@tinycloud/node-sdk 2.2.0-beta.1 → 2.2.0-beta.11

package/dist/core.js

@@ -207,7 +207,9 @@ import {
   DEFAULT_MANIFEST_SPACE,
   composeManifestRequest,
   resourceCapabilitiesToAbilitiesMap,
-  resourceCapabilitiesToSpaceAbilitiesMap
+  resourceCapabilitiesToSpaceAbilitiesMap,
+  resolveTinyCloudHosts,
+  EXPIRY
 } from "@tinycloud/sdk-core";
 
 // src/authorization/strategies.ts
@@ -267,12 +269,12 @@ var NodeUserAuthorization = class {
         ]
       }
     };
-    this.sessionExpirationMs = config.sessionExpirationMs ?? 60 * 60 * 1e3;
+    this.sessionExpirationMs = config.sessionExpirationMs ?? EXPIRY.SESSION_MS;
     this.autoCreateSpace = config.autoCreateSpace ?? false;
     this.spaceCreationHandler = config.spaceCreationHandler;
-    this.tinycloudHosts = config.tinycloudHosts ?? [
-      "https://node.tinycloud.xyz"
-    ];
+    this.tinycloudHosts = config.tinycloudHosts;
+    this.tinycloudRegistryUrl = config.tinycloudRegistryUrl;
+    this.tinycloudFallbackHosts = config.tinycloudFallbackHosts;
     this.enablePublicSpace = config.enablePublicSpace ?? true;
     this.nonce = config.nonce;
     this.siweConfig = config.siweConfig;
@@ -293,6 +295,9 @@ var NodeUserAuthorization = class {
   get capabilityRequest() {
     return this.getCapabilityRequest();
   }
+  get hosts() {
+    return this.tinycloudHosts ? [...this.tinycloudHosts] : [];
+  }
   /**
    * Install or replace the stored manifest. Takes effect on the next
    * `signIn()` call — the current session (if any) is not touched.
@@ -317,6 +322,26 @@ var NodeUserAuthorization = class {
   get tinyCloudSession() {
     return this._tinyCloudSession;
   }
+  async resolveTinyCloudHostsForSignIn(address, chainId) {
+    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
+      return;
+    }
+    const subject = `did:pkh:eip155:${chainId}:${address}`;
+    const resolved = await resolveTinyCloudHosts(subject, {
+      registryUrl: this.tinycloudRegistryUrl,
+      fallbackHosts: this.tinycloudFallbackHosts
+    });
+    this.tinycloudHosts = resolved.hosts;
+  }
+  requireTinyCloudHosts() {
+    if (!this.tinycloudHosts || this.tinycloudHosts.length === 0) {
+      throw new Error("TinyCloud hosts have not been resolved. Call signIn() first.");
+    }
+    return this.tinycloudHosts;
+  }
+  get primaryTinyCloudHost() {
+    return this.requireTinyCloudHosts()[0];
+  }
   get nodeFeatures() {
     return this._nodeFeatures;
   }
@@ -448,7 +473,7 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession || !this._address || !this._chainId) {
       throw new Error("Must be signed in to host space");
     }
-    const host = this.tinycloudHosts[0];
+    const host = this.primaryTinyCloudHost;
     const spaceId = targetSpaceId ?? this._tinyCloudSession.spaceId;
     const peerId = await fetchPeerId(host, spaceId);
     const siwe = this.wasm.generateHostSIWEMessage({
@@ -490,7 +515,7 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession) {
       throw new Error("Must be signed in to ensure space exists");
     }
-    const host = this.tinycloudHosts[0];
+    const host = this.primaryTinyCloudHost;
     const primarySpaceId = this._tinyCloudSession.spaceId;
     const result = await activateSessionWithHost(
       host,
@@ -599,6 +624,7 @@ var NodeUserAuthorization = class {
     this._chainId = await this.signer.getChainId();
     const address = this.wasm.ensureEip55(this._address);
     const chainId = this._chainId;
+    await this.resolveTinyCloudHostsForSignIn(address, chainId);
     const keyId = `session-${Date.now()}`;
     this.sessionManager.renameSessionKeyId("default", keyId);
     const jwkString = this.sessionManager.jwk(keyId);
@@ -677,7 +703,7 @@ var NodeUserAuthorization = class {
     this._address = address;
     this._chainId = chainId;
     const nodeInfo = await checkNodeInfo(
-      this.tinycloudHosts[0],
+      this.primaryTinyCloudHost,
       this.wasm.protocolVersion()
     );
     this._nodeFeatures = nodeInfo.features;
@@ -793,6 +819,7 @@ var NodeUserAuthorization = class {
     });
     const address = this.wasm.ensureEip55(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
+    await this.resolveTinyCloudHostsForSignIn(address, chainId);
     const clientSession = {
       address,
       walletAddress: address,
@@ -842,7 +869,7 @@ var NodeUserAuthorization = class {
     this._address = address;
     this._chainId = chainId;
     const nodeInfo = await checkNodeInfo(
-      this.tinycloudHosts[0],
+      this.primaryTinyCloudHost,
       this.wasm.protocolVersion()
     );
     this._nodeFeatures = nodeInfo.features;
@@ -933,6 +960,7 @@ import {
   DuckDbService as DuckDbService2,
   HooksService as HooksService2,
   DataVaultService,
+  SecretsService,
   createVaultCrypto,
   ServiceContext as ServiceContext2,
   SilentNotificationHandler,
@@ -945,10 +973,11 @@ import {
   ACCOUNT_REGISTRY_SPACE,
   PermissionNotInManifestError,
   SessionExpiredError,
-  expandActionShortNames,
+  expandPermissionEntries as expandPermissionEntriesCore,
   isCapabilitySubset,
   parseRecapCapabilities,
-  SERVICE_LONG_TO_SHORT
+  SERVICE_LONG_TO_SHORT,
+  EXPIRY as EXPIRY3
 } from "@tinycloud/sdk-core";
 
 // src/DelegatedAccess.ts
@@ -1033,6 +1062,24 @@ var DelegatedAccess = class {
   get hooks() {
     return this._hooks;
   }
+  /**
+   * Export the handles needed to rehydrate this activated delegation via
+   * `TinyCloudNode.restoreSession(...)` in another process or after a
+   * restart.
+   *
+   * See `RestorableSession` for lifetime caveats.
