@tinycloud/node-sdk 2.11.0-beta.9 → 2.11.1-beta.0

package/dist/core.js

@@ -220,6 +220,8 @@ var FileSessionStorage = class {
 };
 
 // src/authorization/NodeUserAuthorization.ts
+import { createHash } from "crypto";
+import { SiweMessage } from "siwe";
 import {
   fetchPeerId,
   submitHostDelegation,
@@ -238,6 +240,13 @@ import {
   canonicalizeAddress,
   makePkhSpaceId,
   pkhDid,
+  extractImmutableSiweFields,
+  diffImmutableSiweFields,
+  extractRecapAttenuations,
+  unauthorizedRecapCapabilities,
+  parseCanonicalRecapResource,
+  ACCOUNT_REGISTRY_SPACE,
+  ACCOUNT_MANIFEST_PERMISSIONS,
   KV,
   SQL,
   DUCKDB,
@@ -253,6 +262,27 @@ var defaultSignStrategy = { type: "auto-sign" };
 // src/authorization/NodeUserAuthorization.ts
 var DECRYPT_ACTION = ENCRYPTION.DECRYPT;
 var NETWORK_CREATE_ACTION = ENCRYPTION.NETWORK_CREATE;
+function canonicalizeOpenKeyManifestJson(value) {
+  const json = JSON.stringify(value);
+  if (json === void 0) {
+    throw new TypeError("manifest is not JSON-serializable");
+  }
+  return canonicalizeJsonValue(JSON.parse(json));
+}
+function canonicalizeJsonValue(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalizeJsonValue).join(",")}]`;
+  }
+  return `{${Object.keys(value).sort().map(
+    (key) => `${JSON.stringify(key)}:${canonicalizeJsonValue(value[key])}`
+  ).join(",")}}`;
+}
+function canonicalOpenKeyManifestSha256Hex(value) {
+  return createHash("sha256").update(canonicalizeOpenKeyManifestJson(value)).digest("hex");
+}
 function didPrincipalMatches(actual, expected) {
   try {
     return principalDidEquals(actual, expected);
@@ -270,6 +300,16 @@ function addRawAbility(rawAbilities, resource, action) {
     actions.push(action);
   }
 }
+function cloneAbilitiesMap(actions) {
+  return Object.fromEntries(
+    Object.entries(actions).map(([service, paths]) => [
+      service,
+      Object.fromEntries(
+        Object.entries(paths).map(([path, pathActions]) => [path, [...pathActions]])
+      )
+    ])
+  );
+}
 var NodeUserAuthorization = class {
   constructor(config) {
     this.activeSessionKeyId = "default";
@@ -541,23 +581,41 @@ var NodeUserAuthorization = class {
       const defaultNetworkId = this.defaultEncryptionNetworkId(address, chainId);
       const primarySpaceId2 = makePkhSpaceId(address, chainId, this.spacePrefix);
       const secretsSpaceId = makePkhSpaceId(address, chainId, "secrets");
-      return {
-        abilities: this.defaultActions,
-        spaceId: primarySpaceId2,
-        spaceAbilities: {
-          [primarySpaceId2]: this.defaultActions,
-          [secretsSpaceId]: {
-            kv: {
-              "vault/secrets/": [
-                KV.GET,
-                KV.PUT,
-                KV.DEL,
-                KV.LIST,
-                KV.METADATA
-              ]
+      const primaryActions = this.includeAccountRegistryPermissions && this.spacePrefix === ACCOUNT_REGISTRY_SPACE ? cloneAbilitiesMap(this.defaultActions) : this.defaultActions;
+      const spaceAbilities2 = {
+        [primarySpaceId2]: primaryActions,
+        [secretsSpaceId]: {
+          kv: {
+            "vault/secrets/": [
+              KV.GET,
+              KV.PUT,
+              KV.DEL,
+              KV.LIST,
+              KV.METADATA
+            ]
+          }
+        }
+      };
+      if (this.includeAccountRegistryPermissions && this.spacePrefix !== ACCOUNT_REGISTRY_SPACE) {
+        spaceAbilities2[makePkhSpaceId(address, chainId, ACCOUNT_REGISTRY_SPACE)] = resourceCapabilitiesToAbilitiesMap(ACCOUNT_MANIFEST_PERMISSIONS);
+      } else if (this.includeAccountRegistryPermissions) {
+        const accountAbilities = resourceCapabilitiesToAbilitiesMap(
+          ACCOUNT_MANIFEST_PERMISSIONS
+        );
+        for (const [service, paths] of Object.entries(accountAbilities)) {
+          const existingPaths = primaryActions[service] ?? (primaryActions[service] = {});
+          for (const [path, actions] of Object.entries(paths)) {
+            const existingActions = existingPaths[path] ?? (existingPaths[path] = []);
+            for (const action of actions) {
+              if (!existingActions.includes(action)) existingActions.push(action);
             }
           }
-        },
+        }
+      }
+      return {
+        abilities: primaryActions,
+        spaceId: primarySpaceId2,
+        spaceAbilities: spaceAbilities2,
         rawAbilities: {
           [defaultNetworkId]: [DECRYPT_ACTION, NETWORK_CREATE_ACTION]
         }
@@ -1138,6 +1196,398 @@ var NodeUserAuthorization = class {
     await this.ensureSpaceExists();
     return clientSession;
   }
+  /**
+   * End-to-end sign-in via OpenKey `authorizeTinyCloud()` (Sol CRITICAL-4).
+   *
+   * This is the production entry point that wires
+   * {@link prepareSessionForSigning} → OpenKey `authorizeTinyCloud()` →
+   * {@link signInWithOpenKeyResult} into one call. Consumers pass in a
+   * caller-provided `authorizeFn` (typically a thin wrapper around
+   * `openkey.authorizeTinyCloud()`) so this method has no direct
+   * dependency on the OpenKey SDK — it works with any transport that
+   * conforms to the versioned protocol.
+   *
+   * The `authorizeFn` MUST:
+   *   1. Send the prepared SIWE bytes to OpenKey.
+   *   2. Return the exact `TinyCloudAuthorizationResultV1` shape (with
+   *      `signedMessage` — the bytes the signature actually verifies
+   *      against — plus `selectedActionKeys` and `permissions`).
+   *
+   * NodeUserAuthorization then completes the session with `signedMessage`
+   * (never the prepared bytes), verifying the signature, the immutable
+   * SIWE fields, and every subset invariant enforced by
+   * {@link signInWithOpenKeyResult}. This preserves the exact-byte
+   * guarantee: if the user did NOT narrow, the returned `signedMessage`
+   * equals the prepared SIWE byte-for-byte; if the user narrowed, only
+   * the ReCap block differs and every immutable header field survives.
+   *
+   * Legacy exact-byte {@link signIn} callers are unaffected — this method
+   * is opt-in.
+   *
+   * @param authorizeFn Callback that invokes the versioned OpenKey
+   *   `authorizeTinyCloud()` protocol and returns the result. Receives
+   *   the prepared SIWE bytes plus a `host` hint the widget should bind
+   *   into its /authorize-sign-prepare context.
+   * @param options Optional overrides for the OpenKey request.
+   */
+  async signInWithOpenKey(authorizeFn, options) {
+    if (options?.host !== void 0) {
+      const overrideHost = options.host.trim();
+      if (!overrideHost) {
+        throw new Error("OpenKey authorization host must not be empty");
+      }
+      this.tinycloudHosts = [overrideHost];
+    }
+    const signingAddress = canonicalizeAddress(await this.signer.getAddress());
+    const signingChainId = await this.signer.getChainId();
+    await this.resolveTinyCloudHostsForSignIn(signingAddress, signingChainId);
+    const { prepared, keyId, jwk } = await this.prepareSessionForSigning();
+    const presentation = this.buildPresentationEnvelope(options?.reason);
+    const hostHint = this.primaryTinyCloudHost;
+    const result = await authorizeFn({
+      protocolVersion: 1,
+      siwe: prepared.siwe,
+      jwk,
+      host: hostHint,
+      keyId: options?.openkeyKeyId,
+      presentation
+    });
+    return this.signInWithOpenKeyResult(result, prepared, keyId, jwk);
+  }
+  /**
+   * Build a `CapabilityPresentationEnvelopeV1` from `this._manifest`. The
+   * envelope is display-only — the OpenKey widget renders it under an
+   * honest trust label, and the server /authorize-sign-prepare route
+   * decides whether to upgrade the label to `origin-bound` by fetching
+   * the well-known manifest and comparing its digest to
+   * `manifestDigest`.
