popup needed
+      onRootDelegationNeeded: this.signer ? async (params) => this.createRootDelegationForSharing(params) : void 0
     });
     this._spaceService.updateConfig({
       sharingService: this._sharingService
@@ -18497,7 +18558,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       spaceId: params.session.spaceId,
       verificationMethod: params.session.verificationMethod
     };
-    const result = (0, import_node_sdk_wasm4.createDelegation)(
+    const result = this.wasmBindings.createDelegation(
       wasmSession,
       params.delegateDID,
       params.spaceId,
@@ -18515,6 +18576,67 @@ var _TinyCloudNode = class _TinyCloudNode {
       expiry: new Date(result.expiry * 1e3)
     };
   }
+  /**
+   * Create a direct root delegation from the wallet to a share key.
+   * This bypasses the session delegation chain, allowing share links
+   * with expiry longer than the current session.
+   * @internal
+   */
+  async createRootDelegationForSharing(params) {
+    if (!this.signer) {
+      return void 0;
+    }
+    const session = this.auth?.tinyCloudSession;
+    if (!session) {
+      return void 0;
+    }
+    try {
+      const host = this.config.host;
+      const now = /* @__PURE__ */ new Date();
+      const abilities = {
+        kv: {
+          [params.path]: params.actions
+        }
+      };
+      const prepared = this.wasmBindings.prepareSession({
+        abilities,
+        address: this.wasmBindings.ensureEip55(session.address),
+        chainId: session.chainId,
+        domain: new URL(host).hostname,
+        issuedAt: now.toISOString(),
+        expirationTime: params.requestedExpiry.toISOString(),
+        spaceId: params.spaceId,
+        delegateUri: params.shareKeyDID
+      });
+      const signature2 = await this.signer.signMessage(prepared.siwe);
+      const delegationSession = this.wasmBindings.completeSessionSetup({
+        ...prepared,
+        signature: signature2
+      });
+      const activateResult = await (0, import_sdk_core3.activateSessionWithHost)(
+        host,
+        delegationSession.delegationHeader
+      );
+      if (!activateResult.success) {
+        return void 0;
+      }
+      return {
+        cid: delegationSession.delegationCid,
+        delegateDID: params.shareKeyDID,
+        delegatorDID: `did:pkh:eip155:${session.chainId}:${session.address}`,
+        spaceId: params.spaceId,
+        path: params.path,
+        actions: params.actions,
+        expiry: params.requestedExpiry,
+        isRevoked: false,
+        allowSubDelegation: true,
+        createdAt: now,
+        authHeader: delegationSession.delegationHeader.Authorization
+      };
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Track a received delegation in the capability registry.
    * @internal
@@ -18558,7 +18680,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._sql) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("sql")) {
-        throw new import_sdk_core4.UnsupportedFeatureError("sql", this.config.host, features);
+        throw new import_sdk_core3.UnsupportedFeatureError("sql", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -18571,7 +18693,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._duckdb) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("duckdb")) {
-        throw new import_sdk_core4.UnsupportedFeatureError("duckdb", this.config.host, features);
+        throw new import_sdk_core3.UnsupportedFeatureError("duckdb", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -18785,9 +18907,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     const now = /* @__PURE__ */ new Date();
     const expiryMs = 60 * 60 * 1e3;
     const expirationTime = new Date(now.getTime() + expiryMs);
-    const prepared = (0, import_node_sdk_wasm4.prepareSession)({
+    const prepared = this.wasmBindings.prepareSession({
       abilities,
-      address: (0, import_node_sdk_wasm4.ensureEip55)(this.session.address),
+      address: this.wasmBindings.ensureEip55(this.session.address),
       chainId: this.session.chainId,
       domain: new URL(this.config.host).hostname,
       issuedAt: now.toISOString(),
@@ -18797,11 +18919,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       parents: [this.session.delegationCid]
     });
     const signature2 = await this.signer.signMessage(prepared.siwe);
-    const delegationSession = (0, import_node_sdk_wasm4.completeSessionSetup)({
+    const delegationSession = this.wasmBindings.completeSessionSetup({
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core4.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core3.activateSessionWithHost)(
       this.config.host,
       delegationSession.delegationHeader
     );
@@ -18828,9 +18950,9 @@ var _TinyCloudNode = class _TinyCloudNode {
       }]);
