@tinycloud/node-sdk 2.11.0 → 2.11.1-beta.0

package/dist/core.d.cts

@@ -1,4 +1,4 @@
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerSharePolicyRegistrationReceipt, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterOwnerSharePolicyParams, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
-export { e as BootstrapWarning, C as CreateOwnerDelegationParams, D as DelegateToOptions, f as DelegateToResult, g as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, i as NodeUserAuthorization, j as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, l as RuntimePermissionGrantOptions, S as SecretPermissionHint, m as SecretReadInput, n as SecretReadResult, o as SignStrategy, T as TinyCloudNode, p as TinyCloudNodeConfig, U as UnsupportedSessionRestoreError, W as WasmKeyProvider, q as WasmKeyProviderConfig, s as createWasmKeyProvider, t as defaultSignStrategy, u as deserializeDelegation, w as serializeDelegation } from './core-Bq8TMY7Y.cjs';
+export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, G as serializeDelegation } from './core-C6Czyr52.cjs';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.d.ts

@@ -1,4 +1,4 @@
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerSharePolicyRegistrationReceipt, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterOwnerSharePolicyParams, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
-export { e as BootstrapWarning, C as CreateOwnerDelegationParams, D as DelegateToOptions, f as DelegateToResult, g as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, i as NodeUserAuthorization, j as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, l as RuntimePermissionGrantOptions, S as SecretPermissionHint, m as SecretReadInput, n as SecretReadResult, o as SignStrategy, T as TinyCloudNode, p as TinyCloudNodeConfig, U as UnsupportedSessionRestoreError, W as WasmKeyProvider, q as WasmKeyProviderConfig, s as createWasmKeyProvider, t as defaultSignStrategy, u as deserializeDelegation, w as serializeDelegation } from './core-Bq8TMY7Y.js';
+export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, G as serializeDelegation } from './core-C6Czyr52.js';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.js

@@ -1714,7 +1714,8 @@ import {
   resolveSecretPath as resolveSecretPath2,
   validateOwnerSharePolicyRegistrationBytes,
   validateShareDeliveryAuthorizationBytes,
-  verifyEip191MessageSignature
+  verifyEip191MessageSignature,
+  signCompactUcanRootAuthorization
 } from "@tinycloud/sdk-core";
 import {
   parsePermissionHint
@@ -2182,6 +2183,18 @@ var ROOT_DELEGATION_ACTIONS = [
   DUCKDB2.ALL
 ];
 var DEFAULT_SESSION_EXPIRATION_MS = EXPIRY3.SESSION_MS;
+function unifiedRootAttenuation(capabilities) {
+  const attenuation = {};
+  for (const capability of capabilities) {
+    if (attenuation[capability.resource] !== void 0) throw new Error("unified owner root contains a duplicate resource");
+    attenuation[capability.resource] = capability.kind === "encryption" ? { [capability.action]: [{}] } : Object.fromEntries(capability.actions.map((action) => [action, [{
+      type: "xyz.tinycloud.resource/selector",
+      kind: capability.selector,
+      value: capability.resource
+    }]]));
+  }
+  return attenuation;
+}
 function decodeAuthorizationBytes(authorization) {
   const encoded = authorization.replace(/^Bearer /i, "");
   const match = /^([A-Za-z0-9_-]+)(={1,2})?$/.exec(encoded);
@@ -2561,6 +2574,8 @@ var _TinyCloudNode = class _TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
+    /** Serializes account-registry writes for the active node instance. */
+    this.accountRegistryTail = Promise.resolve();
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -2957,6 +2972,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         "Cannot signIn() in session-only mode. Provide a privateKey in config to create your own space."
