@tinycloud/node-sdk 2.11.0-beta.8 → 2.11.0

package/dist/{core-Bkptd8qZ.d.cts → core-Bq8TMY7Y.d.cts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -239,7 +239,7 @@ interface NodeUserAuthorizationConfig {
     manifest?: Manifest | Manifest[];
     /** Pre-composed manifest request. Takes precedence over `manifest`. */
     capabilityRequest?: ComposedManifestRequest;
-    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    /** Include canonical account registry read/create-update/list permissions when composing `manifest` and plain sign-in. Default true. */
     includeAccountRegistryPermissions?: boolean;
 }
 interface CreateBootstrapSessionOptions {
@@ -546,6 +546,153 @@ declare class NodeUserAuthorization implements IUserAuthorization {
         spaceId: string;
         verificationMethod: string;
     }, signature: string, keyId: string, jwk: Record<string, unknown>): Promise<ClientSession>;
+    /**
+     * End-to-end sign-in via OpenKey `authorizeTinyCloud()` (Sol CRITICAL-4).
+     *
+     * This is the production entry point that wires
+     * {@link prepareSessionForSigning} → OpenKey `authorizeTinyCloud()` →
+     * {@link signInWithOpenKeyResult} into one call. Consumers pass in a
+     * caller-provided `authorizeFn` (typically a thin wrapper around
+     * `openkey.authorizeTinyCloud()`) so this method has no direct
+     * dependency on the OpenKey SDK — it works with any transport that
+     * conforms to the versioned protocol.
+     *
+     * The `authorizeFn` MUST:
+     *   1. Send the prepared SIWE bytes to OpenKey.
+     *   2. Return the exact `TinyCloudAuthorizationResultV1` shape (with
+     *      `signedMessage` — the bytes the signature actually verifies
+     *      against — plus `selectedActionKeys` and `permissions`).
+     *
+     * NodeUserAuthorization then completes the session with `signedMessage`
+     * (never the prepared bytes), verifying the signature, the immutable
+     * SIWE fields, and every subset invariant enforced by
+     * {@link signInWithOpenKeyResult}. This preserves the exact-byte
+     * guarantee: if the user did NOT narrow, the returned `signedMessage`
+     * equals the prepared SIWE byte-for-byte; if the user narrowed, only
+     * the ReCap block differs and every immutable header field survives.
+     *
+     * Legacy exact-byte {@link signIn} callers are unaffected — this method
+     * is opt-in.
+     *
+     * @param authorizeFn Callback that invokes the versioned OpenKey
+     *   `authorizeTinyCloud()` protocol and returns the result. Receives
+     *   the prepared SIWE bytes plus a `host` hint the widget should bind
+     *   into its /authorize-sign-prepare context.
+     * @param options Optional overrides for the OpenKey request.
+     */
+    signInWithOpenKey(authorizeFn: (input: {
+        protocolVersion: 1;
+        siwe: string;
+        jwk: Record<string, unknown>;
+        host?: string;
+        /**
+         * Sol MAJOR-3: OpenKey key ID (managed or external key) to sign
+         * with. When omitted, the OpenKey SDK falls back to the last
+         * connected key. Callers who want to bind the flow to a specific
+         * OpenKey key can override via options.openkeyKeyId; otherwise the
+         * bridge relies on the SDK's connected-key state.
+         */
+        keyId?: string;
+        /**
+         * Optional presentation envelope forwarded to the OpenKey widget.
+         * Built from this instance's `_manifest` when set. Display-only —
+         * the widget/server MUST NOT let it expand authority. The envelope
+         * carries `manifests` payloads plus a stable SHA-256 digest so the
+         * OpenKey server can origin-bind the browser origin against the
+         * app's well-known manifest.