+   *
+   * Returns `undefined` when no manifest is set — the widget renders as
+   * "no manifest supplied" (unsigned).
+   *
+   * The digest is a deterministic SHA-256 over canonical JSON of the
+   * first manifest payload; OpenKey parses the fetched well-known manifest
+   * and applies the same canonicalization before comparing digests.
+   */
+  buildPresentationEnvelope(reason) {
+    const manifests = Array.isArray(this._manifest) ? this._manifest : this._manifest ? [this._manifest] : [];
+    if (manifests.length === 0 && !reason) {
+      return void 0;
+    }
+    const primary = manifests[0];
+    let displayName;
+    let manifestId;
+    let manifestDigest;
+    const envelopeManifests = [];
+    for (const m of manifests) {
+      envelopeManifests.push({
+        name: m.name,
+        appId: m.app_id,
+        // Deep-copy to prevent later mutations from affecting the digest.
+        payload: JSON.parse(JSON.stringify(m))
+      });
+    }
+    if (primary) {
+      displayName = primary.name;
+      manifestId = primary.app_id;
+      manifestDigest = canonicalOpenKeyManifestSha256Hex(primary);
+    }
+    return {
+      protocolVersion: 1,
+      displayName,
+      reason: reason && reason.length > 0 ? reason : void 0,
+      manifestId,
+      manifestDigest,
+      manifests: envelopeManifests.length > 0 ? envelopeManifests : void 0
+    };
+  }
+  /**
+   * Complete sign-in with a versioned OpenKey authorization result.
+   *
+   * Where `signInWithPreparedSession` completes with a signature over the
+   * ORIGINAL prepared SIWE, this method completes with the SIWE bytes the
+   * OpenKey widget actually presented and signed (`signedMessage`). It
+   * exists because the versioned authorizeTinyCloud protocol lets the user
+   * narrow capabilities; the returned bytes may differ from the original
+   * request and are the only ones the signature actually verifies against.
+   *
+   * The `result` parameter is validated at the trust boundary via
+   * `validateAuthorizationResultV1` (in sdk-core). Callers should validate
+   * BEFORE calling this method so unknown/missing fields are rejected
+   * before any session state is created.
+   *
+   * Validation performed here (defence-in-depth: even a "valid" v1 payload
+   * must clear these checks before any session state is created):
+   * 1. `result.address` matches the local signer's address.
+   * 2. `result.signature` recovers to `result.address` when verified against
+   *    `result.signedMessage`.
+   * 3. Every immutable SIWE header field (domain, address, URI, version,
+   *    chainId, nonce, issuedAt) in the original prepared SIWE is preserved
+   *    byte-for-byte in `result.signedMessage`. `statement` is NOT in this
+   *    list because the WASM renders it from the ReCap contents; it MUST
+   *    change when the ReCap is narrowed.
+   * 4. Every capability in `result.signedMessage`'s ReCap block was present
+   *    in the original prepared SIWE — narrowing OK, broadening rejected.
+   * 5. Every `result.selectedActionKeys` entry corresponds to a
+   *    (resource, action) pair in the returned SIWE.
+   */
+  async signInWithOpenKeyResult(result, prepared, keyId, jwk) {
+    if (result.protocolVersion !== 1) {
+      throw new Error(`Unsupported OpenKey protocol version ${result.protocolVersion}`);
+    }
+    if (!result.signedMessage) {
+      throw new Error("OpenKey result must include signedMessage");
+    }
+    if (!prepared.siwe) {
+      throw new Error(
+        "signInWithOpenKeyResult requires prepared.siwe (the SDK-generated SIWE the sign-in was proposed with)"
+      );
+    }
+    const expectedAddress = canonicalizeAddress(await this.signer.getAddress());
+    if (canonicalizeAddress(result.address) !== expectedAddress) {
+      throw new Error(
+        `OpenKey returned signature from ${result.address} but expected ${expectedAddress}`
+      );
+    }
+    let parsedSignedSiwe;
+    try {
+      parsedSignedSiwe = new SiweMessage(result.signedMessage);
+    } catch (err) {
+      throw new Error(
+        `OpenKey signedMessage is not a parseable SIWE: ${err.message}`
+      );
+    }
+    const verifyResult = await parsedSignedSiwe.verify(
+      { signature: result.signature },
+      { suppressExceptions: true }
+    );
+    if (!verifyResult.success) {
+      const errData = verifyResult.error;
+      const type = errData && typeof errData === "object" && "type" in errData ? errData.type : void 0;
+      const details = errData && typeof errData === "object" && "expected" in errData ? ` (expected=${errData.expected}, received=${errData.received})` : "";
+      throw new Error(
+        `OpenKey signature verification failed${type ? `: ${type}` : ""}${details}`
+      );
+    }
+    if (canonicalizeAddress(parsedSignedSiwe.address) !== expectedAddress) {
+      throw new Error(
+        `OpenKey signedMessage.address (${parsedSignedSiwe.address}) does not match local signer address (${expectedAddress})`
+      );
+    }
+    const originalHasRecap = /(?:^|\n)-\s+urn:recap:/i.test(prepared.siwe);
+    const originalFields = extractImmutableSiweFields(prepared.siwe);
+    const signedFields = extractImmutableSiweFields(result.signedMessage);
+    const changedFields = diffImmutableSiweFields(originalFields, signedFields, {
+      originalHasRecap
+    });
+    if (changedFields.length > 0) {
+      throw new Error(
+        `OpenKey signedMessage altered immutable SIWE fields: ${changedFields.join(", ")}`
+      );
+    }
+    let originalCaps;
+    let signedCaps;
+    try {
+      originalCaps = extractRecapAttenuations(prepared.siwe);
+    } catch (err) {
+      throw new Error(
+        `Failed to decode prepared SIWE recap: ${err.message}`
+      );
+    }
+    try {
+      signedCaps = extractRecapAttenuations(result.signedMessage);
+    } catch (err) {
+      throw new Error(
+        `Failed to decode OpenKey signedMessage recap: ${err.message}`
+      );
+    }
+    const unauthorized = unauthorizedRecapCapabilities(signedCaps, originalCaps);
+    if (unauthorized.length > 0) {
+      const previewLimit = 5;
+      const preview = unauthorized.slice(0, previewLimit).map((u) => `${u.resource}::${u.action}`).join(", ");
+      const overflow = unauthorized.length > previewLimit ? ` (and ${unauthorized.length - previewLimit} more)` : "";
+      throw new Error(
+        `OpenKey signedMessage broadened authorization beyond the original request: ${preview}${overflow}`
+      );
+    }
+    if (!result.signedMessage.includes(prepared.spaceId)) {
+      throw new Error(
+        `OpenKey signedMessage does not reference the expected spaceId ${prepared.spaceId}`
+      );
+    }
+    const grantedPairs = /* @__PURE__ */ new Set();
+    const grantedFourPartIndex = /* @__PURE__ */ new Map();
+    for (const [resource, actions] of Object.entries(signedCaps)) {
+      const { space, path } = parseCanonicalRecapResource(resource);
+      for (const action of Object.keys(actions)) {
+        grantedPairs.add(`${resource}\0${action}`);
+        const slashIdx = action.indexOf("/");