       );
     }
+    await this.accountRegistryTail;
     await this.wasmBindings.ensureInitialized?.();
     this._address = canonicalizeAddress2(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
@@ -3438,16 +3454,48 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
   }
   scheduleAccountRegistrySync() {
-    void this.withAccountRegistryRetry(async () => {
-      void this.account.index.ensure();
-      await this.writeManifestRegistryRecords();
-      if (this.currentSessionCanListSpaces()) {
-        const spaces = await this.account.spaces.syncAccessible();
-        if (!spaces.ok) {
-          throw new Error(`Failed to sync account spaces: ${spaces.error.message}`);
+    const session = this.currentTinyCloudSession();
+    if (!session || this.pendingAccountRegistrySync?.session === session) {
+      return;
+    }
+    const promise = this.enqueueAccountRegistryOperation(session, async () => {
+      await this.withAccountRegistryRetry(async () => {
+        if (this.currentTinyCloudSession() !== session) {
+          return;
+        }
+        await this.account.index.ensure();
+        if (this.currentTinyCloudSession() !== session) {
+          return;
+        }
+        await this.writeManifestRegistryRecords();
+        if (this.currentTinyCloudSession() !== session) {
+          return;
+        }
+        if (this.currentSessionCanListSpaces()) {
+          const spaces = await this.account.spaces.syncAccessible();
+          if (!spaces.ok) {
+            throw new Error(`Failed to sync account spaces: ${spaces.error.message}`);
+          }
         }
+      });
+    });
+    this.pendingAccountRegistrySync = { session, promise };
+    const clearPendingSync = () => {
+      if (this.pendingAccountRegistrySync?.promise === promise) {
+        this.pendingAccountRegistrySync = void 0;
+      }
+    };
+    void promise.then(clearPendingSync, clearPendingSync);
+  }
+  enqueueAccountRegistryOperation(session, task) {
+    const operation = this.accountRegistryTail.then(async () => {
+      if (this.currentTinyCloudSession() === session) {
+        await task();
       }
     });
+    this.accountRegistryTail = operation.catch(() => {
+    });
+    return operation;
   }
   /**
    * Whether the current primary session may invoke `tinycloud.space/list`.
@@ -3600,7 +3648,8 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @returns The hosted space URI.
    */
   async hostOwnedSpace(name) {
-    if (!this.auth || !this.auth.tinyCloudSession) {
+    const session = this.auth?.tinyCloudSession;
+    if (!this.auth || !session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const spaceId = this.ownedSpaceId(name);
@@ -3616,22 +3665,26 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const activation = await activateSessionWithHost2(
       host,
-      this.auth.tinyCloudSession.delegationHeader
+      session.delegationHeader
     );
     if (!activation.success || activation.skipped?.includes(spaceId)) {
       throw new Error(
         `Failed to activate session for owned space ${spaceId}: ${activation.error ?? "space was skipped"}`
       );
     }
-    void this.account.spaces.register({
-      spaceId,
-      name,
-      ownerDid: this.did,
-      type: "owned",
-      permissions: ["*"],
-      status: "active"
-    }).catch(() => {
-    });
+    try {
+      await this.enqueueAccountRegistryOperation(session, async () => {
+        await this.account.spaces.register({
+          spaceId,
+          name,
+          ownerDid: this.did,
+          type: "owned",
+          permissions: ["*"],
+          status: "active"
+        });
+      });
+    } catch {
+    }
     return spaceId;
   }
   /**
@@ -3666,23 +3719,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.auth.tinyCloudSession) {
       throw new Error("Not signed in. Call signIn() first.");
     }
+    await this.accountRegistryTail;
     const spaceId = this.ownedSpaceId(name);
     if (await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
-    const hosted = await this.hostOwnedSpace(name);
-    try {