     }
     if (this._serviceContext) {
-      const publicKV = new import_sdk_core4.KVService({ prefix: "" });
-      const publicContext = new import_sdk_core4.ServiceContext({
-        invoke: import_node_sdk_wasm4.invoke,
+      const publicKV = new import_sdk_core3.KVService({ prefix: "" });
+      const publicContext = new import_sdk_core3.ServiceContext({
+        invoke: this.wasmBindings.invoke,
         fetch: this._serviceContext.fetch,
         hosts: this._serviceContext.hosts
       });
@@ -18931,6 +19053,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
+    if (params.delegateDID.endsWith(".eth") && this.config.ensResolver) {
+      const address = await this.config.ensResolver.resolveAddress(params.delegateDID);
+      if (!address) throw new Error(`Could not resolve ENS name: ${params.delegateDID}`);
+      params = { ...params, delegateDID: `did:pkh:eip155:1:${address}` };
+    }
     const abilities = {};
     const kvActions = params.actions.filter((a) => a.startsWith("tinycloud.kv/"));
     const sqlActions = params.actions.filter((a) => a.startsWith("tinycloud.sql/"));
@@ -18947,9 +19074,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     const now = /* @__PURE__ */ new Date();
     const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
     const expirationTime = new Date(now.getTime() + expiryMs);
-    const prepared = (0, import_node_sdk_wasm4.prepareSession)({
+    const prepared = this.wasmBindings.prepareSession({
       abilities,
-      address: (0, import_node_sdk_wasm4.ensureEip55)(session.address),
+      address: this.wasmBindings.ensureEip55(session.address),
       chainId: session.chainId,
       domain: new URL(this.config.host).hostname,
       issuedAt: now.toISOString(),
@@ -18959,18 +19086,18 @@ var _TinyCloudNode = class _TinyCloudNode {
       parents: [session.delegationCid]
     });
     const signature2 = await this.signer.signMessage(prepared.siwe);
-    const delegationSession = (0, import_node_sdk_wasm4.completeSessionSetup)({
+    const delegationSession = this.wasmBindings.completeSessionSetup({
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core4.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core3.activateSessionWithHost)(
       this.config.host,
       delegationSession.delegationHeader
     );
     if (!activateResult.success) {
       throw new Error(`Failed to activate delegation: ${activateResult.error}`);
     }
-    return {
+    const result = {
       cid: delegationSession.delegationCid,
       delegationHeader: delegationSession.delegationHeader,
       spaceId: params.spaceIdOverride ?? session.spaceId,
@@ -18983,6 +19110,52 @@ var _TinyCloudNode = class _TinyCloudNode {
       chainId: session.chainId,
       host: this.config.host
     };
+    const hasKvActions = params.actions.some((a) => a.startsWith("tinycloud.kv/"));
+    if (hasKvActions && params.includePublicSpace !== false) {
+      const publicSpaceId = (0, import_sdk_core3.makePublicSpaceId)(
+        this.wasmBindings.ensureEip55(session.address),
+        session.chainId
+      );
+      const publicAbilities = {
+        kv: { "": ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/metadata"] }
+      };
+      const publicPrepared = this.wasmBindings.prepareSession({
+        abilities: publicAbilities,
+        address: this.wasmBindings.ensureEip55(session.address),
+        chainId: session.chainId,
+        domain: new URL(this.config.host).hostname,
+        issuedAt: now.toISOString(),
+        expirationTime: expirationTime.toISOString(),
+        spaceId: publicSpaceId,
+        delegateUri: params.delegateDID,
+        parents: [session.delegationCid]
+      });
+      const publicSignature = await this.signer.signMessage(publicPrepared.siwe);
+      const publicSession = this.wasmBindings.completeSessionSetup({
+        ...publicPrepared,
+        signature: publicSignature
+      });
+      const publicActivateResult = await (0, import_sdk_core3.activateSessionWithHost)(
+        this.config.host,
+        publicSession.delegationHeader
+      );
+      if (publicActivateResult.success) {
+        result.publicDelegation = {
+          cid: publicSession.delegationCid,
+          delegationHeader: publicSession.delegationHeader,
+          spaceId: publicSpaceId,
+          path: "",
+          actions: ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/metadata"],
+          disableSubDelegation: params.disableSubDelegation ?? false,
+          expiry: expirationTime,
+          delegateDID: params.delegateDID,
+          ownerAddress: session.address,
+          chainId: session.chainId,
+          host: this.config.host
+        };
+      }
+    }
+    return result;
   }
   /**
    * Use a delegation received from another user.
