@tinycloud/node-sdk 2.11.0 → 3.0.0-beta.0

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, CapabilityPresentationEnvelopeV1, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, OwnerSharePolicyRegistrationReceipt, ParsedNetworkId, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterOwnerSharePolicyParams, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CreateOwnerDelegationParams, D as DelegateToOptions, f as DelegateToResult, g as DelegatedAccess, h as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, i as NodeUserAuthorization, j as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, k as RuntimeDelegationActivator, l as RuntimePermissionGrantOptions, S as SecretPermissionHint, m as SecretReadInput, n as SecretReadResult, o as SignStrategy, T as TinyCloudNode, p as TinyCloudNodeConfig, U as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, q as WasmKeyProviderConfig, r as activateValidatedRuntimeDelegation, s as createWasmKeyProvider, t as defaultSignStrategy, u as deserializeDelegation, v as grantAuthRequest, w as serializeDelegation } from './core-Bq8TMY7Y.cjs';
+export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, l as RuntimeDelegationActivator, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, v as activateValidatedRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, z as grantAuthRequest, G as serializeDelegation } from './core-C6Czyr52.cjs';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, CapabilityPresentationEnvelopeV1, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, OwnerSharePolicyRegistrationReceipt, ParsedNetworkId, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterOwnerSharePolicyParams, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CreateOwnerDelegationParams, D as DelegateToOptions, f as DelegateToResult, g as DelegatedAccess, h as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, i as NodeUserAuthorization, j as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, k as RuntimeDelegationActivator, l as RuntimePermissionGrantOptions, S as SecretPermissionHint, m as SecretReadInput, n as SecretReadResult, o as SignStrategy, T as TinyCloudNode, p as TinyCloudNodeConfig, U as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, q as WasmKeyProviderConfig, r as activateValidatedRuntimeDelegation, s as createWasmKeyProvider, t as defaultSignStrategy, u as deserializeDelegation, v as grantAuthRequest, w as serializeDelegation } from './core-Bq8TMY7Y.js';
+export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, l as RuntimeDelegationActivator, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, v as activateValidatedRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, z as grantAuthRequest, G as serializeDelegation } from './core-C6Czyr52.js';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/index.js

@@ -17214,7 +17214,8 @@ import {
   resolveSecretPath as resolveSecretPath2,
   validateOwnerSharePolicyRegistrationBytes,
   validateShareDeliveryAuthorizationBytes,
-  verifyEip191MessageSignature
+  verifyEip191MessageSignature,
+  signCompactUcanRootAuthorization
 } from "@tinycloud/sdk-core";
 import {
   parsePermissionHint
@@ -19192,6 +19193,18 @@ var ROOT_DELEGATION_ACTIONS = [
   DUCKDB2.ALL
 ];
 var DEFAULT_SESSION_EXPIRATION_MS = EXPIRY3.SESSION_MS;
+function unifiedRootAttenuation(capabilities) {
+  const attenuation = {};
+  for (const capability of capabilities) {
+    if (attenuation[capability.resource] !== void 0) throw new Error("unified owner root contains a duplicate resource");
+    attenuation[capability.resource] = capability.kind === "encryption" ? { [capability.action]: [{}] } : Object.fromEntries(capability.actions.map((action) => [action, [{
+      type: "xyz.tinycloud.resource/selector",
+      kind: capability.selector,
+      value: capability.resource
+    }]]));
+  }
+  return attenuation;
+}
 function decodeAuthorizationBytes(authorization) {
   const encoded = authorization.replace(/^Bearer /i, "");
   const match = /^([A-Za-z0-9_-]+)(={1,2})?$/.exec(encoded);
@@ -19571,6 +19584,8 @@ var _TinyCloudNode = class _TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
+    /** Serializes account-registry writes for the active node instance. */
+    this.accountRegistryTail = Promise.resolve();
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -19967,6 +19982,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         "Cannot signIn() in session-only mode. Provide a privateKey in config to create your own space."
