@tinycloud/node-sdk 2.3.0-beta.2 → 2.3.0-beta.4

package/dist/core.d.cts

@@ -1,4 +1,4 @@
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IngestOptions, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, buildSpaceUri, canonicalizeSecretScope, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, isCapabilitySubset, loadManifest, makePublicSpaceId, parseExpiry, parseSpaceUri, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, validateManifest } from '@tinycloud/sdk-core';
-export { D as DelegateToOptions, a as DelegateToResult, b as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, c as NodeUserAuthorization, d as NodeUserAuthorizationConfig, P as PortableDelegation, e as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, f as TinyCloudNodeConfig, W as WasmKeyProvider, g as WasmKeyProviderConfig, h as createWasmKeyProvider, i as defaultSignStrategy, j as deserializeDelegation, s as serializeDelegation } from './core-CWdCZ8q6.cjs';
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, validateManifest } from '@tinycloud/sdk-core';
+export { D as DelegateToOptions, a as DelegateToResult, b as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, c as NodeUserAuthorization, d as NodeUserAuthorizationConfig, P as PortableDelegation, e as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, f as TinyCloudNodeConfig, W as WasmKeyProvider, g as WasmKeyProviderConfig, h as createWasmKeyProvider, i as defaultSignStrategy, j as deserializeDelegation, s as serializeDelegation } from './core-CNyXnUx9.cjs';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.d.ts

@@ -1,4 +1,4 @@
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IngestOptions, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, buildSpaceUri, canonicalizeSecretScope, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, isCapabilitySubset, loadManifest, makePublicSpaceId, parseExpiry, parseSpaceUri, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, validateManifest } from '@tinycloud/sdk-core';
-export { D as DelegateToOptions, a as DelegateToResult, b as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, c as NodeUserAuthorization, d as NodeUserAuthorizationConfig, P as PortableDelegation, e as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, f as TinyCloudNodeConfig, W as WasmKeyProvider, g as WasmKeyProviderConfig, h as createWasmKeyProvider, i as defaultSignStrategy, j as deserializeDelegation, s as serializeDelegation } from './core-CWdCZ8q6.js';
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, validateManifest } from '@tinycloud/sdk-core';
+export { D as DelegateToOptions, a as DelegateToResult, b as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, c as NodeUserAuthorization, d as NodeUserAuthorizationConfig, P as PortableDelegation, e as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, f as TinyCloudNodeConfig, W as WasmKeyProvider, g as WasmKeyProviderConfig, h as createWasmKeyProvider, i as defaultSignStrategy, j as deserializeDelegation, s as serializeDelegation } from './core-CNyXnUx9.js';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.js

@@ -3,7 +3,22 @@ import { TinyCloud as TinyCloud2 } from "@tinycloud/sdk-core";
 import {
   SilentNotificationHandler as SilentNotificationHandler2,
   AutoApproveSpaceCreationHandler as AutoApproveSpaceCreationHandler2,
-  defaultSpaceCreationHandler
+  defaultSpaceCreationHandler,
+  IdentityParseError,
+  addressStorageKey,
+  canonicalizeAddress as canonicalizeAddress3,
+  canonicalizeDid,
+  canonicalizeDidUrl,
+  canonicalizeNetworkId,
+  didCacheKey,
+  didEquals,
+  isEvmAddress,
+  makePkhSpaceId as makePkhSpaceId2,
+  parsePkhDid,
+  pkhDid as pkhDid3,
+  principalDid,
+  principalDidEquals as principalDidEquals2,
+  parseCanonicalNetworkId
 } from "@tinycloud/sdk-core";
 
 // src/storage/MemorySessionStorage.ts
@@ -210,7 +225,10 @@ import {
   resourceCapabilitiesToAbilitiesMap,
   resourceCapabilitiesToSpaceAbilitiesMap,
   resolveTinyCloudHosts,
-  EXPIRY
+  EXPIRY,
+  canonicalizeAddress,
+  makePkhSpaceId,
+  pkhDid
 } from "@tinycloud/sdk-core";
 