+         */
+        presentation?: CapabilityPresentationEnvelopeV1;
+    }) => Promise<{
+        protocolVersion: 1;
+        address: string;
+        signature: string;
+        signedMessage: string;
+        selectedActionKeys: string[];
+        permissions: Array<{
+            service: string;
+            space: string;
+            path: string;
+            actions: string[];
+        }>;
+    }>, options?: {
+        host?: string;
+        openkeyKeyId?: string;
+        /**
+         * Optional caller-supplied reason string forwarded in the
+         * presentation envelope. Rendered as caller-supplied (never
+         * verified) in the widget.
+         */
+        reason?: string;
+    }): Promise<ClientSession>;
+    /**
+     * Build a `CapabilityPresentationEnvelopeV1` from `this._manifest`. The
+     * envelope is display-only — the OpenKey widget renders it under an
+     * honest trust label, and the server /authorize-sign-prepare route
+     * decides whether to upgrade the label to `origin-bound` by fetching
+     * the well-known manifest and comparing its digest to
+     * `manifestDigest`.
+     *
+     * Returns `undefined` when no manifest is set — the widget renders as
+     * "no manifest supplied" (unsigned).
+     *
+     * The digest is a deterministic SHA-256 over canonical JSON of the
+     * first manifest payload; OpenKey parses the fetched well-known manifest
+     * and applies the same canonicalization before comparing digests.
+     */
+    private buildPresentationEnvelope;
+    /**
+     * Complete sign-in with a versioned OpenKey authorization result.
+     *
+     * Where `signInWithPreparedSession` completes with a signature over the
+     * ORIGINAL prepared SIWE, this method completes with the SIWE bytes the
+     * OpenKey widget actually presented and signed (`signedMessage`). It
+     * exists because the versioned authorizeTinyCloud protocol lets the user
+     * narrow capabilities; the returned bytes may differ from the original
+     * request and are the only ones the signature actually verifies against.
+     *
+     * The `result` parameter is validated at the trust boundary via
+     * `validateAuthorizationResultV1` (in sdk-core). Callers should validate
+     * BEFORE calling this method so unknown/missing fields are rejected
+     * before any session state is created.
+     *
+     * Validation performed here (defence-in-depth: even a "valid" v1 payload
+     * must clear these checks before any session state is created):
+     * 1. `result.address` matches the local signer's address.
+     * 2. `result.signature` recovers to `result.address` when verified against
+     *    `result.signedMessage`.
+     * 3. Every immutable SIWE header field (domain, address, URI, version,
+     *    chainId, nonce, issuedAt) in the original prepared SIWE is preserved
+     *    byte-for-byte in `result.signedMessage`. `statement` is NOT in this
+     *    list because the WASM renders it from the ReCap contents; it MUST
+     *    change when the ReCap is narrowed.
+     * 4. Every capability in `result.signedMessage`'s ReCap block was present
+     *    in the original prepared SIWE — narrowing OK, broadening rejected.
+     * 5. Every `result.selectedActionKeys` entry corresponds to a
+     *    (resource, action) pair in the returned SIWE.
+     */
+    signInWithOpenKeyResult(result: {
+        protocolVersion: 1;
+        address: string;
+        signature: string;
+        signedMessage: string;
+        selectedActionKeys: string[];
+        permissions: Array<{
+            service: string;
+            space: string;
+            path: string;
+            actions: string[];
+        }>;
+    }, prepared: {
+        /**
+         * The ORIGINAL SIWE the SDK produced via {@link prepareSessionForSigning}.
+         * Used as the source-of-truth reference for immutable-header and
+         * capability-subset comparison against `result.signedMessage`.
+         */
+        siwe: string;
+        jwk: Record<string, unknown>;
+        spaceId: string;
+        verificationMethod: string;
+    }, keyId: string, jwk: Record<string, unknown>): Promise<ClientSession>;
     /**
      * Clear persisted session data.
