@tinycloud/node-sdk 2.11.0 → 2.11.1-beta.0

package/dist/{core-Bq8TMY7Y.d.cts → core-C6Czyr52.d.cts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -828,6 +828,13 @@ interface ValidatedRuntimeDelegation {
     /** Host selected for, and used by, the runtime activation. */
     readonly host: string;
 }
+interface CompactRuntimeDelegationInput {
+    readonly authorization: string;
+    readonly cid: string;
+    readonly host: string;
+    readonly ownerAddress: string;
+    readonly chainId: number;
+}
 /**
  * CID-bind and activate one compact runtime delegation.
  *
@@ -839,6 +846,12 @@ interface ValidatedRuntimeDelegation {
 declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActivator, delegation: PortableDelegation, options: {
     host: string;
 }): Promise<ValidatedRuntimeDelegation>;
+/**
+ * Import compact UCAN bytes returned by an authority ceremony through the
+ * ordinary runtime-delegation activation path. All transport projections are
+ * derived from signed bytes before `/delegate` is called.
+ */
+declare function activateCompactRuntimeDelegation(node: RuntimeDelegationActivator, input: CompactRuntimeDelegationInput): Promise<ValidatedRuntimeDelegation>;
 /**
  * Turn a delegation REQUEST into a signed GRANT.
  *
@@ -1020,6 +1033,32 @@ type SecretReadResult = {
     status: "invalid_payload";
 };
 type CreateOwnerDelegationParams = CreateOwnerDelegationParams$1;
+interface UnifiedOwnerRootInput {
+    readonly ownerDid: string;
+    readonly role: "policy-authority" | "policy-enforcement";
+    readonly audienceDid: string;
+    readonly policyId: string;
+    readonly policyDigestHex: string;
+    readonly policyCid: string;
+    readonly contentSourceDigestHex: string;
+    readonly capabilityCeilingHashHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly notBefore: Date;
+    readonly expiresAt: Date;
+    readonly nodeAudience: string;
+    readonly capabilities: readonly UnifiedPolicyCapability[];
+}
+interface UnifiedOwnerRootReceipt {
+    readonly cid: string;
+    readonly delegationHeader: {
+        readonly Authorization: string;
+    };
+    readonly delegateDID: string;
+    readonly spaceId: string;
+    readonly path: string;
+    readonly actions: readonly string[];
+    readonly expiry: Date;
+}
 interface OwnerDelegationReceipt extends OwnerDelegationReceipt$1 {
     readonly delegation: Delegation;
     readonly nodeReceipt: {
@@ -1251,6 +1290,9 @@ declare class TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     private readonly confirmedHostedSpaceIds;
+    /** Serializes account-registry writes for the active node instance. */
+    private accountRegistryTail;
+    private pendingAccountRegistrySync?;
     /**
      * TinyCloudSession captured by {@link restoreSession} when there's no
      * auth-layer signer available (session-only mode used by OpenKey-backed
@@ -1457,6 +1499,7 @@ declare class TinyCloudNode {
     private registerPrimarySessionGrant;
     private writeManifestRegistryRecords;
     private scheduleAccountRegistrySync;
+    private enqueueAccountRegistryOperation;
     /**
      * Whether the current primary session may invoke `tinycloud.space/list`.
      *
@@ -1648,6 +1691,8 @@ declare class TinyCloudNode {
     invokeAny(entries: Parameters<InvokeAnyFunction$1>[1], facts?: Parameters<InvokeAnyFunction$1>[2]): ReturnType<InvokeAnyFunction$1>;
     /** Sign protocol bytes with the established in-memory session key. */
     signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
+    createUnifiedOwnerRoot(input: UnifiedOwnerRootInput): Promise<UnifiedOwnerRootReceipt>;
     /** Apply only an already-enabled signing policy to the exact credential request. */
     autoSignCredentialBytes(bytes: Uint8Array): Promise<Uint8Array | undefined>;
     /** Invoke the configured interactive approval strategy before session signing. */
@@ -2445,4 +2490,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type DelegateToResult as f, DelegatedAccess as g, type DelegationAuthority as h, NodeUserAuthorization as i, type NodeUserAuthorizationConfig as j, type RuntimeDelegationActivator as k, type RuntimePermissionGrantOptions as l, type SecretReadInput as m, type SecretReadResult as n, type SignStrategy as o, type TinyCloudNodeConfig as p, type WasmKeyProviderConfig as q, activateValidatedRuntimeDelegation as r, createWasmKeyProvider as s, defaultSignStrategy as t, deserializeDelegation as u, grantAuthRequest as v, serializeDelegation as w };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, serializeDelegation as G, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RuntimeDelegationActivator as l, type RuntimePermissionGrantOptions as m, type SecretReadInput as n, type SecretReadResult as o, type SignStrategy as p, type TinyCloudNodeConfig as q, type UnifiedOwnerRootReceipt as r, UnsupportedSessionRestoreError as s, type WasmKeyProviderConfig as t, activateCompactRuntimeDelegation as u, activateValidatedRuntimeDelegation as v, createWasmKeyProvider as w, defaultSignStrategy as x, deserializeDelegation as y, grantAuthRequest as z };