+        const service = slashIdx > 0 ? action.slice(0, slashIdx) : "";
+        if (service) {
+          grantedFourPartIndex.set(
+            `${service}\0${space}\0${path}\0${action}`,
+            `${resource}\0${action}`
+          );
+        }
+      }
+    }
+    const isStructurallyRequired = (action) => action === "tinycloud.capabilities/read" || action === "capabilities/read";
+    const nonRequiredGrantedPairs = /* @__PURE__ */ new Set();
+    for (const pair of grantedPairs) {
+      const idx = pair.indexOf("\0");
+      const action = idx >= 0 ? pair.slice(idx + 1) : pair;
+      if (!isStructurallyRequired(action)) {
+        nonRequiredGrantedPairs.add(pair);
+      }
+    }
+    const allSignedGrantedPairs = new Set(grantedPairs);
+    const seenRawKeys = /* @__PURE__ */ new Set();
+    for (const rawKey of result.selectedActionKeys) {
+      if (seenRawKeys.has(rawKey)) {
+        throw new Error(
+          `OpenKey selectedActionKeys contains duplicate entry ${rawKey}`
+        );
+      }
+      seenRawKeys.add(rawKey);
+    }
+    const selectedResourceActionPairs = /* @__PURE__ */ new Set();
+    for (const rawKey of result.selectedActionKeys) {
+      const parts = rawKey.split("\0");
+      if (parts.length !== 4) {
+        throw new Error(
+          `OpenKey selectedActionKeys entry is malformed (expected canonical 4-part service\\0space\\0path\\0ability): ${rawKey}`
+        );
+      }
+      const canonical = grantedFourPartIndex.get(rawKey);
+      if (!canonical) {
+        throw new Error(
+          `OpenKey selectedActionKeys entry ${rawKey} is not covered by any granted capability`
+        );
+      }
+      selectedResourceActionPairs.add(canonical);
+    }
+    if (nonRequiredGrantedPairs.size > 0) {
+      const missingPairs = [];
+      for (const pair of nonRequiredGrantedPairs) {
+        if (!selectedResourceActionPairs.has(pair)) {
+          missingPairs.push(pair);
+        }
+      }
+      if (missingPairs.length > 0) {
+        const previewLimit = 5;
+        const preview = missingPairs.slice(0, previewLimit).map((p) => p.replace("\0", "::")).join(", ");
+        const overflow = missingPairs.length > previewLimit ? ` (and ${missingPairs.length - previewLimit} more)` : "";
+        throw new Error(
+          `OpenKey selectedActionKeys is missing entries for signedMessage capabilities: ${preview}${overflow}`
+        );
+      }
+    }
+    if (allSignedGrantedPairs.size > 0 && result.permissions.length === 0) {
+      throw new Error(
+        "OpenKey permissions is empty but signedMessage carries capabilities \u2014 refusing to accept a session without an authoritative grant list"
+      );
+    }
+    const permissionCanonicalKeys = /* @__PURE__ */ new Set();
+    const permissionPairsCovered = /* @__PURE__ */ new Set();
+    for (const perm of result.permissions) {
+      const { service, space, path, actions } = perm;
+      if (typeof service !== "string" || typeof space !== "string" || typeof path !== "string") {
+        throw new Error(
+          `OpenKey permissions entry has non-string service/space/path (service=${service}, space=${space}, path=${path})`
+        );
+      }
+      if (!Array.isArray(actions) || actions.length === 0) {
+        throw new Error(
+          `OpenKey permissions entry (${service} ${space} ${path}) has empty actions \u2014 a capability-bearing entry must list at least one action`
+        );
+      }
+      const canonicalKey = `${service}\0${space}\0${path}`;
+      if (permissionCanonicalKeys.has(canonicalKey)) {
+        throw new Error(
+          `OpenKey permissions has duplicate entry for (${service} ${space} ${path})`
+        );
+      }
+      permissionCanonicalKeys.add(canonicalKey);
+      let expectedResource;
+      if (space.startsWith("tinycloud:")) {
+        const shortService = service.startsWith("tinycloud.") ? service.slice("tinycloud.".length) : service;
+        expectedResource = path ? `${space}/${shortService}/${path}` : `${space}/${shortService}`;
+      } else {
+        if (path) {
+          throw new Error(
+            `OpenKey permissions entry (${service} ${space} ${path}) carries a path on a non-tinycloud: resource URI, which is not a recognized encoding`
+          );
+        }
+        expectedResource = space;
+      }
+      let matchedResource;
+      if (signedCaps[expectedResource] !== void 0) {
+        matchedResource = expectedResource;
+      } else {
+        throw new Error(
+          `OpenKey permissions entry (${service} ${space} ${path}) claims grants not confirmed in signedMessage capabilities`
+        );
+      }
+      const grantedActionsForResource = new Set(
+        Object.keys(signedCaps[matchedResource])
+      );
+      for (const action of actions) {
+        if (typeof action !== "string" || !action) {
+          throw new Error(
+            `OpenKey permissions entry (${service} ${space} ${path}) has non-string action ${String(action)}`
+          );
+        }
+        if (!grantedActionsForResource.has(action)) {
+          throw new Error(
+            `OpenKey permissions entry (${service} ${space} ${path}) claims action ${action} not present in signedMessage capabilities`
+          );
+        }
+        permissionPairsCovered.add(`${matchedResource}\0${action}`);
+      }
+    }
+    if (allSignedGrantedPairs.size > 0) {
+      const missingFromPerms = [];
+      for (const pair of allSignedGrantedPairs) {
+        if (!permissionPairsCovered.has(pair)) {
+          missingFromPerms.push(pair);
+        }
+      }
+      if (missingFromPerms.length > 0) {
+        const previewLimit = 5;
+        const preview = missingFromPerms.slice(0, previewLimit).map((p) => p.replace("\0", "::")).join(", ");
+        const overflow = missingFromPerms.length > previewLimit ? ` (and ${missingFromPerms.length - previewLimit} more)` : "";
+        throw new Error(
+          `OpenKey permissions is missing entries for signedMessage capabilities: ${preview}${overflow}`
+        );
+      }
+      const extrasInPerms = [];
+      for (const pair of permissionPairsCovered) {
+        if (!allSignedGrantedPairs.has(pair)) {
+          extrasInPerms.push(pair);
+        }
+      }
+      if (extrasInPerms.length > 0) {
+        const previewLimit = 5;
+        const preview = extrasInPerms.slice(0, previewLimit).map((p) => p.replace("\0", "::")).join(", ");
+        const overflow = extrasInPerms.length > previewLimit ? ` (and ${extrasInPerms.length - previewLimit} more)` : "";
+        throw new Error(
+          `OpenKey permissions contains entries not present in the signed authority: ${preview}${overflow}`
+        );
+      }
+    }
+    void nonRequiredGrantedPairs;
+    return this.signInWithPreparedSession(
+      {
+        siwe: result.signedMessage,
+        jwk: prepared.jwk,
+        spaceId: prepared.spaceId,
+        verificationMethod: prepared.verificationMethod
+      },
+      result.signature,
+      keyId,
+      jwk
+    );
+  }
   /**
    * Clear persisted session data.