+   */
+  get restorable() {
+    return {
+      delegationHeader: this.session.delegationHeader,
+      delegationCid: this.session.delegationCid,
+      spaceId: this.session.spaceId,
+      jwk: this.session.jwk,
+      verificationMethod: this.session.verificationMethod,
+      address: this.session.address,
+      chainId: this.session.chainId
+    };
+  }
 };
 
 // src/keys/WasmKeyProvider.ts
@@ -1113,7 +1160,8 @@ function createWasmKeyProvider(sessionManager) {
 // src/delegateToHelpers.ts
 import {
   parseExpiry,
-  SiweMessage
+  SiweMessage,
+  EXPIRY as EXPIRY2
 } from "@tinycloud/sdk-core";
 function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   const byService = /* @__PURE__ */ new Map();
@@ -1145,9 +1193,10 @@ function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   }
   return entries;
 }
+var DEFAULT_DELEGATION_EXPIRY_MS = EXPIRY2.SESSION_MS;
 function resolveExpiryMs(expiry) {
   if (expiry === void 0) {
-    return 60 * 60 * 1e3;
+    return DEFAULT_DELEGATION_EXPIRY_MS;
   }
   if (typeof expiry === "number") {
     if (!Number.isFinite(expiry) || expiry <= 0) {
@@ -1173,8 +1222,155 @@ function extractSiweExpiration(siwe) {
   return d;
 }
 
+// src/NodeSecretsService.ts
+import {
+  ErrorCodes,
+  resolveSecretPath,
+  resolveManifest
+} from "@tinycloud/sdk-core";
+var SECRETS_SPACE = "secrets";
+function ok() {
+  return { ok: true, data: void 0 };
+}
+function secretsError(code, message, cause) {
+  return {
+    ok: false,
+    error: {
+      code,
+      service: "secrets",
+      message,
+      ...cause ? { cause } : {}
+    }
+  };
+}
+function displayActionUrn(action) {
+  return action === "put" ? "tinycloud.vault/write" : "tinycloud.vault/delete";
+}
+function kvActionUrn(action) {
+  return `tinycloud.kv/${action}`;
+}
+function vaultMutationAction(action) {
+  return action === "put" ? "write" : "delete";
+}
+function secretPermissionEntries(name, options, action) {
+  const secretPath = resolveSecretPath(name, options);
+  return [
+    {
+      service: "tinycloud.vault",
+      space: SECRETS_SPACE,
+      path: secretPath.vaultKey,
+      actions: [vaultMutationAction(action)],
+      skipPrefix: true
+    }
+  ];
+}
+function isSecretsSpace(space) {
+  return space === SECRETS_SPACE || space.endsWith(`:${SECRETS_SPACE}`);
+}
+var NodeSecretsService = class {
+  constructor(config) {
+    this.config = config;
+    this.shouldRestoreUnlock = false;
+  }
+  get vault() {
+    return this.service.vault;
+  }
+  get isUnlocked() {
+    return this.service.isUnlocked;
+  }
+  async unlock(signer) {
+    const effectiveSigner = signer ?? this.config.getUnlockSigner?.();
+    if (effectiveSigner !== void 0) {
+      this.unlockSigner = effectiveSigner;
+    }
+    const result = await this.service.unlock(effectiveSigner);
+    if (result.ok) {
+      this.shouldRestoreUnlock = true;
+    }
+    return result;
+  }
+  lock() {
+    this.shouldRestoreUnlock = false;
+    this.service.lock();
+  }
+  get(name, options) {
+    return options === void 0 ? this.service.get(name) : this.service.get(name, options);
+  }
+  async put(name, value, options) {
+    const permission = await this.ensureMutationPermission(name, options, "put");
+    if (!permission.ok) return permission;
+    return options === void 0 ? this.service.put(name, value) : this.service.put(name, value, options);
+  }
+  async delete(name, options) {
+    const permission = await this.ensureMutationPermission(name, options, "del");
+    if (!permission.ok) return permission;
+    return options === void 0 ? this.service.delete(name) : this.service.delete(name, options);
+  }
+  list(options) {
+    return options === void 0 ? this.service.list() : this.service.list(options);
+  }
+  get service() {
+    return this.config.getService();
+  }
+  async ensureMutationPermission(name, options, action) {
+    let permissionEntries;
+    try {
+      permissionEntries = secretPermissionEntries(name, options, action);
+    } catch (error) {
+      return secretsError(
+        ErrorCodes.INVALID_INPUT,
+        error instanceof Error ? error.message : String(error),
+        error instanceof Error ? error : void 0
+      );
+    }
+    if (this.hasMutationPermission(name, options, action)) {
+      return ok();
+    }
+    if (!this.config.canEscalate()) {
+      return secretsError(
+        ErrorCodes.PERMISSION_DENIED,
+        `Cannot autosign ${displayActionUrn(action)} for ${name}; TinyCloudNode needs wallet mode with a signer or privateKey.`
+      );
+    }
+    try {
+      await this.config.grantPermissions(permissionEntries);
+      return this.restoreUnlockAfterEscalation();
+    } catch (error) {
+      return secretsError(
+        ErrorCodes.PERMISSION_DENIED,
+        error instanceof Error ? error.message : `Autosign escalation for ${displayActionUrn(action)} on ${name} failed.`,
+        error instanceof Error ? error : void 0
+      );
+    }
+  }
+  async restoreUnlockAfterEscalation() {
+    if (!this.shouldRestoreUnlock) {
+      return ok();
+    }
+    return this.service.unlock(this.unlockSigner);
+  }
+  hasMutationPermission(name, options, action) {
+    const manifest = this.config.getManifest();
+    if (manifest === void 0) {
+      return false;
+    }
+    const manifests = Array.isArray(manifest) ? manifest : [manifest];
+    const requiredAction = kvActionUrn(action);
+    const secretPath = resolveSecretPath(name, options);
+    return manifests.some((entry) => {
+      const resolved = resolveManifest(entry);
+      return ["keys", "vault"].every(
+        (base) => resolved.resources.some(
+          (resource) => resource.service === "tinycloud.kv" && isSecretsSpace(resource.space) && resource.path === secretPath.permissionPaths[base] && resource.actions.includes(requiredAction)
+        )
+      );
+    });
+  }
+};
+
 // src/TinyCloudNode.ts
 var DEFAULT_HOST = "https://node.tinycloud.xyz";
+var DEFAULT_SESSION_EXPIRATION_MS = EXPIRY3.SESSION_MS;
 var _TinyCloudNode = class _TinyCloudNode {
   /**
    * Create a new TinyCloudNode instance.