 // src/authorization/strategies.ts
@@ -336,15 +354,16 @@ var NodeUserAuthorization = class {
    * expired-at-epoch-zero.
    */
   setRestoredTinyCloudSession(session) {
-    this._tinyCloudSession = session;
-    this._address = session.address;
+    const address = canonicalizeAddress(session.address);
+    this._tinyCloudSession = { ...session, address };
+    this._address = address;
     this._chainId = session.chainId;
   }
   async resolveTinyCloudHostsForSignIn(address, chainId) {
     if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
       return;
     }
-    const subject = `did:pkh:eip155:${chainId}:${address}`;
+    const subject = pkhDid(address, chainId);
     const resolved = await resolveTinyCloudHosts(subject, {
       registryUrl: this.tinycloudRegistryUrl,
       fallbackHosts: this.tinycloudFallbackHosts
@@ -408,19 +427,19 @@ var NodeUserAuthorization = class {
     if (space.startsWith("tinycloud:")) {
       return space;
     }
-    return this.wasm.makeSpaceId(address, chainId, space);
+    return makePkhSpaceId(address, chainId, space);
   }
   defaultEncryptionNetworkId(address, chainId) {
-    return `urn:tinycloud:encryption:did:pkh:eip155:${chainId}:${address}:default`;
+    return `urn:tinycloud:encryption:${pkhDid(address, chainId)}:default`;
   }
   resolveSignInCapabilities(address, chainId) {
     const request = this.getCapabilityRequest();
     if (request === void 0) {
       const defaultNetworkId = this.defaultEncryptionNetworkId(address, chainId);
-      const secretsSpaceId = this.wasm.makeSpaceId(address, chainId, "secrets");
+      const secretsSpaceId = makePkhSpaceId(address, chainId, "secrets");
       return {
         abilities: this.defaultActions,
-        spaceId: this.wasm.makeSpaceId(address, chainId, this.spacePrefix),
+        spaceId: makePkhSpaceId(address, chainId, this.spacePrefix),
         spaceAbilities: {
           [secretsSpaceId]: {
             kv: {
@@ -682,9 +701,9 @@ var NodeUserAuthorization = class {
    * @param options - Optional per-call SIWE overrides for this sign-in only
    */
   async signIn(options) {
-    this._address = await this.signer.getAddress();
+    this._address = canonicalizeAddress(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
-    const address = this.wasm.ensureEip55(this._address);
+    const address = this._address;
     const chainId = this._chainId;
     await this.resolveTinyCloudHostsForSignIn(address, chainId);
     const keyId = `session-${Date.now()}`;
@@ -729,7 +748,7 @@ var NodeUserAuthorization = class {
       siwe: prepared.siwe,
       signature
     };
-    const spacesMetadata = this.enablePublicSpace ? { public: this.wasm.makeSpaceId(address, chainId, "public") } : void 0;
+    const spacesMetadata = this.enablePublicSpace ? { public: makePkhSpaceId(address, chainId, "public") } : void 0;
     const tinyCloudSession = {
       address,
       chainId,
@@ -804,7 +823,7 @@ var NodeUserAuthorization = class {
    */
   async signMessage(message) {
     if (!this._address) {
-      this._address = await this.signer.getAddress();
+      this._address = canonicalizeAddress(await this.signer.getAddress());
     }
     if (!this._chainId) {
       this._chainId = await this.signer.getChainId();
@@ -831,7 +850,7 @@ var NodeUserAuthorization = class {
    * ```
    */
   async prepareSessionForSigning() {
-    const address = this.wasm.ensureEip55(await this.signer.getAddress());
+    const address = canonicalizeAddress(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     const keyId = `session-${Date.now()}`;
     this.sessionManager.renameSessionKeyId("default", keyId);
@@ -881,7 +900,7 @@ var NodeUserAuthorization = class {
       ...prepared,
       signature
     });
-    const address = this.wasm.ensureEip55(await this.signer.getAddress());
+    const address = canonicalizeAddress(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     await this.resolveTinyCloudHostsForSignIn(address, chainId);
     const clientSession = {
@@ -892,7 +911,7 @@ var NodeUserAuthorization = class {
       siwe: prepared.siwe,
       signature
     };
-    const spacesMetadata = this.enablePublicSpace ? { public: this.wasm.makeSpaceId(address, chainId, "public") } : void 0;
+    const spacesMetadata = this.enablePublicSpace ? { public: makePkhSpaceId(address, chainId, "public") } : void 0;
     const tinyCloudSession = {
       address,
       chainId,
@@ -1046,7 +1065,10 @@ import {
   EXPIRY as EXPIRY3,
   canonicalHashHex,
   canonicalizeEncryptionJson,
-  verifyDidKeyEd25519Signature
+  verifyDidKeyEd25519Signature,
+  canonicalizeAddress as canonicalizeAddress2,
+  pkhDid as pkhDid2,
+  principalDidEquals
 } from "@tinycloud/sdk-core";
 