      */
@@ -828,6 +975,9 @@ declare class DelegatedAccess {
  * ```
  */
 
+declare const BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
+declare const BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
+declare const ACCEPTED_MARKER_VERSIONS: readonly number[];
 /** Input for {@link TinyCloudNode.readSecret}. The target space is required. */
 interface SecretReadInput {
     /** Explicit full space URI or an owned-space name. */
@@ -957,7 +1107,7 @@ interface TinyCloudNodeConfig {
     manifest?: Manifest | Manifest[];
     /** Pre-composed manifest request. Takes precedence over `manifest`. */
     capabilityRequest?: ComposedManifestRequest;
-    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    /** Include account bootstrap support in plain sessions and implicit manifest permissions. Default true. */
     includeAccountRegistryPermissions?: boolean;
     /** Run canonical first-account bootstrap when fresh account state is detected. Default true. */
     autoBootstrapAccount?: boolean;
@@ -1043,6 +1193,12 @@ interface BootstrapWarning {
     /** Human-readable detail. Diagnostics only — never parse this. */
     message: string;
 }
+/** Durable attestation that the canonical account bootstrap ceremony completed. */
+interface BootstrapCompletionMarker {
+    v: number;
+    stepIds: string[];
+    completedAt: string;
+}
 declare class TinyCloudNode {
     /** @internal Registered by importing @tinycloud/node-sdk (not /core) */
     private static nodeDefaults?;
@@ -1111,9 +1267,12 @@ declare class TinyCloudNode {
     private _bootstrapSkipped;
     /**
      * Outcome of the last signIn()'s account-bootstrap attempt. `skipped` is
-     * true when bootstrap did not complete (interactive signer, auto-sign
-     * denied, or a bootstrap step failed); `reason` carries the cause so apps
-     * can surface a "finish account setup" call-to-action. `warnings` is
+     * true when bootstrap did not complete in this invocation (interactive signer,
+     * auto-bootstrap disabled, already provisioned, or a decision/provisioning
+     * step failed). `already-provisioned` means the bootstrap was not run here;
+     * it does not mean a prior provisioning attempt failed to complete.
+     * `reason` carries the cause so apps can surface a "finish account setup"
+     * call-to-action. `warnings` is
      * present when bootstrap completed, but one or more steps recovered from
      * an ambiguous failure (e.g. a KV batch write reconciled via per-space
      * fallback) — clean vs. recovered runs are otherwise byte-identical.
@@ -1196,6 +1355,10 @@ declare class TinyCloudNode {
      * Use this when you specifically need the session key, not the user identity.
      */
     get sessionDid(): string;
+    /** Bare did:key principal used as the credential subject and holder binding. */
+    get credentialHolderDid(): string;
+    /** Canonical verification method for the active credential holder key. */
+    get credentialHolderKid(): string;
     /**
      * Return the current session's signed ReCap capabilities after the session
      * has been authenticated or restored. This is intentionally distinct from
@@ -1249,7 +1412,11 @@ declare class TinyCloudNode {
     signIn(options?: SignInOptions): Promise<void>;
     private ownedSpaceId;
     private bootstrapAccountIfNeeded;
-    private isFreshBootstrapAccount;
+    private resolveBootstrapDecision;
+    private readBootstrapCompletionMarker;
+    private writeBootstrapCompletionMarker;
+    private isAcceptedBootstrapCompletionMarker;
+    private markerReadIsUnhostedSpace;
     private runAccountBootstrap;
     private registerBootstrapRuntimeGrant;
     /**
@@ -1375,6 +1542,8 @@ declare class TinyCloudNode {
      * @returns The hosted owned-space URI.
      */
     ensureOwnedSpaceHosted(name: string): Promise<string>;
+    /** Resolve and authenticate the owner encoded by an owned-space URI. */
+    credentialSpaceOwnerDid(spaceId: string): string;
     /**
      * Check whether an owned space is already registered/hosted by consulting the
      * account spaces registry.