@@ -1204,6 +1400,31 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.auth = null;
     this.tc = null;
     this._chainId = 1;
+    this.runtimePermissionGrants = [];
+    this.invokeWithRuntimePermissions = (session, service, path, action, facts) => {
+      return this.wasmBindings.invoke(
+        this.selectInvocationSession(session, service, path, action),
+        service,
+        path,
+        action,
+        facts
+      );
+    };
+    this.invokeAnyWithRuntimePermissions = (session, entries, facts) => {
+      if (!this.wasmBindings.invokeAny) {
+        throw new Error("WASM binding does not support invokeAny");
+      }
+      const grant = this.findGrantForOperations(
+        entries.map((entry) => ({
+          spaceId: entry.spaceId,
+          service: this.invocationServiceName(entry.service),
+          path: entry.path,
+          action: entry.action
+        }))
+      );
+      return this.wasmBindings.invokeAny(grant?.session ?? session, entries, facts);
+    };
+    this.explicitHost = config.host;
     this.config = {
       ...config,
       host: config.host ?? DEFAULT_HOST
@@ -1238,7 +1459,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._sharingService = new SharingService({
       hosts: [this.config.host],
       // session: undefined - not needed for receive()
-      invoke: this.wasmBindings.invoke,
+      invoke: this.invokeWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis),
       keyProvider: this._keyProvider,
       registry: this._capabilityRegistry,
@@ -1285,7 +1506,6 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @internal
    */
   setupAuth(config) {
-    const host = this.config.host;
     this.auth = new NodeUserAuthorization({
       signer: this.signer,
       signStrategy: { type: "auto-sign" },
@@ -1293,8 +1513,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionStorage: config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
       spacePrefix: config.prefix,
-      sessionExpirationMs: config.sessionExpirationMs ?? 60 * 60 * 1e3,
-      tinycloudHosts: [host],
+      sessionExpirationMs: config.sessionExpirationMs ?? DEFAULT_SESSION_EXPIRATION_MS,
+      tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
+      tinycloudRegistryUrl: config.tinycloudRegistryUrl,
+      tinycloudFallbackHosts: config.tinycloudFallbackHosts,
       autoCreateSpace: config.autoCreateSpace,
       enablePublicSpace: config.enablePublicSpace ?? true,
       spaceCreationHandler: config.spaceCreationHandler,
@@ -1305,9 +1527,15 @@ var _TinyCloudNode = class _TinyCloudNode {
       includeAccountRegistryPermissions: config.includeAccountRegistryPermissions
     });
     this.tc = new TinyCloud(this.auth, {
-      invokeAny: this.wasmBindings.invokeAny
+      invokeAny: this.invokeAnyWithRuntimePermissions
     });
   }
+  syncResolvedHostFromAuth() {
+    const host = this.auth?.hosts[0];
+    if (host) {
+      this.config.host = host;
+    }
+  }
   /**
    * Install or replace the manifest that drives the SIWE recap at
    * sign-in. Takes effect on the next `signIn()` call — the current
@@ -1345,6 +1573,10 @@ var _TinyCloudNode = class _TinyCloudNode {
   get capabilityRequest() {
     return this.auth?.capabilityRequest;
   }
+  get hosts() {
+    const authHosts = this.auth?.hosts ?? [];
+    return authHosts.length > 0 ? authHosts : [this.config.host];
+  }
   /**
    * Get the primary identity DID for this user.
    * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -1415,8 +1647,14 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._sql = void 0;
     this._duckdb = void 0;
     this._hooks = void 0;
+    this._vault = void 0;
+    this._baseSecrets = void 0;
+    this._secrets = void 0;
+    this._spaceService = void 0;
     this._serviceContext = void 0;
+    this.runtimePermissionGrants = [];
     await this.tc.signIn(options);
+    this.syncResolvedHostFromAuth();
     this.initializeServices();
     await this.writeManifestRegistryRecords();
     this.notificationHandler.success("Successfully signed in");
@@ -1436,7 +1674,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Manifest registry write requires wallet mode");
     }
     const accountSpaceId = this.ownedSpaceId(ACCOUNT_REGISTRY_SPACE);
-    await this.auth.hostOwnedSpace(accountSpaceId);
+    await this.ensureOwnedSpaceHosted(accountSpaceId);
     const accountKV = this.spaces.get(accountSpaceId).kv;
     for (const record of request.registryRecords) {
       const result = await accountKV.put(record.key, {
@@ -1451,6 +1689,39 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     }
   }
+  async ensureOwnedSpaceHosted(spaceId) {
+    if (!this.auth) {
+      throw new Error("Owned space hosting requires wallet mode");
+    }
+    const session = this.auth.tinyCloudSession;
+    if (!session) {
+      throw new Error("Owned space hosting requires an active session");
+    }
+    const host = this.hosts[0] ?? this.config.host;
+    if (!host) {
+      throw new Error("Owned space hosting requires a TinyCloud host");
+    }
+    const activation = await activateSessionWithHost2(host, session.delegationHeader);
+    if (activation.success && !activation.skipped?.includes(spaceId)) {
+      return;
+    }
+    if (!activation.success && activation.status !== 404) {
+      throw new Error(
+        `Failed to check owned space ${spaceId}: ${activation.error ?? activation.status}`
+      );
+    }
+    const created = await this.auth.hostOwnedSpace(spaceId);
+    if (!created) {
+      throw new Error(`Failed to create owned space: ${spaceId}`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+    const retry = await activateSessionWithHost2(host, session.delegationHeader);
+    if (!retry.success || retry.skipped?.includes(spaceId)) {
+      throw new Error(
+        `Failed to activate session after creating owned space ${spaceId}: ${retry.error ?? "space was skipped"}`
+      );
+    }
+  }
   /**
    * Restore a previously established session from stored delegation data.