-      await this.account.spaces.register({
-        spaceId,
-        name,
-        ownerDid: this.did,
-        type: "owned",
-        permissions: ["*"],
-        status: "active"
-      });
-    } catch {
-    }
-    return hosted;
+    return this.hostOwnedSpace(name);
   }
   /** Resolve and authenticate the owner encoded by an owned-space URI. */
   credentialSpaceOwnerDid(spaceId) {
@@ -4235,6 +4277,46 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
     return signBytesWithJwk(bytes, session.jwk);
   }
+  /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
+  async createUnifiedOwnerRoot(input) {
+    const ownerDid = this.credentialHolderDid;
+    if (input.ownerDid !== ownerDid) throw new Error("unified owner root signer does not match owner DID");
+    const facts = {
+      role: input.role,
+      mode: input.role === "policy-authority" ? "policy-source" : "conditional-mint",
+      ownerDid,
+      policyId: input.policyId,
+      policyDigestHex: input.policyDigestHex,
+      policyCid: input.policyCid,
+      contentSourceDigestHex: input.contentSourceDigestHex,
+      capabilityCeilingHashHex: input.capabilityCeilingHashHex,
+      nativeProjectionHashHex: input.nativeProjectionHashHex,
+      nodeAudience: input.nodeAudience,
+      ...input.role === "policy-enforcement" ? { enforcerDid: input.audienceDid } : {}
+    };
+    const root = await signCompactUcanRootAuthorization({
+      issuerDid: ownerDid,
+      audienceDid: input.audienceDid,
+      attenuation: unifiedRootAttenuation(input.capabilities),
+      facts: [facts],
+      notBefore: Math.floor(input.notBefore.getTime() / 1e3),
+      expiresAt: Math.floor(input.expiresAt.getTime() / 1e3),
+      nonce: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+      sign: (bytes) => this.signSessionBytes(bytes)
+    });
+    const kv = input.capabilities.find((capability) => capability.kind === "kv");
+    const resource = kv?.resource ?? "";
+    const marker = resource.indexOf("/kv/");
+    return {
+      cid: root.cid,
+      delegationHeader: { Authorization: root.authorization },
+      delegateDID: input.audienceDid,
+      spaceId: marker === -1 ? "" : resource.slice("tinycloud://".length, marker),
+      path: marker === -1 ? resource : resource.slice(marker + 4),
+      actions: kv?.actions ?? [],
+      expiry: input.expiresAt
+    };
+  }
   /** Apply only an already-enabled signing policy to the exact credential request. */
   async autoSignCredentialBytes(bytes) {
     const strategy = this.config.signStrategy;
@@ -7288,8 +7370,341 @@ import {
 // src/delegation.ts
 import {
   canonicalizeRecapCaveats as canonicalizeRecapCaveats2,
+  decodeBase64Url,
   principalDidEquals as principalDidEquals3
 } from "@tinycloud/sdk-core";
+var SERVICE_BY_SHORT_NAME = {
+  kv: "tinycloud.kv",
+  sql: "tinycloud.sql",
+  duckdb: "tinycloud.duckdb",
+  hooks: "tinycloud.hooks"
+};
+function authorizationWithoutBearer(authorization) {
+  return authorization.replace(/^Bearer /i, "");
+}
+function normalizedHost(host) {
+  if (typeof host !== "string" || host.length === 0) {
+    throw new Error("Validated runtime delegation requires a non-empty host.");
+  }
+  return host.replace(/\/+$/, "");
+}
+function didPrincipalsMatch(left, right) {
+  try {
+    return principalDidEquals3(left, right);
+  } catch {
+    return left === right;
+  }
+}
+function compactUcanPayload(authorization) {
+  const compact = authorizationWithoutBearer(authorization);
+  const parts = compact.split(".");
+  if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+    throw new Error(
+      "Validated runtime delegation requires a compact UCAN authorization so its signed authority can be derived."
+    );
+  }
+  try {
+    const payload = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url(parts[1]))
+    );
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+      throw new Error("payload is not an object");
+    }
+    return payload;
+  } catch {
+    throw new Error(
+      "Validated runtime delegation authorization has an invalid compact UCAN payload."