@@ -1479,6 +1648,10 @@ declare class TinyCloudNode {
     invokeAny(entries: Parameters<InvokeAnyFunction$1>[1], facts?: Parameters<InvokeAnyFunction$1>[2]): ReturnType<InvokeAnyFunction$1>;
     /** Sign protocol bytes with the established in-memory session key. */
     signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /** Apply only an already-enabled signing policy to the exact credential request. */
+    autoSignCredentialBytes(bytes: Uint8Array): Promise<Uint8Array | undefined>;
+    /** Invoke the configured interactive approval strategy before session signing. */
+    approveCredentialBytes(bytes: Uint8Array): Promise<Uint8Array>;
     /** Bind a session-signed invocation to the canonical service audience. */
     bindInvocationAudience(authorization: string, audience: string): Promise<string>;
     /**
@@ -2154,6 +2327,13 @@ declare class TinyCloudNode {
         disableSubDelegation?: boolean;
         /** Expiration time in milliseconds from now (must be before parent's expiry) */
         expiryMs?: number;
+        /** Explicit multi-resource projection, including encryption networks. */
+        resources?: Array<{
+            service: string;
+            space?: string;
+            path: string;
+            actions: string[];
+        }>;
     }): Promise<PortableDelegation>;
 }
 
@@ -2265,4 +2445,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { type AuthDelegationArtifact as A, type BootstrapWarning as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimeDelegationActivator as g, type RuntimePermissionGrantOptions as h, type SecretReadInput as i, type SecretReadResult as j, type SignStrategy as k, type TinyCloudNodeConfig as l, type WasmKeyProviderConfig as m, activateValidatedRuntimeDelegation as n, createWasmKeyProvider as o, defaultSignStrategy as p, deserializeDelegation as q, grantAuthRequest as r, serializeDelegation as s };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type DelegateToResult as f, DelegatedAccess as g, type DelegationAuthority as h, NodeUserAuthorization as i, type NodeUserAuthorizationConfig as j, type RuntimeDelegationActivator as k, type RuntimePermissionGrantOptions as l, type SecretReadInput as m, type SecretReadResult as n, type SignStrategy as o, type TinyCloudNodeConfig as p, type WasmKeyProviderConfig as q, activateValidatedRuntimeDelegation as r, createWasmKeyProvider as s, defaultSignStrategy as t, deserializeDelegation as u, grantAuthRequest as v, serializeDelegation as w };

package/dist/{core-Bkptd8qZ.d.ts → core-Bq8TMY7Y.d.ts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -239,7 +239,7 @@ interface NodeUserAuthorizationConfig {
     manifest?: Manifest | Manifest[];
     /** Pre-composed manifest request. Takes precedence over `manifest`. */
     capabilityRequest?: ComposedManifestRequest;
-    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    /** Include canonical account registry read/create-update/list permissions when composing `manifest` and plain sign-in. Default true. */
     includeAccountRegistryPermissions?: boolean;
 }
 interface CreateBootstrapSessionOptions {
@@ -546,6 +546,153 @@ declare class NodeUserAuthorization implements IUserAuthorization {
         spaceId: string;
         verificationMethod: string;
     }, signature: string, keyId: string, jwk: Record<string, unknown>): Promise<ClientSession>;
+    /**
+     * End-to-end sign-in via OpenKey `authorizeTinyCloud()` (Sol CRITICAL-4).
+     *
+     * This is the production entry point that wires
+     * {@link prepareSessionForSigning} → OpenKey `authorizeTinyCloud()` →
+     * {@link signInWithOpenKeyResult} into one call. Consumers pass in a
+     * caller-provided `authorizeFn` (typically a thin wrapper around
+     * `openkey.authorizeTinyCloud()`) so this method has no direct
+     * dependency on the OpenKey SDK — it works with any transport that
+     * conforms to the versioned protocol.
+     *
+     * The `authorizeFn` MUST:
+     *   1. Send the prepared SIWE bytes to OpenKey.
+     *   2. Return the exact `TinyCloudAuthorizationResultV1` shape (with
+     *      `signedMessage` — the bytes the signature actually verifies
+     *      against — plus `selectedActionKeys` and `permissions`).