    *
@@ -1466,7 +1737,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._sql = void 0;
     this._duckdb = void 0;
     this._hooks = void 0;
+    this._vault = void 0;
+    this._baseSecrets = void 0;
+    this._secrets = void 0;
+    this._spaceService = void 0;
     this._serviceContext = void 0;
+    this.runtimePermissionGrants = [];
     if (sessionData.address) {
       this._address = sessionData.address;
     }
@@ -1474,8 +1750,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       this._chainId = sessionData.chainId;
     }
     this._serviceContext = new ServiceContext2({
-      invoke: this.wasmBindings.invoke,
-      invokeAny: this.wasmBindings.invokeAny,
+      invoke: this.invokeWithRuntimePermissions,
+      invokeAny: this.invokeAnyWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [this.config.host]
     });
@@ -1499,41 +1775,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       jwk: sessionData.jwk
     };
     this._serviceContext.setSession(serviceSession);
-    const wasm = this.wasmBindings;
-    const vaultCrypto = createVaultCrypto({
-      vault_encrypt: wasm.vault_encrypt,
-      vault_decrypt: wasm.vault_decrypt,
-      vault_derive_key: wasm.vault_derive_key,
-      vault_x25519_from_seed: wasm.vault_x25519_from_seed,
-      vault_x25519_dh: wasm.vault_x25519_dh,
-      vault_random_bytes: wasm.vault_random_bytes,
-      vault_sha256: wasm.vault_sha256
-    });
-    const self = this;
-    this._vault = new DataVaultService({
-      spaceId: sessionData.spaceId,
-      crypto: vaultCrypto,
-      tc: {
-        kv: this._kv,
-        ensurePublicSpace: async () => {
-          try {
-            await self.ensurePublicSpace();
-            return { ok: true, data: void 0 };
-          } catch (error) {
-            return { ok: false, error: { code: "STORAGE_ERROR", message: error instanceof Error ? error.message : String(error), service: "vault" } };
-          }
-        },
-        get publicKV() {
-          return self._publicKV ?? self.tc.publicKV;
-        },
-        readPublicSpace: (host, spaceId, key) => TinyCloud.readPublicSpace(host, spaceId, key),
-        makePublicSpaceId: TinyCloud.makePublicSpaceId,
-        did: this.did,
-        address: sessionData.address ?? this._address ?? "",
-        chainId: sessionData.chainId ?? this._chainId,
-        hosts: [this.config.host]
-      }
-    });
+    this._vault = this.createVaultService(sessionData.spaceId, this._kv);
     this._vault.initialize(this._serviceContext);
     this._serviceContext.registerService("vault", this._vault);
     this.initializeV2Services(serviceSession);
@@ -1568,7 +1810,6 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Wallet already connected. Cannot connect another wallet.");
     }
     const prefix = options?.prefix ?? "default";
-    const host = this.config.host;
     if (!_TinyCloudNode.nodeDefaults) {
       throw new Error(
         "connectWallet() requires PrivateKeySigner. Use connectSigner() instead, or import from '@tinycloud/node-sdk' (not '/core') for automatic Node.js defaults."
@@ -1582,8 +1823,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionStorage: options?.sessionStorage ?? this.config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
       spacePrefix: prefix,
-      sessionExpirationMs: this.config.sessionExpirationMs ?? 60 * 60 * 1e3,
-      tinycloudHosts: [host],
+      sessionExpirationMs: this.config.sessionExpirationMs ?? DEFAULT_SESSION_EXPIRATION_MS,
+      tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
+      tinycloudRegistryUrl: this.config.tinycloudRegistryUrl,
+      tinycloudFallbackHosts: this.config.tinycloudFallbackHosts,
       autoCreateSpace: this.config.autoCreateSpace,
       enablePublicSpace: this.config.enablePublicSpace ?? true,
       spaceCreationHandler: this.config.spaceCreationHandler,
@@ -1594,7 +1837,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       includeAccountRegistryPermissions: this.config.includeAccountRegistryPermissions
     });
     this.tc = new TinyCloud(this.auth, {
-      invokeAny: this.wasmBindings.invokeAny
+      invokeAny: this.invokeAnyWithRuntimePermissions
     });
     this.config.prefix = prefix;
   }
@@ -1616,7 +1859,6 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Signer already connected. Cannot connect another signer.");
     }
     const prefix = options?.prefix ?? "default";
-    const host = this.config.host;
     this.signer = signer;
     this.auth = new NodeUserAuthorization({
       signer: this.signer,
@@ -1625,8 +1867,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionStorage: options?.sessionStorage ?? this.config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
       spacePrefix: prefix,
-      sessionExpirationMs: this.config.sessionExpirationMs ?? 60 * 60 * 1e3,
-      tinycloudHosts: [host],
+      sessionExpirationMs: this.config.sessionExpirationMs ?? DEFAULT_SESSION_EXPIRATION_MS,
+      tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
+      tinycloudRegistryUrl: this.config.tinycloudRegistryUrl,
+      tinycloudFallbackHosts: this.config.tinycloudFallbackHosts,
       autoCreateSpace: this.config.autoCreateSpace,
       enablePublicSpace: this.config.enablePublicSpace ?? true,
       spaceCreationHandler: this.config.spaceCreationHandler,
@@ -1637,7 +1881,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       includeAccountRegistryPermissions: this.config.includeAccountRegistryPermissions
     });
     this.tc = new TinyCloud(this.auth, {
-      invokeAny: this.wasmBindings.invokeAny
+      invokeAny: this.invokeAnyWithRuntimePermissions
     });
     this.config.prefix = prefix;
   }
@@ -1650,10 +1894,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       return;
     }
-    this.tc.initializeServices(this.wasmBindings.invoke, [this.config.host]);
+    this.tc.initializeServices(this.invokeWithRuntimePermissions, [this.config.host]);
     this._serviceContext = new ServiceContext2({
-      invoke: this.wasmBindings.invoke,
-      invokeAny: this.wasmBindings.invokeAny,
+      invoke: this.invokeWithRuntimePermissions,
+      invokeAny: this.invokeAnyWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [this.config.host]
     });
@@ -1683,6 +1927,28 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     this._serviceContext.setSession(serviceSession);
     this.tc.serviceContext.setSession(serviceSession);
+    this._vault = this.createVaultService(session.spaceId, this._kv);
+    this._vault.initialize(this._serviceContext);
+    this._serviceContext.registerService("vault", this._vault);
+    this.initializeV2Services(serviceSession);
+  }
+  createSpaceScopedKVService(spaceId) {
+    const kvService = new KVService2({});
+    if (this._serviceContext) {
+      const spaceScopedContext = new ServiceContext2({
+        invoke: this._serviceContext.invoke,
+        fetch: this._serviceContext.fetch,
+        hosts: this._serviceContext.hosts
+      });
+      const session = this._serviceContext.session;
+      if (session) {
+        spaceScopedContext.setSession({ ...session, spaceId });
+      }
+      kvService.initialize(spaceScopedContext);
+    }
+    return kvService;
+  }
+  createVaultService(spaceId, kv) {
     const wasm = this.wasmBindings;
     const vaultCrypto = createVaultCrypto({
       vault_encrypt: wasm.vault_encrypt,
@@ -1694,11 +1960,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       vault_sha256: wasm.vault_sha256
     });
     const self = this;
-    this._vault = new DataVaultService({
-      spaceId: session.spaceId,
+    return new DataVaultService({
+      spaceId,
       crypto: vaultCrypto,
       tc: {
-        kv: this._kv,
+        kv,
         ensurePublicSpace: async () => {
           try {
             await self.ensurePublicSpace();
@@ -1710,17 +1976,14 @@ var _TinyCloudNode = class _TinyCloudNode {
         get publicKV() {
           return self._publicKV ?? self.tc.publicKV;
         },
-        readPublicSpace: (host, spaceId, key) => TinyCloud.readPublicSpace(host, spaceId, key),
+        readPublicSpace: (host, targetSpaceId, key) => TinyCloud.readPublicSpace(host, targetSpaceId, key),
         makePublicSpaceId: TinyCloud.makePublicSpaceId,
         did: this.did,
-        address: this._address,
+        address: this._address ?? "",
         chainId: this._chainId,
         hosts: [this.config.host]
       }
     });
-    this._vault.initialize(this._serviceContext);
-    this._serviceContext.registerService("vault", this._vault);
-    this.initializeV2Services(serviceSession);
   }
   /**
    * Initialize the v2 delegation system services.