+    );
+  }
+}
+function canonicalPermissionEntries(permissions) {
+  return permissions.map((permission) => ({
+    ...permission,
+    actions: [...permission.actions].sort()
+  })).sort(
+    (left, right) => left.service.localeCompare(right.service) || (left.space ?? "").localeCompare(right.space ?? "") || left.path.localeCompare(right.path) || left.actions.join("\0").localeCompare(right.actions.join("\0")) || canonicalizeRecapCaveats2(left.caveats).localeCompare(canonicalizeRecapCaveats2(right.caveats))
+  );
+}
+function signedCaveats(value) {
+  if (!Array.isArray(value) || value.some(
+    (caveat) => caveat === null || typeof caveat !== "object" || Array.isArray(caveat)
+  )) {
+    throw new Error("Validated runtime delegation has malformed signed ReCap caveats.");
+  }
+  const cloned = JSON.parse(JSON.stringify(value));
+  return canonicalizeRecapCaveats2(cloned) === canonicalizeRecapCaveats2(void 0) ? void 0 : cloned;
+}
+function groupedSignedEntries(service, space, path, abilities) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const [action, rawCaveats] of Object.entries(abilities)) {
+    const caveats = signedCaveats(rawCaveats);
+    const identity = canonicalizeRecapCaveats2(caveats);
+    const group = groups.get(identity) ?? { actions: [], caveats };
+    group.actions.push(action);
+    groups.set(identity, group);
+  }
+  return [...groups.values()].map((group) => ({
+    service,
+    ...space === void 0 ? {} : { space },
+    path,
+    actions: group.actions.sort(),
+    ...group.caveats === void 0 ? {} : { caveats: group.caveats }
+  }));
+}
+function signedAuthorityFromCompactUcan(authorization) {
+  const payload = compactUcanPayload(authorization);
+  if (typeof payload.aud !== "string" || payload.aud.length === 0) {
+    throw new Error("Validated runtime delegation is missing a signed audience.");
+  }
+  if (typeof payload.iss !== "string" || payload.iss.length === 0) {
+    throw new Error("Validated runtime delegation is missing a signed issuer.");
+  }
+  if (!Array.isArray(payload.prf) || payload.prf.some(
+    (proof) => typeof proof !== "string" || proof.length === 0
+  )) {
+    throw new Error("Validated runtime delegation has malformed signed proofs.");
+  }
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
+    throw new Error("Validated runtime delegation is missing a signed expiry.");
+  }
+  const expiry = new Date(payload.exp * 1e3);
+  if (Number.isNaN(expiry.getTime())) {
+    throw new Error("Validated runtime delegation has an invalid signed expiry.");
+  }
+  if (payload.att === null || typeof payload.att !== "object" || Array.isArray(payload.att)) {
+    throw new Error("Validated runtime delegation is missing a signed attenuation.");
+  }
+  const fact = Array.isArray(payload.fct) && payload.fct.length > 0 && payload.fct[0] !== null && typeof payload.fct[0] === "object" && !Array.isArray(payload.fct[0]) ? payload.fct[0] : void 0;
+  const remainingRedelegationDepth = fact?.remainingRedelegationDepth;
+  if (remainingRedelegationDepth !== void 0 && (!Number.isInteger(remainingRedelegationDepth) || remainingRedelegationDepth < 0 || remainingRedelegationDepth > 8)) {
+    throw new Error("Validated runtime delegation has invalid signed redelegation depth.");
+  }
+  const permissions = [];
+  for (const [resource, abilities] of Object.entries(payload.att)) {
+    if (abilities === null || typeof abilities !== "object" || Array.isArray(abilities)) {
+      throw new Error("Validated runtime delegation has an invalid signed attenuation.");
+    }
+    const abilityEntries = Object.entries(abilities);
+    if (abilityEntries.length === 0) {
+      throw new Error("Validated runtime delegation has an empty signed capability.");
+    }
+    if (resource.startsWith("urn:tinycloud:encryption:")) {
+      permissions.push(...groupedSignedEntries(
+        "tinycloud.encryption",
+        void 0,
+        resource,
+        abilities
+      ));
+      continue;
+    }
+    const nativeMatch = /^(tinycloud:[^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
+    const policyMatch = /^tinycloud:\/\/([^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
+    const match = nativeMatch ?? policyMatch;
+    if (!match) {
+      throw new Error(
+        `Validated runtime delegation has an unsupported signed resource '${resource}'.`
+      );
+    }
+    const [, space, shortService, path] = match;
+    const service = SERVICE_BY_SHORT_NAME[shortService];
+    if (service === void 0) {
+      throw new Error(
+        `Validated runtime delegation has an unsupported signed service '${shortService}'.`
+      );
+    }
+    permissions.push(...groupedSignedEntries(
+      service,
+      space,
+      path,
+      abilities
+    ));
+  }
+  if (permissions.length === 0) {
