@tinycloud/node-sdk 2.4.0-beta.1 → 2.4.0-beta.11

package/dist/core.d.cts

@@ -1,4 +1,4 @@
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, validateManifest } from '@tinycloud/sdk-core';
-export { D as DelegateToOptions, a as DelegateToResult, b as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, c as NodeUserAuthorization, d as NodeUserAuthorizationConfig, P as PortableDelegation, e as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, f as TinyCloudNodeConfig, W as WasmKeyProvider, g as WasmKeyProviderConfig, h as createWasmKeyProvider, i as defaultSignStrategy, j as deserializeDelegation, s as serializeDelegation } from './core-Dbzm1kA_.cjs';
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, validateManifest } from '@tinycloud/sdk-core';
+export { D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, P as PortableDelegation, g as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, W as WasmKeyProvider, i as WasmKeyProviderConfig, j as createWasmKeyProvider, k as defaultSignStrategy, l as deserializeDelegation, s as serializeDelegation } from './core--mjBU9Jq.cjs';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.d.ts

@@ -1,4 +1,4 @@
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, validateManifest } from '@tinycloud/sdk-core';
-export { D as DelegateToOptions, a as DelegateToResult, b as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, c as NodeUserAuthorization, d as NodeUserAuthorizationConfig, P as PortableDelegation, e as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, f as TinyCloudNodeConfig, W as WasmKeyProvider, g as WasmKeyProviderConfig, h as createWasmKeyProvider, i as defaultSignStrategy, j as deserializeDelegation, s as serializeDelegation } from './core-Dbzm1kA_.js';
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, validateManifest } from '@tinycloud/sdk-core';
+export { D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, P as PortableDelegation, g as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, W as WasmKeyProvider, i as WasmKeyProviderConfig, j as createWasmKeyProvider, k as defaultSignStrategy, l as deserializeDelegation, s as serializeDelegation } from './core--mjBU9Jq.js';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.js

@@ -17,7 +17,7 @@ import {
   parsePkhDid,
   pkhDid as pkhDid3,
   principalDid,
-  principalDidEquals as principalDidEquals2,
+  principalDidEquals as principalDidEquals3,
   parseCanonicalNetworkId
 } from "@tinycloud/sdk-core";
 
@@ -222,6 +222,8 @@ import {
   DEFAULT_MANIFEST_SPACE,
   ENCRYPTION_PERMISSION_SERVICE,
   composeManifestRequest,
+  parseNetworkId,
+  principalDidEquals,
   resourceCapabilitiesToAbilitiesMap,
   resourceCapabilitiesToSpaceAbilitiesMap,
   resolveTinyCloudHosts,
@@ -235,6 +237,25 @@ import {
 var defaultSignStrategy = { type: "auto-sign" };
 
 // src/authorization/NodeUserAuthorization.ts
+var DECRYPT_ACTION = "tinycloud.encryption/decrypt";
+var NETWORK_CREATE_ACTION = "tinycloud.encryption/network.create";
+function didPrincipalMatches(actual, expected) {
+  try {
+    return principalDidEquals(actual, expected);
+  } catch {
+    return actual === expected;
+  }
+}
+function addRawAbility(rawAbilities, resource, action) {
+  const actions = rawAbilities[resource];
+  if (actions === void 0) {
+    rawAbilities[resource] = [action];
+    return;
+  }
+  if (!actions.includes(action)) {
+    actions.push(action);
+  }
+}
 var NodeUserAuthorization = class {
   constructor(config) {
     this.extensions = [];
@@ -261,6 +282,7 @@ var NodeUserAuthorization = class {
         "": [
           "tinycloud.sql/read",
           "tinycloud.sql/write",
+          "tinycloud.sql/ddl",
           "tinycloud.sql/admin",
           "tinycloud.sql/export"
         ]
@@ -352,12 +374,48 @@ var NodeUserAuthorization = class {
    * `siwe` is the load-bearing one because `extractSiweExpiration` returns
    * undefined for missing SIWEs and the SDK then treats the session as
    * expired-at-epoch-zero.
+   *
+   * @param hosts - The TinyCloud hosts this session was created against,
+   *   as persisted in {@link PersistedSessionData.tinycloudHosts}. When
+   *   present (and non-empty) they are adopted directly so the restored
+   *   session resolves to the same node as the original sign-in without
+   *   re-running registry/fallback resolution. When absent (old session)
+   *   hosts are resolved lazily on the first host-needing call via
+   *   {@link ensureTinyCloudHosts}.