@@ -1804,7 +2067,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._delegationManager = new DelegationManager({
       hosts: [this.config.host],
       session: serviceSession,
-      invoke: this.wasmBindings.invoke,
+      invoke: this.invokeWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis)
     });
     this._spaceService = new SpaceService({
@@ -1815,20 +2078,15 @@ var _TinyCloudNode = class _TinyCloudNode {
       capabilityRegistry: this._capabilityRegistry,
       userDid: this.did,
       createKVService: (spaceId) => {
-        const kvService = new KVService2({});
+        return this.createSpaceScopedKVService(spaceId);
+      },
+      createVaultService: (spaceId) => {
+        const kvService = this.createSpaceScopedKVService(spaceId);
+        const vaultService = this.createVaultService(spaceId, kvService);
         if (this._serviceContext) {
-          const spaceScopedContext = new ServiceContext2({
-            invoke: this._serviceContext.invoke,
-            fetch: this._serviceContext.fetch,
-            hosts: this._serviceContext.hosts
-          });
-          const session = this._serviceContext.session;
-          if (session) {
-            spaceScopedContext.setSession({ ...session, spaceId });
-          }
-          kvService.initialize(spaceScopedContext);
+          vaultService.initialize(this._serviceContext);
         }
-        return kvService;
+        return vaultService;
       },
       // Enable space.delegations.create() via SIWE-based delegation
       createDelegation: async (params) => {
@@ -1885,7 +2143,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @internal
    */
   getSessionExpiry() {
-    const expirationMs = this.config.sessionExpirationMs ?? 60 * 60 * 1e3;
+    const expirationMs = this.config.sessionExpirationMs ?? DEFAULT_SESSION_EXPIRATION_MS;
     return new Date(Date.now() + expirationMs);
   }
   /**
@@ -2042,6 +2300,34 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return this._sql;
   }
+  /**
+   * Get an SQL service scoped to a specific space.
+   *
+   * Mirrors {@link SpaceService}'s per-space KV factory: clones the active
+   * service context and overrides its session's spaceId so that subsequent
+   * `sql/<dbName>/<action>` invocations route to that space. Useful when
+   * the caller already holds a delegation covering the target space (e.g.
+   * via {@link grantRuntimePermissions} or {@link useRuntimeDelegation})
+   * but the SDK's per-space SQL surface isn't otherwise exposed.
+   *
+   * Does NOT auto-create the space.
+   *
+   * @param spaceId - Full space URI (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`).
+   */
+  sqlForSpace(spaceId) {
+    if (!this._serviceContext || !this._serviceContext.session) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    const sql = new SQLService2({});
+    const spaceScopedContext = new ServiceContext2({
+      invoke: this._serviceContext.invoke,
+      fetch: this._serviceContext.fetch,
+      hosts: this._serviceContext.hosts
+    });
+    spaceScopedContext.setSession({ ...this._serviceContext.session, spaceId });
+    sql.initialize(spaceScopedContext);
+    return sql;
+  }
   /**
    * DuckDB database operations on this user's space.
    */
@@ -2065,6 +2351,33 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return this._vault;
   }
+  /**
+   * App-facing secrets API backed by the `secrets` space vault.
+   */
+  get secrets() {
+    if (!this._spaceService) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    if (!this._secrets) {
+      this._secrets = new NodeSecretsService({
+        getService: () => this.getBaseSecrets(),
+        getManifest: () => this.manifest,
+        grantPermissions: (additional) => this.grantRuntimePermissions(additional),
+        canEscalate: () => this.signer !== void 0 && this.tc !== void 0,
+        getUnlockSigner: () => this.signer ?? void 0
+      });
+    }
+    return this._secrets;
+  }
+  getBaseSecrets() {
+    if (!this._spaceService) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    if (!this._baseSecrets) {
+      this._baseSecrets = new SecretsService(() => this.space("secrets").vault);
+    }
+    return this._baseSecrets;
+  }
   /**
    * Hooks write stream subscription API.
    */
@@ -2135,6 +2448,171 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
   }
+  /**
+   * Check whether the current session or an approved runtime delegation covers
+   * every requested permission.
+   */
+  hasRuntimePermissions(permissions) {
+    const session = this.auth?.tinyCloudSession;
+    if (!session || !Array.isArray(permissions) || permissions.length === 0) {
+      return false;
+    }
+    const expanded = this.expandPermissionEntries(permissions);
+    if (this.sessionCoversPermissionEntries(session, expanded)) {
+      return true;
+    }
+    return this.findRuntimeGrantsForPermissionEntries(expanded, session).length > 0;
+  }
+  /**
+   * Return installed runtime permission delegations. When `permissions` is
+   * provided, only delegations currently covering those permissions are
+   * returned. Base-session manifest permissions are not represented here.
+   */
+  getRuntimePermissionDelegations(permissions) {
+    this.pruneExpiredRuntimePermissionGrants();
+    if (permissions === void 0) {
+      return this.runtimePermissionGrants.map((grant) => grant.delegation);
+    }
+    const session = this.auth?.tinyCloudSession;
+    if (!session || !Array.isArray(permissions) || permissions.length === 0) {
+      return [];
+    }
+    const expanded = this.expandPermissionEntries(permissions);
+    return this.findRuntimeGrantsForPermissionEntries(expanded, session).map(
+      (grant) => grant.delegation
+    );
+  }
+  /**
+   * Install a portable runtime permission delegation into this SDK instance so
+   * matching service calls and downstream `delegateTo()` calls can use it.
+   */
+  async useRuntimeDelegation(delegation) {
+    const session = this.auth?.tinyCloudSession;
+    if (!session) {
+      throw new SessionExpiredError(/* @__PURE__ */ new Date(0));
+    }
+    if (delegation.expiry.getTime() <= Date.now()) {
+      throw new SessionExpiredError(delegation.expiry);
+    }
+    const expectedDids = /* @__PURE__ */ new Set([session.verificationMethod, this.sessionDid]);
+    if (!expectedDids.has(delegation.delegateDID)) {
+      throw new Error(
+        `Runtime delegation targets ${delegation.delegateDID} but this session key is ${session.verificationMethod}.`
+      );
+    }
+    const targetHost = delegation.host ?? this.config.host;
+    const activateResult = await activateSessionWithHost2(
+      targetHost,
+      delegation.delegationHeader
+    );
+    if (!activateResult.success) {
+      throw new Error(
+        `Failed to activate runtime permission delegation: ${activateResult.error}`
+      );
+    }
+    this.runtimePermissionGrants = this.runtimePermissionGrants.filter(
+      (grant) => grant.delegation.cid !== delegation.cid
+    );
+    this.runtimePermissionGrants.push(
+      this.runtimeGrantFromDelegation(delegation, session)
+    );
+  }
+  /**
+   * Store additional permissions as narrow delegations to the current session
+   * key. Future service invocations automatically use a stored delegation when
+   * its `(space, service, path, action)` covers the request.