    */
@@ -1229,12 +1679,14 @@ import {
   SharingService,
   UnsupportedFeatureError,
   makePublicSpaceId,
-  ACCOUNT_REGISTRY_SPACE,
+  ACCOUNT_REGISTRY_SPACE as ACCOUNT_REGISTRY_SPACE2,
+  BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST,
   BOOTSTRAP_SESSION_REQUESTS,
   SECRET_RECORDS_SCHEMA,
   SECRETS_SPACE as SECRETS_SPACE2,
   TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   bootstrapSteps,
+  ErrorCodes as ErrorCodes2,
   ENCRYPTION_PERMISSION_SERVICE as ENCRYPTION_PERMISSION_SERVICE2,
   CaveatedDelegationUnsupportedError,
   PermissionNotInManifestError,
@@ -1261,7 +1713,9 @@ import {
   parseNetworkId as parseNetworkId2,
   resolveSecretPath as resolveSecretPath2,
   validateOwnerSharePolicyRegistrationBytes,
-  validateShareDeliveryAuthorizationBytes
+  validateShareDeliveryAuthorizationBytes,
+  verifyEip191MessageSignature,
+  signCompactUcanRootAuthorization
 } from "@tinycloud/sdk-core";
 import {
   parsePermissionHint
@@ -1452,7 +1906,7 @@ function createWasmKeyProvider(sessionManager) {
 // src/delegateToHelpers.ts
 import {
   parseExpiry,
-  SiweMessage,
+  SiweMessage as SiweMessage2,
   EXPIRY as EXPIRY2
 } from "@tinycloud/sdk-core";
 function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
@@ -1501,7 +1955,7 @@ function resolveExpiryMs(expiry) {
   return parseExpiry(expiry);
 }
 function extractSiweExpiration(siwe) {
-  const parsed = new SiweMessage(siwe);
+  const parsed = new SiweMessage2(siwe);
   if (parsed.expirationTime === void 0 || parsed.expirationTime === null) {
     return void 0;
   }
@@ -1703,6 +2157,9 @@ var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
 var NETWORK_CREATE_ACTION2 = ENCRYPTION2.NETWORK_CREATE;
 var DECRYPT_ACTION2 = ENCRYPTION2.DECRYPT;
+var BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
+var BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
+var ACCEPTED_MARKER_VERSIONS = [BOOTSTRAP_COMPLETION_MARKER_VERSION];
 var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
 function isSecretPayload(value) {
   return typeof value === "object" && value !== null && "value" in value && typeof value.value === "string" && "createdAt" in value && typeof value.createdAt === "string" && "updatedAt" in value && typeof value.updatedAt === "string";
@@ -1726,6 +2183,18 @@ var ROOT_DELEGATION_ACTIONS = [
   DUCKDB2.ALL
 ];
 var DEFAULT_SESSION_EXPIRATION_MS = EXPIRY3.SESSION_MS;
+function unifiedRootAttenuation(capabilities) {
+  const attenuation = {};
+  for (const capability of capabilities) {
+    if (attenuation[capability.resource] !== void 0) throw new Error("unified owner root contains a duplicate resource");
+    attenuation[capability.resource] = capability.kind === "encryption" ? { [capability.action]: [{}] } : Object.fromEntries(capability.actions.map((action) => [action, [{
+      type: "xyz.tinycloud.resource/selector",
+      kind: capability.selector,
+      value: capability.resource
+    }]]));
+  }
+  return attenuation;
+}
 function decodeAuthorizationBytes(authorization) {
   const encoded = authorization.replace(/^Bearer /i, "");
   const match = /^([A-Za-z0-9_-]+)(={1,2})?$/.exec(encoded);
@@ -1745,6 +2214,9 @@ function decodeAuthorizationBytes(authorization) {
 function isOpenKeyAutoSignStrategy(strategy) {
   return strategy?.openKeyAutoSign === true;
 }
+function openKeyApproval(strategy) {
+  return strategy?.openKeyRequestApproval;
+}
 function isInteractiveSigner(config) {
   if (config.privateKey) {
     return false;
@@ -2102,6 +2574,8 @@ var _TinyCloudNode = class _TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
+    /** Serializes account-registry writes for the active node instance. */
+    this.accountRegistryTail = Promise.resolve();
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -2110,9 +2584,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._bootstrapSkipped = false;
     /**
      * Outcome of the last signIn()'s account-bootstrap attempt. `skipped` is
-     * true when bootstrap did not complete (interactive signer, auto-sign
-     * denied, or a bootstrap step failed); `reason` carries the cause so apps
-     * can surface a "finish account setup" call-to-action. `warnings` is
+     * true when bootstrap did not complete in this invocation (interactive signer,
+     * auto-bootstrap disabled, already provisioned, or a decision/provisioning
+     * step failed). `already-provisioned` means the bootstrap was not run here;
+     * it does not mean a prior provisioning attempt failed to complete.
+     * `reason` carries the cause so apps can surface a "finish account setup"
+     * call-to-action. `warnings` is
      * present when bootstrap completed, but one or more steps recovered from
      * an ambiguous failure (e.g. a KV batch write reconciled via per-space
      * fallback) — clean vs. recovered runs are otherwise byte-identical.
@@ -2295,7 +2772,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: config.nonce,
       siweConfig: config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? config.includeAccountRegistryPermissions === false ? BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : config.includeAccountRegistryPermissions
     });
     this.tc = new TinyCloud(this.auth, {
@@ -2385,6 +2862,15 @@ var _TinyCloudNode = class _TinyCloudNode {
   get sessionDid() {
     return this.sessionManager.getDID(this.sessionKeyId);
   }
+  /** Bare did:key principal used as the credential subject and holder binding. */
+  get credentialHolderDid() {
+    return this.sessionDid.split("#", 1)[0];
+  }
+  /** Canonical verification method for the active credential holder key. */
+  get credentialHolderKid() {
+    const holder = this.credentialHolderDid;
+    return `${holder}#${holder.slice("did:key:".length)}`;
+  }
   /**
    * Return the current session's signed ReCap capabilities after the session
    * has been authenticated or restored. This is intentionally distinct from
@@ -2435,7 +2921,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._address) {
       return void 0;
     }
-    return this.wasmBindings.makeSpaceId(this._address, this._chainId, ACCOUNT_REGISTRY_SPACE);
+    return this.wasmBindings.makeSpaceId(this._address, this._chainId, ACCOUNT_REGISTRY_SPACE2);
   }
   /**
    * Account-level application and delegation helpers.
@@ -2486,6 +2972,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         "Cannot signIn() in session-only mode. Provide a privateKey in config to create your own space."
       );
     }
+    await this.accountRegistryTail;
     await this.wasmBindings.ensureInitialized?.();
     this._address = canonicalizeAddress2(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
@@ -2538,6 +3025,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._bootstrapSkipped = false;
     this._bootstrapStatus = { skipped: false };
     if (this.config.autoBootstrapAccount === false) {
+      this._bootstrapStatus = { skipped: true, reason: "auto-bootstrap-disabled" };
       return false;
     }
     if (!this.auth || !this._address) {
@@ -2552,11 +3040,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       return false;
     }
     const steps = bootstrapSteps(this._address, this._chainId);
-    if (!await this.isFreshBootstrapAccount(steps)) {
-      return false;
-    }
     try {
-      const warnings = await this.runAccountBootstrap(steps);
+      const decision = await this.resolveBootstrapDecision(steps);
+      if (decision.action === "skip") {
+        this._bootstrapStatus = { skipped: true, reason: "already-provisioned" };
+        return false;
+      }
+      const warnings = await this.runAccountBootstrap(steps, { mode: decision.mode });
+      await this.writeBootstrapCompletionMarker(steps);
       if (warnings.length > 0) {
         this._bootstrapStatus = { skipped: false, warnings };
         this.notificationHandler.warning(
@@ -2575,32 +3066,92 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return true;
   }
-  async isFreshBootstrapAccount(steps) {
+  async resolveBootstrapDecision(steps) {
     const enshrinedSpaceIds = /* @__PURE__ */ new Set();
     for (const step of steps) {
       if (step.kind === "session") {
         enshrinedSpaceIds.add(step.spaceId);
       }
     }
-    const skipped = this.auth.lastActivationSkippedSpaceIds;
+    const auth = this.auth;
+    if (!auth) {
+      throw new Error("Account bootstrap requires an active wallet session");
+    }
+    const skipped = auth.lastActivationSkippedSpaceIds;
     if (skipped.some((spaceId) => enshrinedSpaceIds.has(spaceId))) {
-      return true;
+      return { action: "run", mode: "fresh" };
     }
     try {
-      const indexed = await this.account.index.spaces.list();
-      if (indexed.ok && indexed.data.length === 0) {
-        return true;
+      const accountSpaceId = this.ownedSpaceId(ACCOUNT_REGISTRY_SPACE2);
+      const markerPermission = {
+        service: "tinycloud.kv",
+        space: accountSpaceId,
+        path: BOOTSTRAP_COMPLETION_MARKER_KEY,
+        actions: ["get"]
+      };
+      if (!this.hasRuntimePermissions([markerPermission])) {
+        return { action: "run", mode: "repair" };
       }
-    } catch {
+      const marker = await this.readBootstrapCompletionMarker();
+      if (marker.ok) {
+        if (this.isAcceptedBootstrapCompletionMarker(marker.data.data)) {
+          return { action: "skip" };
+        }
+        return { action: "run", mode: "repair" };
+      }
+      if (marker.error.code === ErrorCodes2.KV_NOT_FOUND && this.markerReadIsUnhostedSpace(marker.error.meta)) {
+        return { action: "run", mode: "fresh" };
+      }
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      this.notificationHandler.warning(
+        `Account bootstrap decision failed; attempting one bounded repair: ${reason}`
+      );
+      console.warn(`[TinyCloudNode] account bootstrap decision failed: ${reason}`);
+      return { action: "run", mode: "repair" };
     }
-    try {
-      const spaces = await this.account.spaces.list();
-      return spaces.ok && spaces.data.length === 0;
-    } catch {
-      return false;
+    return { action: "run", mode: "repair" };
+  }
+  async readBootstrapCompletionMarker() {
+    return this.kvForSpace(this.ownedSpaceId(ACCOUNT_REGISTRY_SPACE2)).get(
+      BOOTSTRAP_COMPLETION_MARKER_KEY
+    );
+  }
+  async writeBootstrapCompletionMarker(steps) {
+    if (!this._address) {
+      throw new Error("Bootstrap completion marker requires an active wallet session");
     }
+    const canonicalStepIds = new Set(
+      bootstrapSteps(this._address, this._chainId).map((step) => step.id)
+    );
+    const providedStepIds = new Set(steps.map((step) => step.id));
+    if (canonicalStepIds.size !== providedStepIds.size || [...canonicalStepIds].some((stepId) => !providedStepIds.has(stepId))) {
+      throw new Error("Bootstrap completion marker requires the canonical bootstrap step set");
+    }
+    const marker = {
+      v: BOOTSTRAP_COMPLETION_MARKER_VERSION,
+      stepIds: [...canonicalStepIds],
+      completedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const written = await this.kvForSpace(this.ownedSpaceId(ACCOUNT_REGISTRY_SPACE2)).put(
+      BOOTSTRAP_COMPLETION_MARKER_KEY,
+      marker
+    );
+    if (!written.ok) {
+      throw new Error(`Failed to write bootstrap completion marker: ${written.error.message}`);
+    }
+  }
+  isAcceptedBootstrapCompletionMarker(value) {
+    if (typeof value !== "object" || value === null) return false;
+    const entries = Object.entries(value);
+    const markerValue = (name) => entries.find(([key]) => key === name)?.[1];
+    const version = markerValue("v");
+    return typeof version === "number" && Number.isInteger(version) && ACCEPTED_MARKER_VERSIONS.some((acceptedVersion) => acceptedVersion === version);
+  }
+  markerReadIsUnhostedSpace(meta) {
+    return meta?.status === 404;
   }
-  async runAccountBootstrap(steps) {
+  async runAccountBootstrap(steps, { mode } = { mode: "fresh" }) {
     if (!this.auth || !this._address) {
       throw new Error("Account bootstrap requires an active wallet session");
     }
@@ -2701,9 +3252,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (step.kind === "seed-applications") {
         const registered = await this.account.applications.register(
           step.manifests.length > 0 ? [...step.manifests] : TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
-          // Bootstrap only runs on an account with no registry records, so the
-          // manifest-hash pre-read is definitionally a miss. Skip it; the write
-          // it guards is an INSERT OR REPLACE and is safe to repeat.