    */
-  setRestoredTinyCloudSession(session) {
+  setRestoredTinyCloudSession(session, hosts) {
     const address = canonicalizeAddress(session.address);
     this._tinyCloudSession = { ...session, address };
     this._address = address;
     this._chainId = session.chainId;
+    if ((!this.tinycloudHosts || this.tinycloudHosts.length === 0) && hosts && hosts.length > 0) {
+      this.tinycloudHosts = [...hosts];
+    }
+  }
+  /**
+   * Ensure `tinycloudHosts` are resolved before a host-needing call.
+   *
+   * Fresh sign-in resolves hosts up front; a restored session may not have
+   * (old persisted sessions predate {@link PersistedSessionData.tinycloudHosts}).
+   * This guard makes a restored session resolve the node exactly like a fresh
+   * sign-in — persisted hosts are preferred (already set by
+   * {@link setRestoredTinyCloudSession}), otherwise the registry/fallback
+   * resolution runs lazily here. Idempotent: {@link resolveTinyCloudHostsForSignIn}
+   * early-returns when hosts are already set.
+   *
+   * Throws if hosts are unset and the restored session has no address/chainId
+   * to resolve from — a real failure that must surface, not be masked.
+   */
+  async ensureTinyCloudHosts() {
+    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
+      return;
+    }
+    if (this._address === void 0 || this._chainId === void 0) {
+      throw new Error(
+        "Cannot resolve TinyCloud hosts: no address/chainId available. Sign in or restore a session first."
+      );
+    }
+    await this.resolveTinyCloudHostsForSignIn(this._address, this._chainId);
   }
   async resolveTinyCloudHostsForSignIn(address, chainId) {
     if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
@@ -464,20 +522,18 @@ var NodeUserAuthorization = class {
       };
     }
     const rawAbilities = {};
+    const currentDid = pkhDid(address, chainId);
     const spaceResources = request.resources.filter((entry) => {
       if (entry.service !== ENCRYPTION_PERMISSION_SERVICE) {
         return true;
       }
-      const existing = rawAbilities[entry.path];
-      if (existing === void 0) {
-        rawAbilities[entry.path] = [...entry.actions];
-      } else {
-        const seen = new Set(existing);
-        for (const action of entry.actions) {
-          if (!seen.has(action)) {
-            existing.push(action);
-            seen.add(action);
-          }
+      for (const action of entry.actions) {
+        addRawAbility(rawAbilities, entry.path, action);
+      }
+      if (entry.actions.includes(DECRYPT_ACTION)) {
+        const parsed = parseNetworkId(entry.path);
+        if (didPrincipalMatches(parsed.ownerDid, currentDid)) {
+          addRawAbility(rawAbilities, entry.path, NETWORK_CREATE_ACTION);
         }
       }
       return false;
@@ -556,6 +612,7 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession || !this._address || !this._chainId) {
       throw new Error("Must be signed in to host space");
     }
+    await this.ensureTinyCloudHosts();
     const host = this.primaryTinyCloudHost;
     const spaceId = targetSpaceId ?? this._tinyCloudSession.spaceId;
     const peerId = await fetchPeerId(host, spaceId);
@@ -598,6 +655,7 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession) {
       throw new Error("Must be signed in to ensure space exists");
     }
+    await this.ensureTinyCloudHosts();
     const host = this.primaryTinyCloudHost;
     const primarySpaceId = this._tinyCloudSession.spaceId;
     const result = await activateSessionWithHost(
@@ -779,7 +837,8 @@ var NodeUserAuthorization = class {
       },
       expiresAt: expirationTime.toISOString(),
       createdAt: now.toISOString(),
-      version: "1.0"
+      version: "1.0",
+      tinycloudHosts: this.tinycloudHosts
     };
     await this.sessionStorage.save(address, persistedData);
     this._session = clientSession;
@@ -946,7 +1005,8 @@ var NodeUserAuthorization = class {
       },
       expiresAt,
       createdAt,
-      version: "1.0"
+      version: "1.0",
+      tinycloudHosts: this.tinycloudHosts
     };
     await this.sessionStorage.save(address, persistedData);