@@ -19022,7 +19195,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         // Not used in session-only mode
       };
       this.trackReceivedDelegation(delegation, this.sessionKeyJwk);
-      return new DelegatedAccess(session2, delegation, targetHost);
+      return new DelegatedAccess(session2, delegation, targetHost, this.wasmBindings.invoke);
     }
     const mySession = this.auth?.tinyCloudSession;
     if (!mySession) {
@@ -19045,9 +19218,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     const now = /* @__PURE__ */ new Date();
     const maxExpiry = new Date(now.getTime() + 60 * 60 * 1e3);
     const expirationTime = delegation.expiry < maxExpiry ? delegation.expiry : maxExpiry;
-    const prepared = (0, import_node_sdk_wasm4.prepareSession)({
+    const prepared = this.wasmBindings.prepareSession({
       abilities,
-      address: (0, import_node_sdk_wasm4.ensureEip55)(mySession.address),
+      address: this.wasmBindings.ensureEip55(mySession.address),
       chainId: mySession.chainId,
       domain: new URL(targetHost).hostname,
       issuedAt: now.toISOString(),
@@ -19057,11 +19230,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       parents: [delegation.cid]
     });
     const signature2 = await this.signer.signMessage(prepared.siwe);
-    const invokerSession = (0, import_node_sdk_wasm4.completeSessionSetup)({
+    const invokerSession = this.wasmBindings.completeSessionSetup({
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core4.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core3.activateSessionWithHost)(
       targetHost,
       invokerSession.delegationHeader
     );
@@ -19081,7 +19254,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       signature: signature2
     };
     this.trackReceivedDelegation(delegation, jwk);
-    return new DelegatedAccess(session, delegation, targetHost);
+    return new DelegatedAccess(session, delegation, targetHost, this.wasmBindings.invoke);
   }
   /**
    * Create a sub-delegation from a received delegation.
@@ -19134,9 +19307,9 @@ var _TinyCloudNode = class _TinyCloudNode {
       abilities.duckdb = { [params.path]: duckdbActions };
     }
     const targetHost = parentDelegation.host ?? this.config.host;
-    const prepared = (0, import_node_sdk_wasm4.prepareSession)({
+    const prepared = this.wasmBindings.prepareSession({
       abilities,
-      address: (0, import_node_sdk_wasm4.ensureEip55)(this._address),
+      address: this.wasmBindings.ensureEip55(this._address),
       chainId: this._chainId,
       domain: new URL(targetHost).hostname,
       issuedAt: now.toISOString(),
@@ -19146,11 +19319,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       parents: [parentDelegation.cid]
     });
     const signature2 = await this.signer.signMessage(prepared.siwe);
-    const subDelegationSession = (0, import_node_sdk_wasm4.completeSessionSetup)({
+    const subDelegationSession = this.wasmBindings.completeSessionSetup({
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core4.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core3.activateSessionWithHost)(
       targetHost,
       subDelegationSession.delegationHeader
     );
@@ -19172,9 +19345,136 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
   }
 };
-/** Flag to ensure WASM panic hook is only initialized once */
-_TinyCloudNode.wasmInitialized = false;
-var TinyCloudNode = _TinyCloudNode;
+
+// src/nodeDefaults.ts
+TinyCloudNode.registerNodeDefaults({
+  createWasmBindings: () => new NodeWasmBindings(),
+  createSigner: (privateKey, chainId) => new PrivateKeySigner(privateKey, chainId)
+});
+
+// src/index.ts
+var import_sdk_core5 = require("@tinycloud/sdk-core");
+var import_sdk_core6 = require("@tinycloud/sdk-core");
+
+// src/storage/FileSessionStorage.ts
+var import_sdk_core4 = require("@tinycloud/sdk-core");
+var import_fs = require("fs");
+var import_path = require("path");
+var FileSessionStorage = class {
+  /**
+   * Create a new FileSessionStorage.
+   *
+   * @param baseDir - Directory to store session files (default: ~/.tinycloud/sessions)
+   */
+  constructor(baseDir) {
+    this.baseDir = baseDir || this.getDefaultDir();
+    this.ensureDirectoryExists();
+  }
+  /**
+   * Get the default session storage directory.
+   */
+  getDefaultDir() {
+    const home = process.env.HOME || process.env.USERPROFILE || "/tmp";
+    return (0, import_path.join)(home, ".tinycloud", "sessions");
+  }
+  /**
+   * Ensure the storage directory exists.
+   */
+  ensureDirectoryExists() {
+    if (!(0, import_fs.existsSync)(this.baseDir)) {
+      (0, import_fs.mkdirSync)(this.baseDir, { recursive: true });
+    }
+  }
+  /**
+   * Get the file path for an address.
+   */
+  getFilePath(address) {
+    const normalizedAddress = address.toLowerCase();
+    const filename = `${normalizedAddress.replace("0x", "")}.json`;
+    return (0, import_path.join)(this.baseDir, filename);
+  }
+  /**
+   * Save a session for an address.