+          // The write is an INSERT OR REPLACE and is safe to repeat during a
+          // repair, so skip the manifest-hash pre-read.
           { assumeUnregistered: true }
         );
         if (!registered.ok) {
@@ -2711,7 +3261,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
       }
       if (step.kind === "encryption-network-create") {
-        await this.ensureEncryptionNetwork(step.networkId, { assumeMissing: true });
+        await this.ensureEncryptionNetwork(step.networkId, { assumeMissing: mode === "fresh" });
       }
       if (step.kind === "secret-records-schema") {
         const db = this.sqlForSpace(step.spaceId).db(step.database);
@@ -2894,7 +3444,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.signer) {
       throw new Error("Manifest registry write requires wallet mode");
     }
-    const accountSpaceId = this.ownedSpaceId(ACCOUNT_REGISTRY_SPACE);
+    const accountSpaceId = this.ownedSpaceId(ACCOUNT_REGISTRY_SPACE2);
     await this.ensureOwnedSpaceHostedById(accountSpaceId);
     const result = await this.account.applications.register(request.manifests);
     if (!result.ok) {
@@ -2904,16 +3454,48 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
   }
   scheduleAccountRegistrySync() {
-    void this.withAccountRegistryRetry(async () => {
-      void this.account.index.ensure();
-      await this.writeManifestRegistryRecords();
-      if (this.currentSessionCanListSpaces()) {
-        const spaces = await this.account.spaces.syncAccessible();
-        if (!spaces.ok) {
-          throw new Error(`Failed to sync account spaces: ${spaces.error.message}`);
+    const session = this.currentTinyCloudSession();
+    if (!session || this.pendingAccountRegistrySync?.session === session) {
+      return;
+    }
+    const promise = this.enqueueAccountRegistryOperation(session, async () => {
+      await this.withAccountRegistryRetry(async () => {
+        if (this.currentTinyCloudSession() !== session) {
+          return;
+        }
+        await this.account.index.ensure();
+        if (this.currentTinyCloudSession() !== session) {
+          return;
+        }
+        await this.writeManifestRegistryRecords();
+        if (this.currentTinyCloudSession() !== session) {
+          return;
         }
+        if (this.currentSessionCanListSpaces()) {
+          const spaces = await this.account.spaces.syncAccessible();
+          if (!spaces.ok) {
+            throw new Error(`Failed to sync account spaces: ${spaces.error.message}`);
+          }
+        }
+      });
+    });
+    this.pendingAccountRegistrySync = { session, promise };
+    const clearPendingSync = () => {
+      if (this.pendingAccountRegistrySync?.promise === promise) {
+        this.pendingAccountRegistrySync = void 0;
       }
+    };
+    void promise.then(clearPendingSync, clearPendingSync);
+  }
+  enqueueAccountRegistryOperation(session, task) {
+    const operation = this.accountRegistryTail.then(async () => {
+      if (this.currentTinyCloudSession() === session) {
+        await task();
+      }
+    });
+    this.accountRegistryTail = operation.catch(() => {
     });
+    return operation;
   }
   /**
    * Whether the current primary session may invoke `tinycloud.space/list`.
@@ -3066,7 +3648,8 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @returns The hosted space URI.
    */
   async hostOwnedSpace(name) {
-    if (!this.auth || !this.auth.tinyCloudSession) {
+    const session = this.auth?.tinyCloudSession;
+    if (!this.auth || !session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const spaceId = this.ownedSpaceId(name);
@@ -3082,22 +3665,26 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const activation = await activateSessionWithHost2(
       host,
-      this.auth.tinyCloudSession.delegationHeader
+      session.delegationHeader
     );
     if (!activation.success || activation.skipped?.includes(spaceId)) {
       throw new Error(
         `Failed to activate session for owned space ${spaceId}: ${activation.error ?? "space was skipped"}`
       );
     }
-    void this.account.spaces.register({
-      spaceId,
-      name,
-      ownerDid: this.did,
-      type: "owned",
-      permissions: ["*"],
-      status: "active"
-    }).catch(() => {
-    });
+    try {
+      await this.enqueueAccountRegistryOperation(session, async () => {
+        await this.account.spaces.register({
+          spaceId,
+          name,
+          ownerDid: this.did,
+          type: "owned",
+          permissions: ["*"],
+          status: "active"
+        });
+      });
+    } catch {
+    }
     return spaceId;
   }
   /**
@@ -3132,23 +3719,20 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.auth.tinyCloudSession) {
       throw new Error("Not signed in. Call signIn() first.");
     }
+    await this.accountRegistryTail;
     const spaceId = this.ownedSpaceId(name);
     if (await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
-    const hosted = await this.hostOwnedSpace(name);
-    try {
-      await this.account.spaces.register({
-        spaceId,
-        name,
-        ownerDid: this.did,
-        type: "owned",
-        permissions: ["*"],
-        status: "active"
-      });
-    } catch {
+    return this.hostOwnedSpace(name);
+  }
+  /** Resolve and authenticate the owner encoded by an owned-space URI. */
+  credentialSpaceOwnerDid(spaceId) {
+    const ownerDid = this.ownerDidFromSpaceId(spaceId);
+    if (ownerDid === void 0 || !didPrincipalMatches2(ownerDid, this.did)) {
+      throw new Error("Credential space owner does not match the active TinyCloud owner");
     }
-    return hosted;
+    return ownerDid;
   }
   /**
    * Check whether an owned space is already registered/hosted by consulting the
@@ -3693,6 +4277,106 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
     return signBytesWithJwk(bytes, session.jwk);
   }
+  /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
+  async createUnifiedOwnerRoot(input) {
+    const ownerDid = this.credentialHolderDid;
+    if (input.ownerDid !== ownerDid) throw new Error("unified owner root signer does not match owner DID");
+    const facts = {
+      role: input.role,
+      mode: input.role === "policy-authority" ? "policy-source" : "conditional-mint",
+      ownerDid,
+      policyId: input.policyId,
+      policyDigestHex: input.policyDigestHex,
+      policyCid: input.policyCid,
+      contentSourceDigestHex: input.contentSourceDigestHex,
+      capabilityCeilingHashHex: input.capabilityCeilingHashHex,
+      nativeProjectionHashHex: input.nativeProjectionHashHex,
+      nodeAudience: input.nodeAudience,
+      ...input.role === "policy-enforcement" ? { enforcerDid: input.audienceDid } : {}
+    };
+    const root = await signCompactUcanRootAuthorization({
+      issuerDid: ownerDid,
+      audienceDid: input.audienceDid,
+      attenuation: unifiedRootAttenuation(input.capabilities),
+      facts: [facts],
+      notBefore: Math.floor(input.notBefore.getTime() / 1e3),
+      expiresAt: Math.floor(input.expiresAt.getTime() / 1e3),
+      nonce: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+      sign: (bytes) => this.signSessionBytes(bytes)
+    });
+    const kv = input.capabilities.find((capability) => capability.kind === "kv");
+    const resource = kv?.resource ?? "";
+    const marker = resource.indexOf("/kv/");
+    return {
+      cid: root.cid,
+      delegationHeader: { Authorization: root.authorization },
+      delegateDID: input.audienceDid,
+      spaceId: marker === -1 ? "" : resource.slice("tinycloud://".length, marker),
+      path: marker === -1 ? resource : resource.slice(marker + 4),
+      actions: kv?.actions ?? [],
+      expiry: input.expiresAt
+    };
+  }
+  /** Apply only an already-enabled signing policy to the exact credential request. */
+  async autoSignCredentialBytes(bytes) {
+    const strategy = this.config.signStrategy;
+    if (strategy?.type === "auto-sign") return this.signSessionBytes(bytes);
+    if (strategy?.type !== "callback" || !isOpenKeyAutoSignStrategy(strategy)) return void 0;
+    const session = this.currentTinyCloudSession() ?? this._activeServiceSession;
+    if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
+    const request = {
+      address: this.address ?? "",
+      chainId: this.session?.chainId ?? this._chainId,
+      message: new TextDecoder().decode(bytes),
+      type: "message",
+      purpose: "message"
+    };
+    const decision = await strategy.handler(request);
+    if (!decision.approved) {
+      if (decision.needsApproval) return void 0;
+      throw new Error(decision.reason ?? "OpenKey automatic credential signing was rejected");
+    }
+    if (typeof decision.signature !== "string" || !await verifyEip191MessageSignature(