+   */
+  async grantRuntimePermissions(permissions, options) {
+    if (!Array.isArray(permissions) || permissions.length === 0) {
+      throw new Error("grantRuntimePermissions requires a non-empty permissions array");
+    }
+    const session = this.auth?.tinyCloudSession;
+    if (!session) {
+      throw new SessionExpiredError(/* @__PURE__ */ new Date(0));
+    }
+    const sessionExpiry = extractSiweExpiration(session.siwe);
+    if (sessionExpiry !== void 0) {
+      const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
+      if (sessionExpiry.getTime() <= Date.now() + marginMs) {
+        throw new SessionExpiredError(sessionExpiry);
+      }
+    }
+    const expanded = this.expandPermissionEntries(permissions);
+    if (this.sessionCoversPermissionEntries(session, expanded)) {
+      return [];
+    }
+    const existingGrants = this.findRuntimeGrantsForPermissionEntries(expanded, session);
+    if (existingGrants.length > 0) {
+      return existingGrants.map((grant) => grant.delegation);
+    }
+    if (!this.signer) {
+      throw new Error(
+        "grantRuntimePermissions requires wallet mode with a signer or privateKey."
+      );
+    }
+    const bySpace = /* @__PURE__ */ new Map();
+    for (const entry of expanded) {
+      const spaceId = this.resolvePermissionSpace(entry.space, session);
+      const current = bySpace.get(spaceId) ?? [];
+      current.push(entry);
+      bySpace.set(spaceId, current);
+    }
+    const now = /* @__PURE__ */ new Date();
+    const requestedExpiryMs = resolveExpiryMs(options?.expiry);
+    let expiresAt = new Date(now.getTime() + requestedExpiryMs);
+    if (sessionExpiry !== void 0 && sessionExpiry < expiresAt) {
+      expiresAt = sessionExpiry;
+    }
+    const delegations = [];
+    for (const [spaceId, entries] of bySpace) {
+      const abilities = this.permissionsToAbilities(entries);
+      const prepared = this.wasmBindings.prepareSession({
+        abilities,
+        address: this.wasmBindings.ensureEip55(session.address),
+        chainId: session.chainId,
+        domain: this.siweDomain,
+        issuedAt: now.toISOString(),
+        expirationTime: expiresAt.toISOString(),
+        spaceId,
+        jwk: session.jwk
+      });
+      const signature = await this.signer.signMessage(prepared.siwe);
+      const delegatedSession = this.wasmBindings.completeSessionSetup({
+        ...prepared,
+        signature
+      });
+      const activateResult = await activateSessionWithHost2(
+        this.config.host,
+        delegatedSession.delegationHeader
+      );
+      if (!activateResult.success) {
+        throw new Error(
+          `Failed to activate runtime permission delegation: ${activateResult.error}`
+        );
+      }
+      const delegation = this.runtimeDelegationFromSession(
+        delegatedSession,
+        entries,
+        spaceId,
+        session,
+        expiresAt
+      );
+      this.runtimePermissionGrants.push({
+        session: {
+          delegationHeader: delegatedSession.delegationHeader,
+          delegationCid: delegatedSession.delegationCid,
+          spaceId,
+          verificationMethod: session.verificationMethod,
+          jwk: session.jwk
+        },
+        delegation,
+        operations: this.permissionOperations(entries, spaceId),
+        expiresAt
+      });
+      delegations.push(delegation);
+    }
+    return delegations;
+  }
   /**
    * Get the DelegationManager for delegation CRUD operations.
    *
@@ -2203,6 +2681,12 @@ var _TinyCloudNode = class _TinyCloudNode {
   get spaceService() {
     return this.spaces;
   }
+  /**
+   * Get a Space object by short name or full URI.
+   */
+  space(nameOrUri) {
+    return this.spaces.get(nameOrUri);
+  }
   /**
    * Get the SharingService for creating and receiving v2 sharing links.
    *
@@ -2270,7 +2754,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     ];
     const abilities = { kv: { "": kvActions } };
     const now = /* @__PURE__ */ new Date();
-    const expiryMs = 60 * 60 * 1e3;
+    const expiryMs = EXPIRY3.EPHEMERAL_MS;
     const expirationTime = new Date(now.getTime() + expiryMs);
     const prepared = this.wasmBindings.prepareSession({
       abilities,
@@ -2317,7 +2801,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (this._serviceContext) {
       const publicKV = new KVService2({ prefix: "" });
       const publicContext = new ServiceContext2({
-        invoke: this.wasmBindings.invoke,
+        invoke: this.invokeWithRuntimePermissions,
         fetch: this._serviceContext.fetch,
         hosts: this._serviceContext.hosts
       });
@@ -2405,8 +2889,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * Issue a delegation using the capability-chain flow.