+     *
+     * NodeUserAuthorization then completes the session with `signedMessage`
+     * (never the prepared bytes), verifying the signature, the immutable
+     * SIWE fields, and every subset invariant enforced by
+     * {@link signInWithOpenKeyResult}. This preserves the exact-byte
+     * guarantee: if the user did NOT narrow, the returned `signedMessage`
+     * equals the prepared SIWE byte-for-byte; if the user narrowed, only
+     * the ReCap block differs and every immutable header field survives.
+     *
+     * Legacy exact-byte {@link signIn} callers are unaffected — this method
+     * is opt-in.
+     *
+     * @param authorizeFn Callback that invokes the versioned OpenKey
+     *   `authorizeTinyCloud()` protocol and returns the result. Receives
+     *   the prepared SIWE bytes plus a `host` hint the widget should bind
+     *   into its /authorize-sign-prepare context.
+     * @param options Optional overrides for the OpenKey request.
+     */
+    signInWithOpenKey(authorizeFn: (input: {
+        protocolVersion: 1;
+        siwe: string;
+        jwk: Record<string, unknown>;
+        host?: string;
+        /**
+         * Sol MAJOR-3: OpenKey key ID (managed or external key) to sign
+         * with. When omitted, the OpenKey SDK falls back to the last
+         * connected key. Callers who want to bind the flow to a specific
+         * OpenKey key can override via options.openkeyKeyId; otherwise the
+         * bridge relies on the SDK's connected-key state.
+         */
+        keyId?: string;
+        /**
+         * Optional presentation envelope forwarded to the OpenKey widget.
+         * Built from this instance's `_manifest` when set. Display-only —
+         * the widget/server MUST NOT let it expand authority. The envelope
+         * carries `manifests` payloads plus a stable SHA-256 digest so the
+         * OpenKey server can origin-bind the browser origin against the
+         * app's well-known manifest.
+         */
+        presentation?: CapabilityPresentationEnvelopeV1;
+    }) => Promise<{
+        protocolVersion: 1;
+        address: string;
+        signature: string;
+        signedMessage: string;
+        selectedActionKeys: string[];
+        permissions: Array<{
+            service: string;
+            space: string;
+            path: string;
+            actions: string[];
+        }>;
+    }>, options?: {
+        host?: string;
+        openkeyKeyId?: string;
+        /**
+         * Optional caller-supplied reason string forwarded in the
+         * presentation envelope. Rendered as caller-supplied (never
+         * verified) in the widget.
+         */
+        reason?: string;
+    }): Promise<ClientSession>;
+    /**
+     * Build a `CapabilityPresentationEnvelopeV1` from `this._manifest`. The
+     * envelope is display-only — the OpenKey widget renders it under an
+     * honest trust label, and the server /authorize-sign-prepare route
+     * decides whether to upgrade the label to `origin-bound` by fetching
+     * the well-known manifest and comparing its digest to
+     * `manifestDigest`.
+     *
+     * Returns `undefined` when no manifest is set — the widget renders as
+     * "no manifest supplied" (unsigned).
+     *
+     * The digest is a deterministic SHA-256 over canonical JSON of the
+     * first manifest payload; OpenKey parses the fetched well-known manifest
+     * and applies the same canonicalization before comparing digests.
+     */
+    private buildPresentationEnvelope;
+    /**
+     * Complete sign-in with a versioned OpenKey authorization result.
+     *
+     * Where `signInWithPreparedSession` completes with a signature over the
+     * ORIGINAL prepared SIWE, this method completes with the SIWE bytes the
+     * OpenKey widget actually presented and signed (`signedMessage`). It
+     * exists because the versioned authorizeTinyCloud protocol lets the user
+     * narrow capabilities; the returned bytes may differ from the original
+     * request and are the only ones the signature actually verifies against.
+     *
+     * The `result` parameter is validated at the trust boundary via
+     * `validateAuthorizationResultV1` (in sdk-core). Callers should validate
+     * BEFORE calling this method so unknown/missing fields are rejected
+     * before any session state is created.
+     *
+     * Validation performed here (defence-in-depth: even a "valid" v1 payload
+     * must clear these checks before any session state is created):
+     * 1. `result.address` matches the local signer's address.