+      request.message,
+      decision.signature,
+      request.address
+    )) {
+      throw new Error("OpenKey credential signature evidence is invalid");
+    }
+    return this.signSessionBytes(bytes);
+  }
+  /** Invoke the configured interactive approval strategy before session signing. */
+  async approveCredentialBytes(bytes) {
+    const strategy = this.config.signStrategy;
+    const session = this.currentTinyCloudSession() ?? this._activeServiceSession;
+    if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
+    const request = {
+      address: this.address ?? "",
+      chainId: this.session?.chainId ?? this._chainId,
+      message: new TextDecoder().decode(bytes),
+      type: "message",
+      purpose: "message"
+    };
+    const approval = isOpenKeyAutoSignStrategy(strategy) ? openKeyApproval(strategy) : strategy?.type === "callback" ? strategy.handler : void 0;
+    if (approval) {
+      const decision = await approval(request);
+      if (!decision.approved) throw new Error(decision.reason ?? "Credential signing was rejected");
+      if (decision.signature !== void 0 && !await verifyEip191MessageSignature(
+        request.message,
+        decision.signature,
+        request.address
+      )) {
+        throw new Error("OpenKey credential signature evidence is invalid");
+      }
+      return this.signSessionBytes(bytes);
+    }
+    if (strategy?.type === "auto-reject") throw new Error("Credential signing was rejected");
+    if (this.config.signer) {
+      await this.config.signer.signMessage(request.message);
+      return this.signSessionBytes(bytes);
+    }
+    throw new Error("Interactive OpenKey approval is not configured");
+  }
   /** Bind a session-signed invocation to the canonical service audience. */
   async bindInvocationAudience(authorization, audience) {
     const session = this.currentTinyCloudSession() ?? this._activeServiceSession;
@@ -3760,7 +4444,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
     });
     this.tc = new TinyCloud(this.auth, {
@@ -3813,7 +4497,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
     });
     this.tc = new TinyCloud(this.auth, {
@@ -6562,35 +7246,44 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (parentDelegation.disableSubDelegation) {
       throw new Error("Parent delegation does not allow sub-delegation");
     }
-    if (!params.path.startsWith(parentDelegation.path)) {
+    const parentResources = parentDelegation.resources ?? [{
+      service: parentDelegation.actions[0]?.split("/", 1)[0]?.replace(/^tinycloud\./, "") ?? "kv",
+      space: parentDelegation.spaceId,
+      path: parentDelegation.path,
+      actions: parentDelegation.actions
+    }];
+    const requestedResources = params.resources ?? [{
+      service: params.actions[0]?.split("/", 1)[0]?.replace(/^tinycloud\./, "") ?? "kv",
+      space: parentDelegation.spaceId,
+      path: params.path,
+      actions: params.actions
+    }];
+    const resourceIsContained = (parent, child) => {
+      const parentEncryption = parent.service === "encryption" || parent.service === "tinycloud.encryption";
+      const childEncryption = child.service === "encryption" || child.service === "tinycloud.encryption";
+      if (parentEncryption || childEncryption) return parentEncryption && childEncryption && parent.path === child.path && child.actions.every((action) => parent.actions.includes(action));
+      const pathContained = parent.path === child.path || parent.path.endsWith("/") && child.path.startsWith(parent.path) || child.path.startsWith(`${parent.path}/`);
+      return pathContained && child.actions.every((action) => parent.actions.includes(action));
+    };
+    if (requestedResources.length === 0 || requestedResources.some((child) => !parentResources.some((parent) => resourceIsContained(parent, child)))) {
       throw new Error(
-        `Sub-delegation path "${params.path}" must be within parent path "${parentDelegation.path}"`
+        "Sub-delegation resources exceed the received delegation"
       );
     }
-    const parentActions = new Set(parentDelegation.actions);
-    for (const action of params.actions) {
-      if (!parentActions.has(action)) {
-        throw new Error(
-          `Sub-delegation action "${action}" is not in parent's actions: ${parentDelegation.actions.join(", ")}`
-        );
-      }
-    }
     const now = /* @__PURE__ */ new Date();
     const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
     const requestedExpiry = new Date(now.getTime() + expiryMs);
     const actualExpiry = requestedExpiry > parentDelegation.expiry ? parentDelegation.expiry : requestedExpiry;
     const abilities = {};
-    const kvActions = params.actions.filter((a) => a.startsWith("tinycloud.kv/"));
-    const sqlActions = params.actions.filter((a) => a.startsWith("tinycloud.sql/"));
-    const duckdbActions = params.actions.filter((a) => a.startsWith("tinycloud.duckdb/"));
-    if (kvActions.length > 0) {
-      abilities.kv = { [params.path]: kvActions };
-    }
-    if (sqlActions.length > 0) {
-      abilities.sql = { [params.path]: sqlActions };
-    }
-    if (duckdbActions.length > 0) {
-      abilities.duckdb = { [params.path]: duckdbActions };
+    const rawAbilities = {};
+    for (const resource of requestedResources) {
+      const service = resource.service.replace(/^tinycloud\./, "");
+      if (service === "encryption") {
+        rawAbilities[resource.path] = [...resource.actions];
+        continue;
+      }
+      abilities[service] ?? (abilities[service] = {});
+      abilities[service][resource.path] = [...resource.actions];
     }
     const targetHost = parentDelegation.host ?? this.config.host;
     const prepared = this.wasmBindings.prepareSession({
@@ -6602,7 +7295,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       expirationTime: actualExpiry.toISOString(),
       spaceId: parentDelegation.spaceId,
       delegateUri: params.delegateDID,
-      parents: [parentDelegation.cid]
+      parents: [parentDelegation.cid],
+      ...Object.keys(rawAbilities).length > 0 ? { rawAbilities } : {}
     });
     const signature = await this.signer.signMessage(prepared.siwe);
     const subDelegationSession = this.wasmBindings.completeSessionSetup({
@@ -6620,14 +7314,20 @@ var _TinyCloudNode = class _TinyCloudNode {
       cid: subDelegationSession.delegationCid,
       delegationHeader: subDelegationSession.delegationHeader,
       spaceId: parentDelegation.spaceId,
-      path: params.path,
-      actions: params.actions,
+      path: requestedResources[0].path,
+      actions: requestedResources[0].actions,
       disableSubDelegation: params.disableSubDelegation ?? false,
       expiry: actualExpiry,
       delegateDID: params.delegateDID,
       ownerAddress: parentDelegation.ownerAddress,
       chainId: parentDelegation.chainId,
-      host: targetHost
+      host: targetHost,
+      resources: requestedResources.map((resource) => ({
+        service: resource.service.replace(/^tinycloud\./, ""),
+        space: resource.service.replace(/^tinycloud\./, "") === "encryption" ? "encryption" : resource.space ?? parentDelegation.spaceId,
+        path: resource.path,
+        actions: [...resource.actions]
+      }))
     };
   }
 };
@@ -6647,7 +7347,7 @@ var TinyCloudNode = _TinyCloudNode;
 // src/core.ts
 import {
   ACCOUNT_REGISTRY_PATH,
-  ACCOUNT_REGISTRY_SPACE as ACCOUNT_REGISTRY_SPACE2,
+  ACCOUNT_REGISTRY_SPACE as ACCOUNT_REGISTRY_SPACE3,
   DEFAULT_MANIFEST_SPACE as DEFAULT_MANIFEST_SPACE2,
   DEFAULT_MANIFEST_VERSION,
   VAULT_PERMISSION_SERVICE,
@@ -6670,8 +7370,341 @@ import {
 // src/delegation.ts
 import {
   canonicalizeRecapCaveats as canonicalizeRecapCaveats2,
+  decodeBase64Url,
   principalDidEquals as principalDidEquals3
 } from "@tinycloud/sdk-core";
+var SERVICE_BY_SHORT_NAME = {
+  kv: "tinycloud.kv",
+  sql: "tinycloud.sql",
+  duckdb: "tinycloud.duckdb",
+  hooks: "tinycloud.hooks"
+};
+function authorizationWithoutBearer(authorization) {
+  return authorization.replace(/^Bearer /i, "");
+}
+function normalizedHost(host) {
+  if (typeof host !== "string" || host.length === 0) {
+    throw new Error("Validated runtime delegation requires a non-empty host.");
+  }
+  return host.replace(/\/+$/, "");
+}
+function didPrincipalsMatch(left, right) {
+  try {
+    return principalDidEquals3(left, right);
+  } catch {
+    return left === right;
+  }
+}
+function compactUcanPayload(authorization) {
+  const compact = authorizationWithoutBearer(authorization);
+  const parts = compact.split(".");
+  if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+    throw new Error(
+      "Validated runtime delegation requires a compact UCAN authorization so its signed authority can be derived."