     this._session = clientSession;
@@ -1070,9 +1130,14 @@ import {
   verifyDidKeyEd25519Signature,
   canonicalizeAddress as canonicalizeAddress2,
   pkhDid as pkhDid2,
-  principalDidEquals
+  resolveTinyCloudHosts as resolveTinyCloudHosts2,
+  principalDidEquals as principalDidEquals2,
+  parseNetworkId as parseNetworkId2
 } from "@tinycloud/sdk-core";
 
+// src/account/AccountService.ts
+import { AccountService } from "@tinycloud/sdk-core";
+
 // src/DelegatedAccess.ts
 import {
   KVService,
@@ -1490,13 +1555,13 @@ var NodeSecretsService = class {
 // src/TinyCloudNode.ts
 var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
-var NETWORK_CREATE_ACTION = "tinycloud.encryption/network.create";
-var DECRYPT_ACTION = "tinycloud.encryption/decrypt";
+var NETWORK_CREATE_ACTION2 = "tinycloud.encryption/network.create";
+var DECRYPT_ACTION2 = "tinycloud.encryption/decrypt";
 var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
 var DEFAULT_SESSION_EXPIRATION_MS = EXPIRY3.SESSION_MS;
-function didPrincipalMatches(actual, expected) {
+function didPrincipalMatches2(actual, expected) {
   try {
-    return principalDidEquals(actual, expected);
+    return principalDidEquals2(actual, expected);
   } catch {
     return actual === expected;
   }
@@ -1833,6 +1898,37 @@ var _TinyCloudNode = class _TinyCloudNode {
   get spaceId() {
     return this.auth?.tinyCloudSession?.spaceId;
   }
+  /**
+   * Get the account space ID for this wallet identity.
+   * Available after wallet-backed sign-in or a restored session with address metadata.
+   */
+  get accountSpaceId() {
+    if (!this._address) {
+      return void 0;
+    }
+    return this.wasmBindings.makeSpaceId(this._address, this._chainId, ACCOUNT_REGISTRY_SPACE);
+  }
+  /**
+   * Account-level application and delegation helpers.
+   */
+  get account() {
+    if (!this._account) {
+      this._account = new AccountService({
+        getDid: () => this.did,
+        getHost: () => this.hosts[0] ?? this.config.host,
+        getPrimarySpaceId: () => this.spaceId,
+        getAccountSpaceId: () => this.accountSpaceId,
+        getSpaces: () => this.spaces,
+        getAccountDb: () => this.accountSpaceId ? this.sqlForSpace(this.accountSpaceId).db("account") : void 0,
+        ensureAccountSpaceHosted: async () => {
+          if (this.accountSpaceId && this.auth) {
+            await this.ensureOwnedSpaceHostedById(this.accountSpaceId);
+          }
+        }
+      });
+    }
+    return this._account;
+  }
   /**
    * Get the current TinyCloud session.
    * Available after signIn().
@@ -1870,10 +1966,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
     this.initializeServices();
+    await this.ensureRequestedEncryptionNetworks();
     if (this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
-      await this.ensureOwnedSpaceHosted(this.ownedSpaceId("secrets"));
+      await this.ensureOwnedSpaceHostedById(this.ownedSpaceId("secrets"));
     }
-    await this.writeManifestRegistryRecords();
+    this.scheduleAccountRegistrySync();
     this.notificationHandler.success("Successfully signed in");
   }
   ownedSpaceId(name) {
@@ -1891,22 +1988,68 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Manifest registry write requires wallet mode");
     }
     const accountSpaceId = this.ownedSpaceId(ACCOUNT_REGISTRY_SPACE);
-    await this.ensureOwnedSpaceHosted(accountSpaceId);
-    const accountKV = this.spaces.get(accountSpaceId).kv;
-    for (const record of request.registryRecords) {
-      const result = await accountKV.put(record.key, {
-        app_id: record.app_id,
-        manifests: record.manifests,
-        updated_at: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (!result.ok) {
-        throw new Error(
-          `Failed to write manifest registry record ${record.key}: ${result.error.message}`
-        );
+    await this.ensureOwnedSpaceHostedById(accountSpaceId);
+    const result = await this.account.applications.register(request.manifests);
+    if (!result.ok) {
+      throw new Error(
+        `Failed to write manifest registry records: ${result.error.message}`