+     * 2. `result.signature` recovers to `result.address` when verified against
+     *    `result.signedMessage`.
+     * 3. Every immutable SIWE header field (domain, address, URI, version,
+     *    chainId, nonce, issuedAt) in the original prepared SIWE is preserved
+     *    byte-for-byte in `result.signedMessage`. `statement` is NOT in this
+     *    list because the WASM renders it from the ReCap contents; it MUST
+     *    change when the ReCap is narrowed.
+     * 4. Every capability in `result.signedMessage`'s ReCap block was present
+     *    in the original prepared SIWE — narrowing OK, broadening rejected.
+     * 5. Every `result.selectedActionKeys` entry corresponds to a
+     *    (resource, action) pair in the returned SIWE.
+     */
+    signInWithOpenKeyResult(result: {
+        protocolVersion: 1;
+        address: string;
+        signature: string;
+        signedMessage: string;
+        selectedActionKeys: string[];
+        permissions: Array<{
+            service: string;
+            space: string;
+            path: string;
+            actions: string[];
+        }>;
+    }, prepared: {
+        /**
+         * The ORIGINAL SIWE the SDK produced via {@link prepareSessionForSigning}.
+         * Used as the source-of-truth reference for immutable-header and
+         * capability-subset comparison against `result.signedMessage`.
+         */
+        siwe: string;
+        jwk: Record<string, unknown>;
+        spaceId: string;
+        verificationMethod: string;
+    }, keyId: string, jwk: Record<string, unknown>): Promise<ClientSession>;
     /**
      * Clear persisted session data.
      */
@@ -828,6 +975,9 @@ declare class DelegatedAccess {
  * ```
  */
 
+declare const BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
+declare const BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
+declare const ACCEPTED_MARKER_VERSIONS: readonly number[];
 /** Input for {@link TinyCloudNode.readSecret}. The target space is required. */
 interface SecretReadInput {
     /** Explicit full space URI or an owned-space name. */
@@ -957,7 +1107,7 @@ interface TinyCloudNodeConfig {
     manifest?: Manifest | Manifest[];
     /** Pre-composed manifest request. Takes precedence over `manifest`. */
     capabilityRequest?: ComposedManifestRequest;
-    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    /** Include account bootstrap support in plain sessions and implicit manifest permissions. Default true. */
     includeAccountRegistryPermissions?: boolean;
     /** Run canonical first-account bootstrap when fresh account state is detected. Default true. */
     autoBootstrapAccount?: boolean;
@@ -1043,6 +1193,12 @@ interface BootstrapWarning {
     /** Human-readable detail. Diagnostics only — never parse this. */
     message: string;
 }
+/** Durable attestation that the canonical account bootstrap ceremony completed. */
+interface BootstrapCompletionMarker {
+    v: number;
+    stepIds: string[];
+    completedAt: string;
+}
 declare class TinyCloudNode {
     /** @internal Registered by importing @tinycloud/node-sdk (not /core) */
     private static nodeDefaults?;
@@ -1111,9 +1267,12 @@ declare class TinyCloudNode {
     private _bootstrapSkipped;
     /**
      * Outcome of the last signIn()'s account-bootstrap attempt. `skipped` is
-     * true when bootstrap did not complete (interactive signer, auto-sign
-     * denied, or a bootstrap step failed); `reason` carries the cause so apps
-     * can surface a "finish account setup" call-to-action. `warnings` is
+     * true when bootstrap did not complete in this invocation (interactive signer,
+     * auto-bootstrap disabled, already provisioned, or a decision/provisioning
+     * step failed). `already-provisioned` means the bootstrap was not run here;
+     * it does not mean a prior provisioning attempt failed to complete.
+     * `reason` carries the cause so apps can surface a "finish account setup"
+     * call-to-action. `warnings` is
      * present when bootstrap completed, but one or more steps recovered from
      * an ambiguous failure (e.g. a KV batch write reconciled via per-space
      * fallback) — clean vs. recovered runs are otherwise byte-identical.