+    throw new Error("Validated runtime delegation has no signed capabilities.");
+  }
+  const canonicalPermissions = canonicalPermissionEntries(permissions);
+  const canonicalResources = canonicalPermissions.map((permission) => ({
+    service: permission.service === "tinycloud.encryption" ? "encryption" : permission.service.slice("tinycloud.".length),
+    space: permission.service === "tinycloud.encryption" ? "encryption" : permission.space,
+    path: permission.path,
+    actions: [...permission.actions],
+    ...permission.caveats === void 0 ? {} : { caveats: permission.caveats }
+  }));
+  return {
+    issuer: payload.iss,
+    audience: payload.aud,
+    expiry,
+    proofs: [...payload.prf],
+    ...remainingRedelegationDepth === void 0 ? {} : { remainingRedelegationDepth },
+    permissions: canonicalPermissions,
+    resources: canonicalResources
+  };
+}
+function canonicalResourcesFromPortableDelegation(delegation) {
+  if (delegation.resources !== void 0 && delegation.resources.length > 0) {
+    return delegation.resources.map((resource) => ({ ...resource, actions: [...resource.actions].sort() })).sort(
+      (left, right) => left.service.localeCompare(right.service) || left.space.localeCompare(right.space) || left.path.localeCompare(right.path) || left.actions.join("\0").localeCompare(right.actions.join("\0")) || canonicalizeRecapCaveats2(left.caveats).localeCompare(canonicalizeRecapCaveats2(right.caveats))
+    );
+  }
+  const byService = /* @__PURE__ */ new Map();
+  for (const action of delegation.actions) {
+    const [service] = action.split("/", 1);
+    const shortService = service.replace(/^tinycloud\./, "");
+    const values = byService.get(shortService) ?? [];
+    values.push(action);
+    byService.set(shortService, values);
+  }
+  return [...byService.entries()].map(([service, actions]) => ({
+    service,
+    space: service === "encryption" ? "encryption" : delegation.spaceId,
+    path: delegation.path,
+    actions: [...new Set(actions)].sort(),
+    ...delegation.caveats === void 0 ? {} : { caveats: delegation.caveats }
+  })).sort(
+    (left, right) => left.service.localeCompare(right.service) || left.space.localeCompare(right.space) || left.path.localeCompare(right.path)
+  );
+}
+function resourcesMatch(actual, expected) {
+  const comparable = (resource) => ({
+    ...resource,
+    caveats: canonicalizeRecapCaveats2(resource.caveats)
+  });
+  return JSON.stringify(actual.map(comparable)) === JSON.stringify(expected.map(comparable));
+}
+async function activateValidatedRuntimeDelegation(node, delegation, options) {
+  const host = normalizedHost(options.host);
+  if (delegation.host !== void 0 && normalizedHost(delegation.host) !== host) {
+    throw new Error(
+      `Runtime delegation host '${delegation.host}' does not match expected host '${options.host}'.`
+    );
+  }
+  if (!(delegation.expiry instanceof Date) || Number.isNaN(delegation.expiry.getTime())) {
+    throw new Error("Runtime delegation has an invalid expiry.");
+  }
+  if (delegation.expiry.getTime() <= Date.now()) {
+    throw new Error("Runtime delegation is expired.");
+  }
+  const authorization = delegation.delegationHeader?.Authorization;
+  if (typeof authorization !== "string" || authorization.length === 0) {
+    throw new Error("Runtime delegation is missing authorization bytes.");
+  }
+  const cid = node.computeDelegationCid(authorization);
+  if (cid !== delegation.cid) {
+    throw new Error("Runtime delegation CID does not match authorization bytes.");
+  }
+  const signed = signedAuthorityFromCompactUcan(authorization);
+  if (signed.expiry.getTime() <= Date.now()) {
+    throw new Error("Runtime delegation is expired.");
+  }
+  if (delegation.expiry.getTime() !== signed.expiry.getTime()) {
+    throw new Error("Runtime delegation expiry does not match signed authority.");
+  }
+  if (!didPrincipalsMatch(signed.audience, node.sessionDid)) {
+    throw new Error(
+      `Runtime delegation targets ${signed.audience} but this session is ${node.sessionDid}.`
+    );
+  }
+  if (!didPrincipalsMatch(delegation.delegateDID, signed.audience)) {
+    throw new Error("Runtime delegation audience does not match signed authority.");
+  }
+  const declaredResources = canonicalResourcesFromPortableDelegation(delegation);
+  if (!resourcesMatch(declaredResources, signed.resources)) {
+    throw new Error("Runtime delegation resources do not match signed authority.");
+  }
+  const previouslyInstalled = node.getRuntimePermissionDelegations().find((candidate) => candidate.cid === cid);
+  if (previouslyInstalled !== void 0 && previouslyInstalled.delegationHeader.Authorization !== authorization) {
+    throw new Error(
+      "A different authorization is already installed for this runtime delegation CID."