       );
     }
+    await this.accountRegistryTail;
     await this.wasmBindings.ensureInitialized?.();
     this._address = canonicalizeAddress2(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
@@ -20448,16 +20464,48 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
   }
   scheduleAccountRegistrySync() {
-    void this.withAccountRegistryRetry(async () => {
-      void this.account.index.ensure();
-      await this.writeManifestRegistryRecords();
-      if (this.currentSessionCanListSpaces()) {
-        const spaces = await this.account.spaces.syncAccessible();
-        if (!spaces.ok) {
-          throw new Error(`Failed to sync account spaces: ${spaces.error.message}`);
+    const session = this.currentTinyCloudSession();
+    if (!session || this.pendingAccountRegistrySync?.session === session) {
+      return;
+    }
+    const promise = this.enqueueAccountRegistryOperation(session, async () => {
+      await this.withAccountRegistryRetry(async () => {
+        if (this.currentTinyCloudSession() !== session) {
+          return;
+        }
+        await this.account.index.ensure();
+        if (this.currentTinyCloudSession() !== session) {
+          return;
+        }
+        await this.writeManifestRegistryRecords();
+        if (this.currentTinyCloudSession() !== session) {
+          return;
         }
+        if (this.currentSessionCanListSpaces()) {
+          const spaces = await this.account.spaces.syncAccessible();
+          if (!spaces.ok) {
+            throw new Error(`Failed to sync account spaces: ${spaces.error.message}`);
+          }
+        }
+      });
+    });
+    this.pendingAccountRegistrySync = { session, promise };
+    const clearPendingSync = () => {
+      if (this.pendingAccountRegistrySync?.promise === promise) {
+        this.pendingAccountRegistrySync = void 0;
+      }
+    };
+    void promise.then(clearPendingSync, clearPendingSync);
+  }
+  enqueueAccountRegistryOperation(session, task) {
+    const operation = this.accountRegistryTail.then(async () => {
+      if (this.currentTinyCloudSession() === session) {
+        await task();
       }
     });
+    this.accountRegistryTail = operation.catch(() => {
+    });
+    return operation;
   }
   /**
    * Whether the current primary session may invoke `tinycloud.space/list`.
@@ -20610,7 +20658,8 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @returns The hosted space URI.
    */
   async hostOwnedSpace(name) {
-    if (!this.auth || !this.auth.tinyCloudSession) {
+    const session = this.auth?.tinyCloudSession;
+    if (!this.auth || !session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const spaceId = this.ownedSpaceId(name);
@@ -20626,22 +20675,26 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const activation = await activateSessionWithHost2(
       host,
-      this.auth.tinyCloudSession.delegationHeader
+      session.delegationHeader
     );
     if (!activation.success || activation.skipped?.includes(spaceId)) {
       throw new Error(
         `Failed to activate session for owned space ${spaceId}: ${activation.error ?? "space was skipped"}`
       );
     }
-    void this.account.spaces.register({
-      spaceId,
-      name,
-      ownerDid: this.did,
-      type: "owned",
-      permissions: ["*"],
-      status: "active"
-    }).catch(() => {
-    });
+    try {
+      await this.enqueueAccountRegistryOperation(session, async () => {
+        await this.account.spaces.register({
+          spaceId,
+          name,
+          ownerDid: this.did,
+          type: "owned",
+          permissions: ["*"],
+          status: "active"
+        });
+      });
+    } catch {
+    }
     return spaceId;
   }
   /**
@@ -20676,23 +20729,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.auth.tinyCloudSession) {
       throw new Error("Not signed in. Call signIn() first.");
     }
+    await this.accountRegistryTail;
     const spaceId = this.ownedSpaceId(name);
     if (await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
-    const hosted = await this.hostOwnedSpace(name);
-    try {
-      await this.account.spaces.register({
-        spaceId,
-        name,
-        ownerDid: this.did,
-        type: "owned",
-        permissions: ["*"],
-        status: "active"
-      });
-    } catch {
-    }
-    return hosted;
+    return this.hostOwnedSpace(name);
   }
   /** Resolve and authenticate the owner encoded by an owned-space URI. */
   credentialSpaceOwnerDid(spaceId) {
@@ -21245,6 +21287,46 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
     return signBytesWithJwk(bytes, session.jwk);
   }
+  /** Author a proofless Policy/v3 owner root with the authenticated holder key. */
+  async createUnifiedOwnerRoot(input) {
+    const ownerDid = this.credentialHolderDid;