+   */
+  async save(address, session) {
+    const filePath = this.getFilePath(address);
+    const data = JSON.stringify(session, null, 2);
+    (0, import_fs.writeFileSync)(filePath, data, "utf-8");
+  }
+  /**
+   * Load a session for an address.
+   */
+  async load(address) {
+    const filePath = this.getFilePath(address);
+    if (!(0, import_fs.existsSync)(filePath)) {
+      return null;
+    }
+    try {
+      const data = (0, import_fs.readFileSync)(filePath, "utf-8");
+      const parsed = JSON.parse(data);
+      const validation = (0, import_sdk_core4.validatePersistedSessionData)(parsed);
+      if (!validation.ok) {
+        console.warn(`Invalid session data for ${address}:`, validation.error.message);
+        (0, import_fs.unlinkSync)(filePath);
+        return null;
+      }
+      const session = validation.data;
+      const expiresAt = new Date(session.expiresAt);
+      if (expiresAt < /* @__PURE__ */ new Date()) {
+        (0, import_fs.unlinkSync)(filePath);
+        return null;
+      }
+      return session;
+    } catch (error) {
+      try {
+        (0, import_fs.unlinkSync)(filePath);
+      } catch {
+      }
+      return null;
+    }
+  }
+  /**
+   * Clear a session for an address.
+   */
+  async clear(address) {
+    const filePath = this.getFilePath(address);
+    if ((0, import_fs.existsSync)(filePath)) {
+      (0, import_fs.unlinkSync)(filePath);
+    }
+  }
+  /**
+   * Check if a session exists for an address.
+   */
+  exists(address) {
+    const filePath = this.getFilePath(address);
+    if (!(0, import_fs.existsSync)(filePath)) {
+      return false;
+    }
+    try {
+      const data = (0, import_fs.readFileSync)(filePath, "utf-8");
+      const session = JSON.parse(data);
+      const expiresAt = new Date(session.expiresAt);
+      if (expiresAt < /* @__PURE__ */ new Date()) {
+        (0, import_fs.unlinkSync)(filePath);
+        return false;
+      }
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Check if file system storage is available.
+   */
+  isAvailable() {
+    try {
+      this.ensureDirectoryExists();
+      return (0, import_fs.existsSync)(this.baseDir);
+    } catch {
+      return false;
+    }
+  }
+};
 
 // src/delegation.ts
 function serializeDelegation(delegation) {
@@ -19193,7 +19493,6 @@ function deserializeDelegation(data) {
 }
 
 // src/index.ts
-var import_sdk_core6 = require("@tinycloud/sdk-core");
 var import_sdk_core7 = require("@tinycloud/sdk-core");
 var import_sdk_core8 = require("@tinycloud/sdk-core");
 var import_sdk_core9 = require("@tinycloud/sdk-core");
@@ -19202,8 +19501,10 @@ var import_sdk_core11 = require("@tinycloud/sdk-core");
 var import_sdk_core12 = require("@tinycloud/sdk-core");
 var import_sdk_core13 = require("@tinycloud/sdk-core");
 var import_sdk_core14 = require("@tinycloud/sdk-core");
+var import_sdk_core15 = require("@tinycloud/sdk-core");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AutoApproveSpaceCreationHandler,
   CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
   DataVaultService,
@@ -19218,6 +19519,7 @@ var import_sdk_core14 = require("@tinycloud/sdk-core");
   KVService,
   MemorySessionStorage,
   NodeUserAuthorization,
+  NodeWasmBindings,
   PrefixedKVService,
   PrivateKeySigner,
   ProtocolMismatchError,
@@ -19225,24 +19527,26 @@ var import_sdk_core14 = require("@tinycloud/sdk-core");
   SQLService,
   ServiceContext,
   SharingService,
+  SilentNotificationHandler,
   Space,
   SpaceErrorCodes,
   SpaceService,
   TinyCloud,
   TinyCloudNode,
   UnsupportedFeatureError,
-  VaultAction,
   VaultHeaders,
+  VaultPublicSpaceKVActions,
   VersionCheckError,
   WasmKeyProvider,
   buildSpaceUri,
-  checkNodeVersion,
+  checkNodeInfo,
   createCapabilityKeyRegistry,
   createSharingService,
   createSpaceService,
   createVaultCrypto,
   createWasmKeyProvider,
   defaultSignStrategy,
+  defaultSpaceCreationHandler,
   deserializeDelegation,
   makePublicSpaceId,
   parseSpaceUri,