+    );
+  }
+  const primary = signed.resources[0];
+  const signedSpace = signed.permissions.find(
+    (permission) => permission.service !== "tinycloud.encryption"
+  )?.space;
+  const installedCandidate = {
+    cid,
+    delegationHeader: { Authorization: authorization },
+    ownerAddress: delegation.ownerAddress,
+    chainId: delegation.chainId,
+    delegatorDID: signed.issuer,
+    ...signed.proofs.length === 1 ? { parentCid: signed.proofs[0] } : {},
+    ...signed.remainingRedelegationDepth === void 0 ? {} : {
+      allowSubDelegation: signed.remainingRedelegationDepth > 0,
+      disableSubDelegation: signed.remainingRedelegationDepth === 0
+    },
+    authHeader: authorization,
+    spaceId: signedSpace ?? delegation.spaceId,
+    path: primary.path,
+    actions: [...primary.actions],
+    ...primary.caveats === void 0 ? {} : { caveats: primary.caveats },
+    resources: signed.resources.map((resource) => ({
+      ...resource,
+      actions: [...resource.actions]
+    })),
+    expiry: new Date(signed.expiry),
+    delegateDID: signed.audience,
+    host
+  };
+  if (node.isSessionOnly === true && typeof node.did === "string" && principalDidEquals3(node.did, node.sessionDid) && typeof node.useDelegation === "function") {
+    await node.useDelegation(installedCandidate);
+  } else {
+    await node.useRuntimeDelegation(installedCandidate);
+  }
+  const installed = node.getRuntimePermissionDelegations().find((candidate) => candidate.cid === cid);
+  if (!installed) {
+    throw new Error("Runtime delegation activation did not install the validated authority.");
+  }
+  if (installed.delegationHeader.Authorization !== authorization || !didPrincipalsMatch(installed.delegateDID, signed.audience) || installed.expiry.getTime() !== signed.expiry.getTime() || !resourcesMatch(
+    canonicalResourcesFromPortableDelegation(installed),
+    signed.resources
+  ) || normalizedHost(installed.host ?? "") !== host) {
+    throw new Error(
+      "Runtime delegation activation installed authority that differs from the validated authority."
+    );
+  }
+  return {
+    cid,
+    delegation: installed,
+    effectivePermissions: signed.permissions,
+    expiry: new Date(signed.expiry),
+    audience: signed.audience,
+    host: normalizedHost(installed.host ?? host)
+  };
+}
+async function activateCompactRuntimeDelegation(node, input) {
+  const authorization = input.authorization;
+  const cid = node.computeDelegationCid(authorization);
+  if (cid !== input.cid) {
+    throw new Error("Compact runtime delegation CID does not match authorization bytes.");
+  }
+  const signed = signedAuthorityFromCompactUcan(authorization);
+  const primary = signed.resources[0];
+  const signedSpace = signed.permissions.find(
+    (permission) => permission.service !== "tinycloud.encryption"
+  )?.space;
+  const delegation = {
+    cid,
+    delegationHeader: { Authorization: authorization },
+    ownerAddress: input.ownerAddress,
+    chainId: input.chainId,
+    delegatorDID: signed.issuer,
+    authHeader: authorization,
+    spaceId: signedSpace ?? primary.space,
+    path: primary.path,
+    actions: [...primary.actions],
+    ...primary.caveats === void 0 ? {} : { caveats: primary.caveats },
+    resources: signed.resources.map((resource) => ({
+      ...resource,
+      actions: [...resource.actions]
+    })),
+    expiry: new Date(signed.expiry),
+    delegateDID: signed.audience,
+    host: normalizedHost(input.host)
+  };
+  return activateValidatedRuntimeDelegation(node, delegation, {
+    host: input.host
+  });
+}
 function serializeDelegation(delegation) {
   return JSON.stringify({
     ...delegation,
@@ -7404,6 +7819,7 @@ export {
   VaultPublicSpaceKVActions,
   VersionCheckError,
   WasmKeyProvider,
+  activateCompactRuntimeDelegation,
   addressStorageKey,
   buildSpaceUri,
   canonicalizeAddress3 as canonicalizeAddress,