+      );
+    }
+  }
+  scheduleAccountRegistrySync() {
+    void this.withAccountRegistryRetry(async () => {
+      await this.writeManifestRegistryRecords();
+      const spaces = await this.account.spaces.syncAccessible();
+      if (!spaces.ok) {
+        throw new Error(`Failed to sync account spaces: ${spaces.error.message}`);
+      }
+    });
+  }
+  async withAccountRegistryRetry(task) {
+    const delays = [250, 1e3, 3e3];
+    let lastError;
+    for (let attempt = 0; attempt < delays.length; attempt += 1) {
+      try {
+        await task();
+        return;
+      } catch (error) {
+        lastError = error;
+        if (attempt < delays.length - 1) {
+          await new Promise((resolve) => setTimeout(resolve, delays[attempt]));
+        }
+      }
+    }
+    console.warn(
+      "TinyCloud account registry sync failed after retries",
+      lastError
+    );
+  }
+  requestedEncryptionNetworkIds() {
+    const request = this.capabilityRequest;
+    if (!request) {
+      return [];
+    }
+    const networkIds = /* @__PURE__ */ new Set();
+    for (const resource of request.resources) {
+      if (resource.service === ENCRYPTION_PERMISSION_SERVICE2 && resource.path.startsWith("urn:tinycloud:encryption:") && resource.actions.includes(DECRYPT_ACTION2)) {
+        networkIds.add(resource.path);
       }
     }
+    return [...networkIds];
   }
-  async ensureOwnedSpaceHosted(spaceId) {
+  async ensureRequestedEncryptionNetworks() {
+    if (!this.signer || !this.auth) {
+      return;
+    }
+    for (const networkId of this.requestedEncryptionNetworkIds()) {
+      const parsed = parseNetworkId2(networkId);
+      if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
+        continue;
+      }
+      await this.ensureEncryptionNetwork(networkId);
+    }
+  }
+  async ensureOwnedSpaceHostedById(spaceId) {
     if (!this.auth) {
       throw new Error("Owned space hosting requires wallet mode");
     }
@@ -1949,7 +2092,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * caller is the root authority of their own owned spaces, so no additional
    * delegation is required.
    *
-   * Unlike {@link ensureOwnedSpaceHosted}, this always submits the host
+   * Unlike {@link ensureOwnedSpaceHostedById}, this always submits the host
    * delegation rather than inferring hosting from session activation: a space
    * the current session has never referenced is reported neither as
    * `activated` nor `skipped`, so activation-based detection would wrongly
@@ -1983,8 +2126,40 @@ var _TinyCloudNode = class _TinyCloudNode {
         `Failed to activate session for owned space ${spaceId}: ${activation.error ?? "space was skipped"}`
       );
     }
+    void this.account.spaces.register({
+      spaceId,
+      name,
+      ownerDid: this.did,
+      type: "owned",
+      permissions: ["*"],
+      status: "active"
+    }).catch(() => {
+    });
     return spaceId;
   }
+  /**
+   * Ensure one of this user's owned spaces (e.g. `"secrets"`) is hosted on the
+   * server.
+   *
+   * At sign-in, a full-authority session auto-hosts the owner's `secrets`
+   * space, but a session created with a manifest / capabilityRequest does not.
+   * Such a session can therefore hold valid `tinycloud.kv/*` capabilities for
+   * the owned `secrets` space yet still fail its first scoped
+   * `secrets.put(...)` with `404 Space not found`, because the space was never
+   * registered on the node.
+   *
+   * Calling this resolves `name` to the owner's owned-space URI
+   * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`) and hosts it via the
+   * host-SIWE delegation flow. The host SIWE is idempotent server-side, so it
+   * is safe to call whether or not the space already exists; do not gate it on
+   * a prior existence check. Must be called after {@link signIn}.
+   *
+   * @param name - The owned space name (e.g. `"secrets"`).
+   * @returns The hosted owned-space URI.
+   */
+  async ensureOwnedSpaceHosted(name) {
+    return this.hostOwnedSpace(name);
+  }
   /**
    * Restore a previously established session from stored delegation data.