+    );
+  }
+  try {
+    const payload = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url(parts[1]))
+    );
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+      throw new Error("payload is not an object");
+    }
+    return payload;
+  } catch {
+    throw new Error(
+      "Validated runtime delegation authorization has an invalid compact UCAN payload."
+    );
+  }
+}
+function canonicalPermissionEntries(permissions) {
+  return permissions.map((permission) => ({
+    ...permission,
+    actions: [...permission.actions].sort()
+  })).sort(
+    (left, right) => left.service.localeCompare(right.service) || (left.space ?? "").localeCompare(right.space ?? "") || left.path.localeCompare(right.path) || left.actions.join("\0").localeCompare(right.actions.join("\0")) || canonicalizeRecapCaveats2(left.caveats).localeCompare(canonicalizeRecapCaveats2(right.caveats))
+  );
+}
+function signedCaveats(value) {
+  if (!Array.isArray(value) || value.some(
+    (caveat) => caveat === null || typeof caveat !== "object" || Array.isArray(caveat)
+  )) {
+    throw new Error("Validated runtime delegation has malformed signed ReCap caveats.");
+  }
+  const cloned = JSON.parse(JSON.stringify(value));
+  return canonicalizeRecapCaveats2(cloned) === canonicalizeRecapCaveats2(void 0) ? void 0 : cloned;
+}
+function groupedSignedEntries(service, space, path, abilities) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const [action, rawCaveats] of Object.entries(abilities)) {
+    const caveats = signedCaveats(rawCaveats);
+    const identity = canonicalizeRecapCaveats2(caveats);
+    const group = groups.get(identity) ?? { actions: [], caveats };
+    group.actions.push(action);
+    groups.set(identity, group);
+  }
+  return [...groups.values()].map((group) => ({
+    service,
+    ...space === void 0 ? {} : { space },
+    path,
+    actions: group.actions.sort(),
+    ...group.caveats === void 0 ? {} : { caveats: group.caveats }
+  }));
+}
+function signedAuthorityFromCompactUcan(authorization) {
+  const payload = compactUcanPayload(authorization);
+  if (typeof payload.aud !== "string" || payload.aud.length === 0) {
+    throw new Error("Validated runtime delegation is missing a signed audience.");
+  }
+  if (typeof payload.iss !== "string" || payload.iss.length === 0) {
+    throw new Error("Validated runtime delegation is missing a signed issuer.");
+  }
+  if (!Array.isArray(payload.prf) || payload.prf.some(
+    (proof) => typeof proof !== "string" || proof.length === 0
+  )) {
+    throw new Error("Validated runtime delegation has malformed signed proofs.");
+  }
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
+    throw new Error("Validated runtime delegation is missing a signed expiry.");
+  }
+  const expiry = new Date(payload.exp * 1e3);
+  if (Number.isNaN(expiry.getTime())) {
+    throw new Error("Validated runtime delegation has an invalid signed expiry.");
+  }
+  if (payload.att === null || typeof payload.att !== "object" || Array.isArray(payload.att)) {
+    throw new Error("Validated runtime delegation is missing a signed attenuation.");
+  }
+  const fact = Array.isArray(payload.fct) && payload.fct.length > 0 && payload.fct[0] !== null && typeof payload.fct[0] === "object" && !Array.isArray(payload.fct[0]) ? payload.fct[0] : void 0;
+  const remainingRedelegationDepth = fact?.remainingRedelegationDepth;
+  if (remainingRedelegationDepth !== void 0 && (!Number.isInteger(remainingRedelegationDepth) || remainingRedelegationDepth < 0 || remainingRedelegationDepth > 8)) {
+    throw new Error("Validated runtime delegation has invalid signed redelegation depth.");
+  }
+  const permissions = [];
+  for (const [resource, abilities] of Object.entries(payload.att)) {
+    if (abilities === null || typeof abilities !== "object" || Array.isArray(abilities)) {
+      throw new Error("Validated runtime delegation has an invalid signed attenuation.");
+    }
+    const abilityEntries = Object.entries(abilities);
+    if (abilityEntries.length === 0) {
+      throw new Error("Validated runtime delegation has an empty signed capability.");
+    }
+    if (resource.startsWith("urn:tinycloud:encryption:")) {
+      permissions.push(...groupedSignedEntries(
+        "tinycloud.encryption",
+        void 0,
+        resource,
+        abilities
+      ));
+      continue;
+    }
+    const nativeMatch = /^(tinycloud:[^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
+    const policyMatch = /^tinycloud:\/\/([^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
+    const match = nativeMatch ?? policyMatch;
+    if (!match) {
+      throw new Error(
+        `Validated runtime delegation has an unsupported signed resource '${resource}'.`
+      );
+    }
+    const [, space, shortService, path] = match;
+    const service = SERVICE_BY_SHORT_NAME[shortService];
+    if (service === void 0) {
+      throw new Error(
+        `Validated runtime delegation has an unsupported signed service '${shortService}'.`
+      );
+    }
+    permissions.push(...groupedSignedEntries(
+      service,
+      space,
+      path,
+      abilities
+    ));
+  }
+  if (permissions.length === 0) {
+    throw new Error("Validated runtime delegation has no signed capabilities.");
+  }
+  const canonicalPermissions = canonicalPermissionEntries(permissions);
+  const canonicalResources = canonicalPermissions.map((permission) => ({
+    service: permission.service === "tinycloud.encryption" ? "encryption" : permission.service.slice("tinycloud.".length),
+    space: permission.service === "tinycloud.encryption" ? "encryption" : permission.space,
+    path: permission.path,
+    actions: [...permission.actions],
+    ...permission.caveats === void 0 ? {} : { caveats: permission.caveats }
+  }));
+  return {
+    issuer: payload.iss,
+    audience: payload.aud,
+    expiry,
+    proofs: [...payload.prf],
+    ...remainingRedelegationDepth === void 0 ? {} : { remainingRedelegationDepth },
+    permissions: canonicalPermissions,
+    resources: canonicalResources
+  };
+}
+function canonicalResourcesFromPortableDelegation(delegation) {
+  if (delegation.resources !== void 0 && delegation.resources.length > 0) {
+    return delegation.resources.map((resource) => ({ ...resource, actions: [...resource.actions].sort() })).sort(
+      (left, right) => left.service.localeCompare(right.service) || left.space.localeCompare(right.space) || left.path.localeCompare(right.path) || left.actions.join("\0").localeCompare(right.actions.join("\0")) || canonicalizeRecapCaveats2(left.caveats).localeCompare(canonicalizeRecapCaveats2(right.caveats))
+    );
+  }
+  const byService = /* @__PURE__ */ new Map();
+  for (const action of delegation.actions) {
+    const [service] = action.split("/", 1);
+    const shortService = service.replace(/^tinycloud\./, "");
+    const values = byService.get(shortService) ?? [];
+    values.push(action);
+    byService.set(shortService, values);
+  }
+  return [...byService.entries()].map(([service, actions]) => ({
+    service,
+    space: service === "encryption" ? "encryption" : delegation.spaceId,