+    if (input.ownerDid !== ownerDid) throw new Error("unified owner root signer does not match owner DID");
+    const facts = {
+      role: input.role,
+      mode: input.role === "policy-authority" ? "policy-source" : "conditional-mint",
+      ownerDid,
+      policyId: input.policyId,
+      policyDigestHex: input.policyDigestHex,
+      policyCid: input.policyCid,
+      contentSourceDigestHex: input.contentSourceDigestHex,
+      capabilityCeilingHashHex: input.capabilityCeilingHashHex,
+      nativeProjectionHashHex: input.nativeProjectionHashHex,
+      nodeAudience: input.nodeAudience,
+      ...input.role === "policy-enforcement" ? { enforcerDid: input.audienceDid } : {}
+    };
+    const root = await signCompactUcanRootAuthorization({
+      issuerDid: ownerDid,
+      audienceDid: input.audienceDid,
+      attenuation: unifiedRootAttenuation(input.capabilities),
+      facts: [facts],
+      notBefore: Math.floor(input.notBefore.getTime() / 1e3),
+      expiresAt: Math.floor(input.expiresAt.getTime() / 1e3),
+      nonce: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+      sign: (bytes) => this.signSessionBytes(bytes)
+    });
+    const kv = input.capabilities.find((capability) => capability.kind === "kv");
+    const resource = kv?.resource ?? "";
+    const marker = resource.indexOf("/kv/");
+    return {
+      cid: root.cid,
+      delegationHeader: { Authorization: root.authorization },
+      delegateDID: input.audienceDid,
+      spaceId: marker === -1 ? "" : resource.slice("tinycloud://".length, marker),
+      path: marker === -1 ? resource : resource.slice(marker + 4),
+      actions: kv?.actions ?? [],
+      expiry: input.expiresAt
+    };
+  }
   /** Apply only an already-enabled signing policy to the exact credential request. */
   async autoSignCredentialBytes(bytes) {
     const strategy = this.config.signStrategy;
@@ -24498,6 +24580,7 @@ import {
 // src/delegation.ts
 import {
   canonicalizeRecapCaveats as canonicalizeRecapCaveats2,
+  decodeBase64Url,
   principalDidEquals as principalDidEquals3
 } from "@tinycloud/sdk-core";
 var SERVICE_BY_SHORT_NAME = {
@@ -24532,7 +24615,7 @@ function compactUcanPayload(authorization) {
   }
   try {
     const payload = JSON.parse(
-      Buffer.from(parts[1], "base64url").toString("utf8")
+      new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url(parts[1]))
     );
     if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
       throw new Error("payload is not an object");
@@ -24624,7 +24707,9 @@ function signedAuthorityFromCompactUcan(authorization) {
       ));
       continue;
     }
-    const match = /^(tinycloud:[^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
+    const nativeMatch = /^(tinycloud:[^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
+    const policyMatch = /^tinycloud:\/\/([^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
+    const match = nativeMatch ?? policyMatch;
     if (!match) {
       throw new Error(
         `Validated runtime delegation has an unsupported signed resource '${resource}'.`
@@ -24796,6 +24881,40 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
     host: normalizedHost(installed.host ?? host)
   };
 }
+async function activateCompactRuntimeDelegation(node, input) {
+  const authorization = input.authorization;
+  const cid = node.computeDelegationCid(authorization);
+  if (cid !== input.cid) {
+    throw new Error("Compact runtime delegation CID does not match authorization bytes.");
+  }
+  const signed2 = signedAuthorityFromCompactUcan(authorization);
+  const primary = signed2.resources[0];
+  const signedSpace = signed2.permissions.find(
+    (permission) => permission.service !== "tinycloud.encryption"
+  )?.space;
+  const delegation = {
+    cid,
+    delegationHeader: { Authorization: authorization },
+    ownerAddress: input.ownerAddress,
+    chainId: input.chainId,
+    delegatorDID: signed2.issuer,
+    authHeader: authorization,
+    spaceId: signedSpace ?? primary.space,
+    path: primary.path,
+    actions: [...primary.actions],
+    ...primary.caveats === void 0 ? {} : { caveats: primary.caveats },
+    resources: signed2.resources.map((resource) => ({
+      ...resource,
+      actions: [...resource.actions]
+    })),
+    expiry: new Date(signed2.expiry),
+    delegateDID: signed2.audience,
+    host: normalizedHost(input.host)
+  };
+  return activateValidatedRuntimeDelegation(node, delegation, {
+    host: input.host
+  });
+}
 async function grantAuthRequest(authority, request, options) {
   if (request.kind !== "tinycloud.auth.request") {
     throw new Error(
@@ -24999,6 +25118,7 @@ export {
   VaultPublicSpaceKVActions,
   VersionCheckError,
   WasmKeyProvider,
+  activateCompactRuntimeDelegation,
   activateValidatedRuntimeDelegation,
   addressStorageKey,
   buildCanonicalDecryptRequest,