package/dist/{core-Bq8TMY7Y.d.ts → core-C6Czyr52.d.ts}

@@ -1,4 +1,4 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterOwnerSharePolicyParams, OwnerSharePolicyRegistrationReceipt, ShareDeliveryAuthorizationReceipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -828,6 +828,13 @@ interface ValidatedRuntimeDelegation {
     /** Host selected for, and used by, the runtime activation. */
     readonly host: string;
 }
+interface CompactRuntimeDelegationInput {
+    readonly authorization: string;
+    readonly cid: string;
+    readonly host: string;
+    readonly ownerAddress: string;
+    readonly chainId: number;
+}
 /**
  * CID-bind and activate one compact runtime delegation.
  *
@@ -839,6 +846,12 @@ interface ValidatedRuntimeDelegation {
 declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActivator, delegation: PortableDelegation, options: {
     host: string;
 }): Promise<ValidatedRuntimeDelegation>;
+/**
+ * Import compact UCAN bytes returned by an authority ceremony through the
+ * ordinary runtime-delegation activation path. All transport projections are
+ * derived from signed bytes before `/delegate` is called.
+ */
+declare function activateCompactRuntimeDelegation(node: RuntimeDelegationActivator, input: CompactRuntimeDelegationInput): Promise<ValidatedRuntimeDelegation>;
 /**
  * Turn a delegation REQUEST into a signed GRANT.
  *
@@ -1020,6 +1033,32 @@ type SecretReadResult = {
     status: "invalid_payload";
 };
 type CreateOwnerDelegationParams = CreateOwnerDelegationParams$1;
+interface UnifiedOwnerRootInput {
+    readonly ownerDid: string;
+    readonly role: "policy-authority" | "policy-enforcement";
+    readonly audienceDid: string;
+    readonly policyId: string;
+    readonly policyDigestHex: string;
+    readonly policyCid: string;
+    readonly contentSourceDigestHex: string;
+    readonly capabilityCeilingHashHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly notBefore: Date;
+    readonly expiresAt: Date;
+    readonly nodeAudience: string;
+    readonly capabilities: readonly UnifiedPolicyCapability[];
+}
+interface UnifiedOwnerRootReceipt {
+    readonly cid: string;
+    readonly delegationHeader: {
+        readonly Authorization: string;
+    };
+    readonly delegateDID: string;
+    readonly spaceId: string;
+    readonly path: string;
+    readonly actions: readonly string[];
+    readonly expiry: Date;
+}
 interface OwnerDelegationReceipt extends OwnerDelegationReceipt$1 {
     readonly delegation: Delegation;
     readonly nodeReceipt: {
@@ -1251,6 +1290,9 @@ declare class TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     private readonly confirmedHostedSpaceIds;
+    /** Serializes account-registry writes for the active node instance. */
+    private accountRegistryTail;
+    private pendingAccountRegistrySync?;
     /**
      * TinyCloudSession captured by {@link restoreSession} when there's no
      * auth-layer signer available (session-only mode used by OpenKey-backed
@@ -1457,6 +1499,7 @@ declare class TinyCloudNode {
     private registerPrimarySessionGrant;
     private writeManifestRegistryRecords;
     private scheduleAccountRegistrySync;
+    private enqueueAccountRegistryOperation;
     /**
      * Whether the current primary session may invoke `tinycloud.space/list`.
      *
@@ -1648,6 +1691,8 @@ declare class TinyCloudNode {
     invokeAny(entries: Parameters<InvokeAnyFunction$1>[1], facts?: Parameters<InvokeAnyFunction$1>[2]): ReturnType<InvokeAnyFunction$1>;
     /** Sign protocol bytes with the established in-memory session key. */
     signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
+    createUnifiedOwnerRoot(input: UnifiedOwnerRootInput): Promise<UnifiedOwnerRootReceipt>;
     /** Apply only an already-enabled signing policy to the exact credential request. */
     autoSignCredentialBytes(bytes: Uint8Array): Promise<Uint8Array | undefined>;
     /** Invoke the configured interactive approval strategy before session signing. */
@@ -2445,4 +2490,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type DelegateToResult as f, DelegatedAccess as g, type DelegationAuthority as h, NodeUserAuthorization as i, type NodeUserAuthorizationConfig as j, type RuntimeDelegationActivator as k, type RuntimePermissionGrantOptions as l, type SecretReadInput as m, type SecretReadResult as n, type SignStrategy as o, type TinyCloudNodeConfig as p, type WasmKeyProviderConfig as q, activateValidatedRuntimeDelegation as r, createWasmKeyProvider as s, defaultSignStrategy as t, deserializeDelegation as u, grantAuthRequest as v, serializeDelegation as w };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, serializeDelegation as G, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RuntimeDelegationActivator as l, type RuntimePermissionGrantOptions as m, type SecretReadInput as n, type SecretReadResult as o, type SignStrategy as p, type TinyCloudNodeConfig as q, type UnifiedOwnerRootReceipt as r, UnsupportedSessionRestoreError as s, type WasmKeyProviderConfig as t, activateCompactRuntimeDelegation as u, activateValidatedRuntimeDelegation as v, createWasmKeyProvider as w, defaultSignStrategy as x, deserializeDelegation as y, grantAuthRequest as z };