    *
@@ -2014,6 +2189,14 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (sessionData.chainId) {
       this._chainId = sessionData.chainId;
     }
+    const resolvedHost = await this.resolveRestoredHost(
+      sessionData.tinycloudHosts,
+      restoredAddress,
+      sessionData.chainId
+    );
+    if (resolvedHost) {
+      this.config.host = resolvedHost;
+    }
     this._serviceContext = new ServiceContext2({
       invoke: this.invokeWithRuntimePermissions,
       invokeAny: this.invokeAnyWithRuntimePermissions,
@@ -2059,12 +2242,45 @@ var _TinyCloudNode = class _TinyCloudNode {
         signature: sessionData.signature ?? ""
       };
       if (this.auth) {
-        this.auth.setRestoredTinyCloudSession(tcSession);
+        this.auth.setRestoredTinyCloudSession(
+          tcSession,
+          this.config.host ? [this.config.host] : void 0
+        );
       } else {
         this._restoredTcSession = tcSession;
       }
     }
   }
+  /**
+   * Resolve the host a restored session should target.
+   *
+   * Mirrors fresh sign-in host resolution but for the restore path:
+   * an explicit/pinned host always wins, then the hosts the session was
+   * persisted with, then a lazy registry/fallback resolution for sessions
+   * that predate the persisted `tinycloudHosts` field. Returns `undefined`
+   * only when there's nothing to resolve from (no explicit host, no
+   * persisted hosts, and no address/chainId) — in which case the existing
+   * `config.host` (default) is left in place.
+   *
+   * Resolution failures are surfaced, not swallowed: a genuinely broken
+   * registry lookup throws rather than silently falling back to a wrong host.
+   */
+  async resolveRestoredHost(persistedHosts, address, chainId) {
+    if (this.explicitHost) {
+      return this.explicitHost;
+    }
+    if (persistedHosts && persistedHosts.length > 0) {
+      return persistedHosts[0];
+    }
+    if (address === void 0 || chainId === void 0) {
+      return void 0;
+    }
+    const resolved = await resolveTinyCloudHosts2(pkhDid2(address, chainId), {
+      registryUrl: this.config.tinycloudRegistryUrl,
+      fallbackHosts: this.config.tinycloudFallbackHosts
+    });
+    return resolved.hosts[0];
+  }
   /**
    * Resolve the currently-active TinyCloudSession, preferring the auth
    * layer's value (wallet mode) and falling back to the node-level
@@ -2374,7 +2590,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           const signed = await this.signRawNetworkAuthorization({
             targetNode: input.targetNode,
             networkId: input.networkId,
-            action: DECRYPT_ACTION,
+            action: DECRYPT_ACTION2,
             facts: input.facts
           });
           return {
@@ -2391,7 +2607,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       wellKnown: {
         fetchWellKnown: async (principal, discoveryKey) => {
-          if (!this._address || !didPrincipalMatches(principal, this.did)) {
+          if (!this._address || !didPrincipalMatches2(principal, this.did)) {
             return null;
           }
           if (!this.config.host) {
@@ -2600,6 +2816,9 @@ var _TinyCloudNode = class _TinyCloudNode {
             }
           };
         }
+      },
+      onSpaceRegistered: async (space) => {
+        await this.account.spaces.register(space);
       }
     });
     this._sharingService.updateConfig({
@@ -2898,12 +3117,12 @@ var _TinyCloudNode = class _TinyCloudNode {
         crypto.sha256,
         body
       ),
-      action: NETWORK_CREATE_ACTION
+      action: NETWORK_CREATE_ACTION2
     };
     const signed = await this.signRawNetworkAuthorization({
       targetNode,
       networkId,
-      action: NETWORK_CREATE_ACTION,
+      action: NETWORK_CREATE_ACTION2,
       facts
     });
     const response = await fetch(`${this.config.host}/encryption/networks`, {
@@ -2924,12 +3143,19 @@ var _TinyCloudNode = class _TinyCloudNode {
     const created = await response.json();
     return created.descriptor;
   }
-  async ensureEncryptionNetwork(name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
-    const existing = await this.getEncryptionNetwork(name);
+  async ensureEncryptionNetwork(nameOrNetworkId = DEFAULT_ENCRYPTION_NETWORK_NAME) {
+    const networkId = nameOrNetworkId.startsWith("urn:tinycloud:encryption:") ? nameOrNetworkId : this.getDefaultEncryptionNetworkId(nameOrNetworkId);
+    const existing = await this.getEncryptionNetwork(networkId);
     if (existing) {
       return existing;
     }
-    return this.createEncryptionNetwork(name);
+    const parsed = parseNetworkId2(networkId);
+    if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
+      throw new Error(
+        `Cannot create encryption network ${networkId}: owner ${parsed.ownerDid} does not match signed-in DID ${this.did}`
+      );
+    }
+    return this.createEncryptionNetwork(parsed.name);
   }
   /**
    * App-facing secrets API backed by the `secrets` space vault.