    *
    * When every requested permission is a subset of the current
-   * session's recap, the delegation is signed by the session key via
-   * WASM — no wallet prompt. When at least one is NOT derivable, a
+   * session's recap, or of one installed runtime permission delegation,
+   * the delegation is signed by the session key via WASM — no wallet
+   * prompt. When at least one is NOT derivable, a
    * {@link PermissionNotInManifestError} is raised (carrying the
    * missing entries) so the caller can trigger an escalation flow
    * (e.g. `TinyCloudWeb.requestPermissions`). Passing
@@ -2456,10 +2941,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         "delegateTo requires a non-empty permissions array"
       );
     }
-    const expandedEntries = permissions.map((entry) => ({
-      ...entry,
-      actions: expandActionShortNames(entry.service, entry.actions)
-    }));
+    const expandedEntries = this.expandPermissionEntries(permissions);
     const now = /* @__PURE__ */ new Date();
     const expiryMs = resolveExpiryMs(options?.expiry);
     const expirationTime = new Date(now.getTime() + expiryMs);
@@ -2486,6 +2968,23 @@ var _TinyCloudNode = class _TinyCloudNode {
     );
     const { subset, missing } = isCapabilitySubset(expandedEntries, granted);
     if (!subset) {
+      const runtimeGrant = this.findGrantForOperations(
+        this.permissionEntriesToOperations(expandedEntries, session)
+      );
+      if (runtimeGrant) {
+        const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
+        if (runtimeGrant.expiresAt.getTime() <= Date.now() + marginMs) {
+          throw new SessionExpiredError(runtimeGrant.expiresAt);
+        }
+        const runtimeExpiration = runtimeGrant.expiresAt < effectiveExpiration ? runtimeGrant.expiresAt : effectiveExpiration;
+        const delegation2 = await this.createDelegationViaRuntimeGrant(
+          did,
+          expandedEntries,
+          runtimeExpiration,
+          runtimeGrant
+        );
+        return { delegation: delegation2, prompted: false };
+      }
       throw new PermissionNotInManifestError(missing, granted);
     }
     const delegation = await this.createDelegationViaWasmPath(
@@ -2630,6 +3129,41 @@ var _TinyCloudNode = class _TinyCloudNode {
       host: this.config.host
     };
   }
+  async createDelegationViaRuntimeGrant(did, entries, expirationTime, grant) {
+    const result = this.createDelegationWrapper({
+      session: grant.session,
+      delegateDID: did,
+      spaceId: grant.session.spaceId,
+      abilities: this.permissionsToAbilities(entries),
+      expirationSecs: Math.floor(expirationTime.getTime() / 1e3)
+    });
+    const primary = result.resources[0];
+    const delegationHeader = { Authorization: result.delegation };
+    const targetHost = grant.delegation.host ?? this.config.host;
+    const activateResult = await activateSessionWithHost2(
+      targetHost,
+      delegationHeader
+    );
+    if (!activateResult.success) {
+      throw new Error(
+        `Failed to activate delegation with host: ${activateResult.error}`
+      );
+    }
+    return {
+      cid: result.cid,
+      delegationHeader,
+      spaceId: grant.session.spaceId,
+      path: primary.path,
+      actions: primary.actions,
+      resources: result.resources,
+      disableSubDelegation: false,
+      expiry: result.expiry,
+      delegateDID: did,
+      ownerAddress: grant.delegation.ownerAddress,
+      chainId: grant.delegation.chainId,
+      host: targetHost
+    };
+  }
   resolvePermissionSpace(space, session) {
     if (space === void 0) {
       return this.wasmBindings.makeSpaceId(
@@ -2646,6 +3180,220 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return this.wasmBindings.makeSpaceId(session.address, session.chainId, space);
   }
+  expandPermissionEntries(permissions) {
+    return expandPermissionEntriesCore(permissions);
+  }
+  shortServiceName(service) {
+    const short = SERVICE_LONG_TO_SHORT[service];
+    if (short === void 0) {
+      throw new Error(
+        `unknown service '${service}' \u2014 no short-form mapping`
+      );
+    }
+    return short;
+  }
+  permissionsToAbilities(entries) {
+    const abilities = {};
+    for (const entry of entries) {
+      const service = this.shortServiceName(entry.service);
+      abilities[service] ?? (abilities[service] = {});
+      const existing = abilities[service][entry.path] ?? [];
+      const seen = new Set(existing);
+      for (const action of entry.actions) {
+        if (!seen.has(action)) {
+          existing.push(action);
+          seen.add(action);
+        }
+      }
+      abilities[service][entry.path] = existing;
+    }
+    return abilities;
+  }
+  permissionOperations(entries, spaceId) {
+    return entries.flatMap((entry) => {
+      const service = this.shortServiceName(entry.service);
+      return entry.actions.map((action) => ({
+        spaceId,
+        service,
+        path: entry.path,
+        action
+      }));
+    });
+  }
+  sessionCoversPermissionEntries(session, entries) {
+    try {
+      const granted = parseRecapCapabilities(
+        (siwe) => this.wasmBindings.parseRecapFromSiwe(siwe),
+        session.siwe
+      );
+      return isCapabilitySubset(entries, granted).subset;
+    } catch {
+      return false;
+    }
+  }
+  permissionEntriesToOperations(entries, session) {
+    return entries.flatMap((entry) => {
+      const spaceId = this.resolvePermissionSpace(entry.space, session);
+      const service = this.shortServiceName(entry.service);
+      return entry.actions.map((action) => ({
+        spaceId,
+        service,
+        path: entry.path,
+        action
+      }));
+    });
+  }
+  findRuntimeGrantsForPermissionEntries(entries, session) {
+    const grants = [];
+    const operations = this.permissionEntriesToOperations(entries, session);
+    if (operations.length === 0) {
+      return grants;
+    }
+    for (const operation of operations) {
+      const grant = this.findGrantForOperation(operation);
+      if (!grant) {
+        return [];
+      }
+      if (!grants.includes(grant)) {
+        grants.push(grant);
+      }
+    }
+    return grants;
+  }
+  runtimeDelegationFromSession(delegatedSession, entries, spaceId, session, expiresAt) {
+    const resources = this.delegatedResourcesForEntries(entries, spaceId);
+    const primary = resources[0];
+    return {
+      cid: delegatedSession.delegationCid,
+      delegationHeader: delegatedSession.delegationHeader,
+      spaceId,
+      path: primary.path,
+      actions: primary.actions,
+      resources,
+      disableSubDelegation: false,
+      expiry: expiresAt,
+      delegateDID: session.verificationMethod,
+      ownerAddress: session.address,
+      chainId: session.chainId,
+      host: this.config.host
+    };
+  }
+  runtimeGrantFromDelegation(delegation, session) {
+    const operations = this.operationsFromDelegation(delegation);
+    return {
+      session: {
+        delegationHeader: delegation.delegationHeader,
+        delegationCid: delegation.cid,