 // src/DelegatedAccess.ts
@@ -1469,6 +1491,13 @@ var NETWORK_CREATE_ACTION = "tinycloud.encryption/network.create";
 var DECRYPT_ACTION = "tinycloud.encryption/decrypt";
 var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
 var DEFAULT_SESSION_EXPIRATION_MS = EXPIRY3.SESSION_MS;
+function didPrincipalMatches(actual, expected) {
+  try {
+    return principalDidEquals(actual, expected);
+  } catch {
+    return actual === expected;
+  }
+}
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
@@ -1765,7 +1794,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   get did() {
     if (this._address) {
-      return `did:pkh:eip155:${this._chainId}:${this._address}`;
+      return pkhDid2(this._address, this._chainId);
     }
     return this.sessionManager.getDID(this.sessionKeyId);
   }
@@ -1782,7 +1811,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * Get the Ethereum address for this user.
    */
   get address() {
-    return this._address;
+    return this.auth?.address() ?? this._address;
   }
   /**
    * Check if this instance is in session-only mode (no wallet).
@@ -1820,7 +1849,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     await this.wasmBindings.ensureInitialized?.();
-    this._address = await this.signer.getAddress();
+    this._address = canonicalizeAddress2(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
     this._kv = void 0;
     this._sql = void 0;
@@ -1927,8 +1956,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
-    if (sessionData.address) {
-      this._address = sessionData.address;
+    const restoredAddress = sessionData.address ? canonicalizeAddress2(sessionData.address) : void 0;
+    if (restoredAddress) {
+      this._address = restoredAddress;
     }
     if (sessionData.chainId) {
       this._chainId = sessionData.chainId;
@@ -1963,9 +1993,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._vault.initialize(this._serviceContext);
     this._serviceContext.registerService("vault", this._vault);
     this.initializeV2Services(serviceSession);
-    if (sessionData.siwe && sessionData.address && sessionData.chainId) {
+    if (sessionData.siwe && restoredAddress && sessionData.chainId) {
       const tcSession = {
-        address: sessionData.address,
+        address: restoredAddress,
         chainId: sessionData.chainId,
         sessionKey: JSON.stringify(sessionData.jwk),
         spaceId: sessionData.spaceId,
@@ -2304,8 +2334,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         fetchByNetworkId: (networkId) => this.getEncryptionNetwork(networkId)
       },
       wellKnown: {
-        fetchWellKnown: async (ownerDid, discoveryKey) => {
-          if (!this._address || ownerDid !== this.did) {
+        fetchWellKnown: async (principal, discoveryKey) => {
+          if (!this._address || !didPrincipalMatches(principal, this.did)) {
             return null;
           }
           if (!this.config.host) {
@@ -2629,7 +2659,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       return {
         cid: delegationSession.delegationCid,
         delegateDID: params.shareKeyDID,
-        delegatorDID: `did:pkh:eip155:${session.chainId}:${session.address}`,
+        delegatorDID: pkhDid2(session.address, session.chainId),
         spaceId: params.spaceId,
         path: params.path,
         actions: params.actions,
@@ -2961,13 +2991,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (delegation.expiry.getTime() <= Date.now()) {
       throw new SessionExpiredError(delegation.expiry);
     }
-    const expectedDids = /* @__PURE__ */ new Set([
-      session.verificationMethod,
-      this.didWithoutFragment(session.verificationMethod),
-      this.sessionDid,
-      this.didWithoutFragment(this.sessionDid)
-    ]);
-    if (!expectedDids.has(delegation.delegateDID)) {
+    const expectedDids = [session.verificationMethod, this.sessionDid];