+    path: delegation.path,
+    actions: [...new Set(actions)].sort(),
+    ...delegation.caveats === void 0 ? {} : { caveats: delegation.caveats }
+  })).sort(
+    (left, right) => left.service.localeCompare(right.service) || left.space.localeCompare(right.space) || left.path.localeCompare(right.path)
+  );
+}
+function resourcesMatch(actual, expected) {
+  const comparable = (resource) => ({
+    ...resource,
+    caveats: canonicalizeRecapCaveats2(resource.caveats)
+  });
+  return JSON.stringify(actual.map(comparable)) === JSON.stringify(expected.map(comparable));
+}
+async function activateValidatedRuntimeDelegation(node, delegation, options) {
+  const host = normalizedHost(options.host);
+  if (delegation.host !== void 0 && normalizedHost(delegation.host) !== host) {
+    throw new Error(
+      `Runtime delegation host '${delegation.host}' does not match expected host '${options.host}'.`
+    );
+  }
+  if (!(delegation.expiry instanceof Date) || Number.isNaN(delegation.expiry.getTime())) {
+    throw new Error("Runtime delegation has an invalid expiry.");
+  }
+  if (delegation.expiry.getTime() <= Date.now()) {
+    throw new Error("Runtime delegation is expired.");
+  }
+  const authorization = delegation.delegationHeader?.Authorization;
+  if (typeof authorization !== "string" || authorization.length === 0) {
+    throw new Error("Runtime delegation is missing authorization bytes.");
+  }
+  const cid = node.computeDelegationCid(authorization);
+  if (cid !== delegation.cid) {
+    throw new Error("Runtime delegation CID does not match authorization bytes.");
+  }
+  const signed = signedAuthorityFromCompactUcan(authorization);
+  if (signed.expiry.getTime() <= Date.now()) {
+    throw new Error("Runtime delegation is expired.");
+  }
+  if (delegation.expiry.getTime() !== signed.expiry.getTime()) {
+    throw new Error("Runtime delegation expiry does not match signed authority.");
+  }
+  if (!didPrincipalsMatch(signed.audience, node.sessionDid)) {
+    throw new Error(
+      `Runtime delegation targets ${signed.audience} but this session is ${node.sessionDid}.`
+    );
+  }
+  if (!didPrincipalsMatch(delegation.delegateDID, signed.audience)) {
+    throw new Error("Runtime delegation audience does not match signed authority.");
+  }
+  const declaredResources = canonicalResourcesFromPortableDelegation(delegation);
+  if (!resourcesMatch(declaredResources, signed.resources)) {
+    throw new Error("Runtime delegation resources do not match signed authority.");
+  }
+  const previouslyInstalled = node.getRuntimePermissionDelegations().find((candidate) => candidate.cid === cid);
+  if (previouslyInstalled !== void 0 && previouslyInstalled.delegationHeader.Authorization !== authorization) {
+    throw new Error(
+      "A different authorization is already installed for this runtime delegation CID."
+    );
+  }
+  const primary = signed.resources[0];
+  const signedSpace = signed.permissions.find(
+    (permission) => permission.service !== "tinycloud.encryption"
+  )?.space;
+  const installedCandidate = {
+    cid,
+    delegationHeader: { Authorization: authorization },
+    ownerAddress: delegation.ownerAddress,
+    chainId: delegation.chainId,
+    delegatorDID: signed.issuer,
+    ...signed.proofs.length === 1 ? { parentCid: signed.proofs[0] } : {},
+    ...signed.remainingRedelegationDepth === void 0 ? {} : {
+      allowSubDelegation: signed.remainingRedelegationDepth > 0,
+      disableSubDelegation: signed.remainingRedelegationDepth === 0
+    },
+    authHeader: authorization,
+    spaceId: signedSpace ?? delegation.spaceId,
+    path: primary.path,
+    actions: [...primary.actions],
+    ...primary.caveats === void 0 ? {} : { caveats: primary.caveats },
+    resources: signed.resources.map((resource) => ({
+      ...resource,
+      actions: [...resource.actions]
+    })),
+    expiry: new Date(signed.expiry),
+    delegateDID: signed.audience,
+    host
+  };
+  if (node.isSessionOnly === true && typeof node.did === "string" && principalDidEquals3(node.did, node.sessionDid) && typeof node.useDelegation === "function") {
+    await node.useDelegation(installedCandidate);
+  } else {
+    await node.useRuntimeDelegation(installedCandidate);
+  }
+  const installed = node.getRuntimePermissionDelegations().find((candidate) => candidate.cid === cid);
+  if (!installed) {
+    throw new Error("Runtime delegation activation did not install the validated authority.");
+  }
+  if (installed.delegationHeader.Authorization !== authorization || !didPrincipalsMatch(installed.delegateDID, signed.audience) || installed.expiry.getTime() !== signed.expiry.getTime() || !resourcesMatch(
+    canonicalResourcesFromPortableDelegation(installed),
+    signed.resources
+  ) || normalizedHost(installed.host ?? "") !== host) {
+    throw new Error(
+      "Runtime delegation activation installed authority that differs from the validated authority."
+    );
+  }
+  return {
+    cid,
+    delegation: installed,
+    effectivePermissions: signed.permissions,
+    expiry: new Date(signed.expiry),
+    audience: signed.audience,
+    host: normalizedHost(installed.host ?? host)
+  };
+}
+async function activateCompactRuntimeDelegation(node, input) {
+  const authorization = input.authorization;
+  const cid = node.computeDelegationCid(authorization);
+  if (cid !== input.cid) {
+    throw new Error("Compact runtime delegation CID does not match authorization bytes.");
+  }
+  const signed = signedAuthorityFromCompactUcan(authorization);
+  const primary = signed.resources[0];
+  const signedSpace = signed.permissions.find(
+    (permission) => permission.service !== "tinycloud.encryption"
+  )?.space;
+  const delegation = {
+    cid,
+    delegationHeader: { Authorization: authorization },
+    ownerAddress: input.ownerAddress,
+    chainId: input.chainId,
+    delegatorDID: signed.issuer,
+    authHeader: authorization,
+    spaceId: signedSpace ?? primary.space,
+    path: primary.path,
+    actions: [...primary.actions],
+    ...primary.caveats === void 0 ? {} : { caveats: primary.caveats },
+    resources: signed.resources.map((resource) => ({
+      ...resource,
+      actions: [...resource.actions]
+    })),
+    expiry: new Date(signed.expiry),
+    delegateDID: signed.audience,
+    host: normalizedHost(input.host)
+  };
+  return activateValidatedRuntimeDelegation(node, delegation, {
+    host: input.host
+  });
+}
 function serializeDelegation(delegation) {
   return JSON.stringify({
     ...delegation,
@@ -6739,7 +7772,7 @@ import {
 import { ServiceContext as ServiceContext3 } from "@tinycloud/sdk-core";
 export {
   ACCOUNT_REGISTRY_PATH,
-  ACCOUNT_REGISTRY_SPACE2 as ACCOUNT_REGISTRY_SPACE,
+  ACCOUNT_REGISTRY_SPACE3 as ACCOUNT_REGISTRY_SPACE,
   AccountService,
   AutoApproveSpaceCreationHandler2 as AutoApproveSpaceCreationHandler,
   CapabilityKeyRegistry2 as CapabilityKeyRegistry,
@@ -6786,6 +7819,7 @@ export {
   VaultPublicSpaceKVActions,
   VersionCheckError,
   WasmKeyProvider,
+  activateCompactRuntimeDelegation,
   addressStorageKey,
   buildSpaceUri,
   canonicalizeAddress3 as canonicalizeAddress,