+        spaceId: delegation.spaceId,
+        verificationMethod: session.verificationMethod,
+        jwk: session.jwk
+      },
+      delegation,
+      operations,
+      expiresAt: delegation.expiry
+    };
+  }
+  delegatedResourcesForEntries(entries, spaceId) {
+    return entries.map((entry) => ({
+      service: this.shortServiceName(entry.service),
+      space: spaceId,
+      path: entry.path,
+      actions: [...entry.actions]
+    }));
+  }
+  operationsFromDelegation(delegation) {
+    const resources = delegation.resources !== void 0 && delegation.resources.length > 0 ? delegation.resources : this.flatDelegationResources(delegation);
+    return resources.flatMap(
+      (resource) => resource.actions.map((action) => ({
+        spaceId: resource.space,
+        service: this.invocationServiceName(resource.service),
+        path: resource.path,
+        action
+      }))
+    );
+  }
+  flatDelegationResources(delegation) {
+    const byService = /* @__PURE__ */ new Map();
+    for (const action of delegation.actions) {
+      const service = this.shortServiceName(action.split("/")[0]);
+      const actions = byService.get(service) ?? [];
+      actions.push(action);
+      byService.set(service, actions);
+    }
+    return [...byService.entries()].map(([service, actions]) => ({
+      service,
+      space: delegation.spaceId,
+      path: delegation.path,
+      actions
+    }));
+  }
+  selectInvocationSession(fallback, service, path, action) {
+    const grant = this.findGrantForOperation({
+      spaceId: fallback.spaceId,
+      service: this.invocationServiceName(service),
+      path,
+      action
+    });
+    return grant?.session ?? fallback;
+  }
+  findGrantForOperations(operations) {
+    if (operations.length === 0) {
+      return void 0;
+    }
+    this.pruneExpiredRuntimePermissionGrants();
+    return this.runtimePermissionGrants.find((grant) => {
+      return operations.every(
+        (operation) => grant.operations.some(
+          (granted) => this.operationCovers(granted, operation)
+        )
+      );
+    });
+  }
+  findGrantForOperation(operation) {
+    return this.findGrantForOperations([operation]);
+  }
+  pruneExpiredRuntimePermissionGrants() {
+    const now = Date.now();
+    this.runtimePermissionGrants = this.runtimePermissionGrants.filter(
+      (grant) => grant.expiresAt.getTime() > now
+    );
+  }
+  operationCovers(granted, requested) {
+    return granted.spaceId === requested.spaceId && granted.service === requested.service && this.actionContains(granted.action, requested.action) && this.pathContains(granted.path, requested.path);
+  }
+  actionContains(grantedAction, requestedAction) {
+    if (grantedAction === requestedAction) {
+      return true;
+    }
+    if (grantedAction.endsWith("/*")) {
+      const prefix = grantedAction.slice(0, -2);
+      return requestedAction.startsWith(`${prefix}/`);
+    }
+    return false;
+  }
+  invocationServiceName(service) {
+    return service.startsWith("tinycloud.") ? this.shortServiceName(service) : service;
+  }
+  pathContains(grantedPath, requestedPath) {
+    if (grantedPath === "" || grantedPath === "/") {
+      return true;
+    }
+    if (grantedPath.endsWith("/**")) {
+      return requestedPath.startsWith(grantedPath.slice(0, -3));
+    }
+    if (grantedPath.endsWith("/*")) {
+      const prefix = grantedPath.slice(0, -2);
+      if (!requestedPath.startsWith(prefix)) {
+        return false;
+      }
+      const remainder = requestedPath.slice(prefix.length);
+      return !remainder.includes("/") || remainder === "/";
+    }
+    if (grantedPath.endsWith("/")) {
+      return requestedPath.startsWith(grantedPath);
+    }
+    return grantedPath === requestedPath;
+  }
   /**
    * Issue a delegation via the legacy wallet-signed SIWE path for a single
    * {@link PermissionEntry}. Shares the implementation with the public
@@ -3033,15 +3781,18 @@ import {
   ACCOUNT_REGISTRY_SPACE as ACCOUNT_REGISTRY_SPACE2,
   DEFAULT_MANIFEST_SPACE as DEFAULT_MANIFEST_SPACE2,
   DEFAULT_MANIFEST_VERSION,
+  VAULT_PERMISSION_SERVICE,
   PermissionNotInManifestError as PermissionNotInManifestError2,
   SessionExpiredError as SessionExpiredError2,
   ManifestValidationError,
   composeManifestRequest as composeManifestRequest2,
-  resolveManifest,
+  resolveManifest as resolveManifest2,
   validateManifest,
   loadManifest,
   isCapabilitySubset as isCapabilitySubset2,
-  expandActionShortNames as expandActionShortNames2,
+  expandActionShortNames,
+  expandPermissionEntries,
+  expandPermissionEntry,
   parseExpiry as parseExpiry2,
   resourceCapabilitiesToSpaceAbilitiesMap as resourceCapabilitiesToSpaceAbilitiesMap2
 } from "@tinycloud/sdk-core";
@@ -3066,7 +3817,16 @@ function deserializeDelegation(data) {
 import { KVService as KVService3, PrefixedKVService } from "@tinycloud/sdk-core";
 import { SQLService as SQLService3, SQLAction, DatabaseHandle } from "@tinycloud/sdk-core";
 import { DuckDbService as DuckDbService3, DuckDbDatabaseHandle, DuckDbAction } from "@tinycloud/sdk-core";
-import { DataVaultService as DataVaultService2, VaultHeaders, VaultPublicSpaceKVActions, createVaultCrypto as createVaultCrypto2 } from "@tinycloud/sdk-core";
+import {
+  DataVaultService as DataVaultService2,
+  VaultHeaders,
+  VaultPublicSpaceKVActions,
+  createVaultCrypto as createVaultCrypto2,
+  SecretsService as SecretsService2,
+  SECRET_NAME_RE,
+  canonicalizeSecretScope,
+  resolveSecretPath as resolveSecretPath2
+} from "@tinycloud/sdk-core";
 import {
   DelegationManager as DelegationManager2,
   SharingService as SharingService2,
@@ -3118,8 +3878,10 @@ export {
   PermissionNotInManifestError2 as PermissionNotInManifestError,
   PrefixedKVService,
   ProtocolMismatchError,
+  SECRET_NAME_RE,
   SQLAction,
   SQLService3 as SQLService,
+  SecretsService2 as SecretsService,
   ServiceContext3 as ServiceContext,
   SessionExpiredError2 as SessionExpiredError,
   SharingService2 as SharingService,
@@ -3130,11 +3892,13 @@ export {
   TinyCloud2 as TinyCloud,
   TinyCloudNode,
   UnsupportedFeatureError2 as UnsupportedFeatureError,
+  VAULT_PERMISSION_SERVICE,
   VaultHeaders,
   VaultPublicSpaceKVActions,
   VersionCheckError,
   WasmKeyProvider,
   buildSpaceUri,
+  canonicalizeSecretScope,
   checkNodeInfo2 as checkNodeInfo,
   composeManifestRequest2 as composeManifestRequest,
   createCapabilityKeyRegistry,
@@ -3145,13 +3909,16 @@ export {
   defaultSignStrategy,
   defaultSpaceCreationHandler,
   deserializeDelegation,
-  expandActionShortNames2 as expandActionShortNames,
+  expandActionShortNames,
+  expandPermissionEntries,
+  expandPermissionEntry,
   isCapabilitySubset2 as isCapabilitySubset,
   loadManifest,
   makePublicSpaceId2 as makePublicSpaceId,
   parseExpiry2 as parseExpiry,
   parseSpaceUri,
-  resolveManifest,
+  resolveManifest2 as resolveManifest,
+  resolveSecretPath2 as resolveSecretPath,
   resourceCapabilitiesToSpaceAbilitiesMap2 as resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation,
   validateManifest