@@ -3077,7 +3303,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new SessionExpiredError(delegation.expiry);
     }
     const expectedDids = [session.verificationMethod, this.sessionDid];
-    if (!expectedDids.some((did) => didPrincipalMatches(delegation.delegateDID, did))) {
+    if (!expectedDids.some((did) => didPrincipalMatches2(delegation.delegateDID, did))) {
       throw new Error(
         `Runtime delegation targets ${delegation.delegateDID} but this session key is ${session.verificationMethod}.`
       );
@@ -3606,7 +3832,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     const target = request.delegationTargets.find(
-      (entry) => didPrincipalMatches(entry.did, did)
+      (entry) => didPrincipalMatches2(entry.did, did)
     );
     if (!target) {
       throw new Error(`No manifest delegation target found for DID ${did}`);
@@ -4056,7 +4282,23 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (granted.resource !== void 0 || requested.resource !== void 0) {
       return granted.resource !== void 0 && requested.resource !== void 0 && granted.resource === requested.resource && this.pathContains(granted.path, requested.path);
     }
-    return granted.spaceId !== void 0 && requested.spaceId !== void 0 && granted.spaceId === requested.spaceId && this.pathContains(granted.path, requested.path);
+    return granted.spaceId !== void 0 && requested.spaceId !== void 0 && this.spaceIdsEqual(granted.spaceId, requested.spaceId) && this.pathContains(granted.path, requested.path);
+  }
+  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. The embedded
+  // EIP-155 address is case-insensitive, but the CLI canonicalizes it to
+  // lowercase when building a space URI while stored runtime delegations keep
+  // the EIP-55 checksummed form — so a byte-for-byte compare spuriously rejects
+  // an otherwise-valid grant. Lowercase ONLY the `eip155:<chain>:0x<addr>`
+  // segment and leave everything else (crucially the case-sensitive space NAME)
+  // byte-exact. Mirrors the CLI's `normalizeSpaceForCompare` (OPENKEY_SCOPE_MISMATCH fix).
+  spaceIdsEqual(a, b) {
+    return this.normalizeSpaceAddress(a) === this.normalizeSpaceAddress(b);
+  }
+  normalizeSpaceAddress(space) {
+    return space.replace(
+      /(eip155:\d+:)(0x[0-9a-fA-F]{40})/,
+      (_match, prefix, addr) => prefix + addr.toLowerCase()
+    );
   }
   actionContains(grantedAction, requestedAction) {
     if (grantedAction === requestedAction) {
@@ -4320,7 +4562,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const targetHost = delegation.host ?? this.config.host;
     if (this.isSessionOnly) {
       const myDid = this.did;
-      if (!didPrincipalMatches(delegation.delegateDID, myDid)) {
+      if (!didPrincipalMatches2(delegation.delegateDID, myDid)) {
         throw new Error(
           `Delegation targets ${delegation.delegateDID} but this user's DID is ${myDid}. The delegation must target this user's DID.`
         );
@@ -4617,6 +4859,7 @@ import { ServiceContext as ServiceContext3 } from "@tinycloud/sdk-core";
 export {
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE2 as ACCOUNT_REGISTRY_SPACE,
+  AccountService,
   AutoApproveSpaceCreationHandler2 as AutoApproveSpaceCreationHandler,
   CapabilityKeyRegistry2 as CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
@@ -4692,7 +4935,7 @@ export {
   parseSpaceUri,
   pkhDid3 as pkhDid,
   principalDid,
-  principalDidEquals2 as principalDidEquals,
+  principalDidEquals3 as principalDidEquals,
   resolveManifest2 as resolveManifest,
   resolveSecretListPrefix2 as resolveSecretListPrefix,
   resolveSecretPath2 as resolveSecretPath,