+    if (!expectedDids.some((did) => didPrincipalMatches(delegation.delegateDID, did))) {
       throw new Error(
         `Runtime delegation targets ${delegation.delegateDID} but this session key is ${session.verificationMethod}.`
       );
@@ -3494,7 +3519,9 @@ var _TinyCloudNode = class _TinyCloudNode {
         "materializeDelegation requires a composed manifest request"
       );
     }
-    const target = request.delegationTargets.find((entry) => entry.did === did);
+    const target = request.delegationTargets.find(
+      (entry) => didPrincipalMatches(entry.did, did)
+    );
     if (!target) {
       throw new Error(`No manifest delegation target found for DID ${did}`);
     }
@@ -3802,10 +3829,6 @@ var _TinyCloudNode = class _TinyCloudNode {
       expiresAt: delegation.expiry
     };
   }
-  didWithoutFragment(did) {
-    const fragment = did.indexOf("#");
-    return fragment === -1 ? did : did.slice(0, fragment);
-  }
   installRuntimeGrantFromServiceSession(delegation, session, expiresAt) {
     const operations = this.operationsFromDelegation(delegation);
     if (operations.length === 0) {
@@ -4001,7 +4024,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (resolvedDelegateDID.endsWith(".eth") && this.config.ensResolver) {
       const address = await this.config.ensResolver.resolveAddress(resolvedDelegateDID);
       if (!address) throw new Error(`Could not resolve ENS name: ${resolvedDelegateDID}`);
-      resolvedDelegateDID = `did:pkh:eip155:1:${address}`;
+      resolvedDelegateDID = pkhDid2(address, 1);
     }
     const entries = legacyParamsToPermissionEntries(
       params.actions,
@@ -4158,7 +4181,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const targetHost = delegation.host ?? this.config.host;
     if (this.isSessionOnly) {
       const myDid = this.did;
-      if (delegation.delegateDID !== myDid) {
+      if (!didPrincipalMatches(delegation.delegateDID, myDid)) {
         throw new Error(
           `Delegation targets ${delegation.delegateDID} but this user's DID is ${myDid}. The delegation must target this user's DID.`
         );
@@ -4416,7 +4439,11 @@ import {
   PrefixedKVService
 } from "@tinycloud/sdk-core";
 import { SQLService as SQLService3, SQLAction, DatabaseHandle } from "@tinycloud/sdk-core";
-import { DuckDbService as DuckDbService3, DuckDbDatabaseHandle, DuckDbAction } from "@tinycloud/sdk-core";
+import {
+  DuckDbService as DuckDbService3,
+  DuckDbDatabaseHandle,
+  DuckDbAction
+} from "@tinycloud/sdk-core";
 import {
   DataVaultService as DataVaultService2,
   VaultHeaders,
@@ -4473,6 +4500,7 @@ export {
   DuckDbDatabaseHandle,
   DuckDbService3 as DuckDbService,
   FileSessionStorage,
+  IdentityParseError,
   KVService3 as KVService,
   ManifestValidationError,
   MemorySessionStorage,
@@ -4499,7 +4527,12 @@ export {
   VaultPublicSpaceKVActions,
   VersionCheckError,
   WasmKeyProvider,
+  addressStorageKey,
   buildSpaceUri,
+  canonicalizeAddress3 as canonicalizeAddress,
+  canonicalizeDid,
+  canonicalizeDidUrl,
+  canonicalizeNetworkId,
   canonicalizeSecretScope,
   checkNodeInfo2 as checkNodeInfo,
   composeManifestRequest2 as composeManifestRequest,
@@ -4511,14 +4544,23 @@ export {
   defaultSignStrategy,
   defaultSpaceCreationHandler,
   deserializeDelegation,
+  didCacheKey,
+  didEquals,
   expandActionShortNames,
   expandPermissionEntries2 as expandPermissionEntries,
   expandPermissionEntry,
   isCapabilitySubset2 as isCapabilitySubset,
+  isEvmAddress,
   loadManifest,
+  makePkhSpaceId2 as makePkhSpaceId,
   makePublicSpaceId2 as makePublicSpaceId,
+  parseCanonicalNetworkId,
   parseExpiry2 as parseExpiry,
+  parsePkhDid,
   parseSpaceUri,
+  pkhDid3 as pkhDid,
+  principalDid,
+  principalDidEquals2 as principalDidEquals,
   resolveManifest2 as resolveManifest,
   resolveSecretListPrefix2 as resolveSecretListPrefix,
   resolveSecretPath2 as resolveSecretPath,