@@ -1196,6 +1355,10 @@ declare class TinyCloudNode {
      * Use this when you specifically need the session key, not the user identity.
      */
     get sessionDid(): string;
+    /** Bare did:key principal used as the credential subject and holder binding. */
+    get credentialHolderDid(): string;
+    /** Canonical verification method for the active credential holder key. */
+    get credentialHolderKid(): string;
     /**
      * Return the current session's signed ReCap capabilities after the session
      * has been authenticated or restored. This is intentionally distinct from
@@ -1249,7 +1412,11 @@ declare class TinyCloudNode {
     signIn(options?: SignInOptions): Promise<void>;
     private ownedSpaceId;
     private bootstrapAccountIfNeeded;
-    private isFreshBootstrapAccount;
+    private resolveBootstrapDecision;
+    private readBootstrapCompletionMarker;
+    private writeBootstrapCompletionMarker;
+    private isAcceptedBootstrapCompletionMarker;
+    private markerReadIsUnhostedSpace;
     private runAccountBootstrap;
     private registerBootstrapRuntimeGrant;
     /**
@@ -1375,6 +1542,8 @@ declare class TinyCloudNode {
      * @returns The hosted owned-space URI.
      */
     ensureOwnedSpaceHosted(name: string): Promise<string>;
+    /** Resolve and authenticate the owner encoded by an owned-space URI. */
+    credentialSpaceOwnerDid(spaceId: string): string;
     /**
      * Check whether an owned space is already registered/hosted by consulting the
      * account spaces registry.
@@ -1479,6 +1648,10 @@ declare class TinyCloudNode {
     invokeAny(entries: Parameters<InvokeAnyFunction$1>[1], facts?: Parameters<InvokeAnyFunction$1>[2]): ReturnType<InvokeAnyFunction$1>;
     /** Sign protocol bytes with the established in-memory session key. */
     signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /** Apply only an already-enabled signing policy to the exact credential request. */
+    autoSignCredentialBytes(bytes: Uint8Array): Promise<Uint8Array | undefined>;
+    /** Invoke the configured interactive approval strategy before session signing. */
+    approveCredentialBytes(bytes: Uint8Array): Promise<Uint8Array>;
     /** Bind a session-signed invocation to the canonical service audience. */
     bindInvocationAudience(authorization: string, audience: string): Promise<string>;
     /**
@@ -2154,6 +2327,13 @@ declare class TinyCloudNode {
         disableSubDelegation?: boolean;
         /** Expiration time in milliseconds from now (must be before parent's expiry) */
         expiryMs?: number;
+        /** Explicit multi-resource projection, including encryption networks. */
+        resources?: Array<{
+            service: string;
+            space?: string;
+            path: string;
+            actions: string[];
+        }>;
     }): Promise<PortableDelegation>;
 }
 
@@ -2265,4 +2445,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { type AuthDelegationArtifact as A, type BootstrapWarning as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimeDelegationActivator as g, type RuntimePermissionGrantOptions as h, type SecretReadInput as i, type SecretReadResult as j, type SignStrategy as k, type TinyCloudNodeConfig as l, type WasmKeyProviderConfig as m, activateValidatedRuntimeDelegation as n, createWasmKeyProvider as o, defaultSignStrategy as p, deserializeDelegation as q, grantAuthRequest as r, serializeDelegation as s };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type DelegateToResult as f, DelegatedAccess as g, type DelegationAuthority as h, NodeUserAuthorization as i, type NodeUserAuthorizationConfig as j, type RuntimeDelegationActivator as k, type RuntimePermissionGrantOptions as l, type SecretReadInput as m, type SecretReadResult as n, type SignStrategy as o, type TinyCloudNodeConfig as p, type WasmKeyProviderConfig as q, activateValidatedRuntimeDelegation as r, createWasmKeyProvider as s, defaultSignStrategy as t, deserializeDelegation as u, grantAuthRequest as v, serializeDelegation as w };