@tinycloud/node-sdk 2.4.0-beta.1 → 2.4.0-beta.11

package/dist/index.cjs

@@ -17025,133 +17025,135 @@ var require_utils2 = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  ACCOUNT_REGISTRY_PATH: () => import_sdk_core9.ACCOUNT_REGISTRY_PATH,
-  ACCOUNT_REGISTRY_SPACE: () => import_sdk_core9.ACCOUNT_REGISTRY_SPACE,
-  AutoApproveSpaceCreationHandler: () => import_sdk_core8.AutoApproveSpaceCreationHandler,
-  CapabilityKeyRegistry: () => import_sdk_core17.CapabilityKeyRegistry,
-  CapabilityKeyRegistryErrorCodes: () => import_sdk_core17.CapabilityKeyRegistryErrorCodes,
-  DECRYPT_ACTION: () => import_sdk_core14.DECRYPT_ACTION,
-  DECRYPT_FACT_TYPE: () => import_sdk_core14.DECRYPT_FACT_TYPE,
-  DECRYPT_RESULT_TYPE: () => import_sdk_core14.DECRYPT_RESULT_TYPE,
-  DEFAULT_ENCRYPTION_ALG: () => import_sdk_core14.DEFAULT_ENCRYPTION_ALG,
-  DEFAULT_KEY_VERSION: () => import_sdk_core14.DEFAULT_KEY_VERSION,
-  DEFAULT_MANIFEST_SPACE: () => import_sdk_core9.DEFAULT_MANIFEST_SPACE,
-  DEFAULT_MANIFEST_VERSION: () => import_sdk_core9.DEFAULT_MANIFEST_VERSION,
-  DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => import_sdk_core10.DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
-  DataVaultService: () => import_sdk_core13.DataVaultService,
-  DatabaseHandle: () => import_sdk_core11.DatabaseHandle,
+  ACCOUNT_REGISTRY_PATH: () => import_sdk_core10.ACCOUNT_REGISTRY_PATH,
+  ACCOUNT_REGISTRY_SPACE: () => import_sdk_core10.ACCOUNT_REGISTRY_SPACE,
+  AccountService: () => import_sdk_core2.AccountService,
+  AutoApproveSpaceCreationHandler: () => import_sdk_core9.AutoApproveSpaceCreationHandler,
+  CapabilityKeyRegistry: () => import_sdk_core18.CapabilityKeyRegistry,
+  CapabilityKeyRegistryErrorCodes: () => import_sdk_core18.CapabilityKeyRegistryErrorCodes,
+  DECRYPT_ACTION: () => import_sdk_core15.DECRYPT_ACTION,
+  DECRYPT_FACT_TYPE: () => import_sdk_core15.DECRYPT_FACT_TYPE,
+  DECRYPT_RESULT_TYPE: () => import_sdk_core15.DECRYPT_RESULT_TYPE,
+  DEFAULT_ENCRYPTION_ALG: () => import_sdk_core15.DEFAULT_ENCRYPTION_ALG,
+  DEFAULT_KEY_VERSION: () => import_sdk_core15.DEFAULT_KEY_VERSION,
+  DEFAULT_MANIFEST_SPACE: () => import_sdk_core10.DEFAULT_MANIFEST_SPACE,
+  DEFAULT_MANIFEST_VERSION: () => import_sdk_core10.DEFAULT_MANIFEST_VERSION,
+  DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => import_sdk_core11.DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
+  DataVaultService: () => import_sdk_core14.DataVaultService,
+  DatabaseHandle: () => import_sdk_core12.DatabaseHandle,
   DelegatedAccess: () => DelegatedAccess,
-  DelegationErrorCodes: () => import_sdk_core16.DelegationErrorCodes,
-  DelegationManager: () => import_sdk_core16.DelegationManager,
-  DuckDbAction: () => import_sdk_core12.DuckDbAction,
-  DuckDbDatabaseHandle: () => import_sdk_core12.DuckDbDatabaseHandle,
-  DuckDbService: () => import_sdk_core12.DuckDbService,
-  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_core14.ENCRYPTION_NETWORK_URN_PREFIX,
-  ENCRYPTION_SERVICE: () => import_sdk_core14.ENCRYPTION_SERVICE,
-  ENCRYPTION_SERVICE_SHORT: () => import_sdk_core14.ENCRYPTION_SERVICE_SHORT,
-  ENVELOPE_VERSION: () => import_sdk_core14.ENVELOPE_VERSION,
-  EncryptionService: () => import_sdk_core14.EncryptionService,
+  DelegationErrorCodes: () => import_sdk_core17.DelegationErrorCodes,
+  DelegationManager: () => import_sdk_core17.DelegationManager,
+  DuckDbAction: () => import_sdk_core13.DuckDbAction,
+  DuckDbDatabaseHandle: () => import_sdk_core13.DuckDbDatabaseHandle,
+  DuckDbService: () => import_sdk_core13.DuckDbService,
+  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_core15.ENCRYPTION_NETWORK_URN_PREFIX,
+  ENCRYPTION_SERVICE: () => import_sdk_core15.ENCRYPTION_SERVICE,
+  ENCRYPTION_SERVICE_SHORT: () => import_sdk_core15.ENCRYPTION_SERVICE_SHORT,
+  ENVELOPE_VERSION: () => import_sdk_core15.ENVELOPE_VERSION,
+  EncryptionService: () => import_sdk_core15.EncryptionService,
   FileSessionStorage: () => FileSessionStorage,
-  HooksService: () => import_sdk_core15.HooksService,
-  IdentityParseError: () => import_sdk_core8.IdentityParseError,
-  KVService: () => import_sdk_core10.KVService,
-  ManifestValidationError: () => import_sdk_core9.ManifestValidationError,
+  HooksService: () => import_sdk_core16.HooksService,
+  IdentityParseError: () => import_sdk_core9.IdentityParseError,
+  KVService: () => import_sdk_core11.KVService,
+  ManifestValidationError: () => import_sdk_core10.ManifestValidationError,
   MemorySessionStorage: () => MemorySessionStorage,
-  NETWORK_NAME_PATTERN: () => import_sdk_core14.NETWORK_NAME_PATTERN,
-  NetworkIdError: () => import_sdk_core14.NetworkIdError,
+  NETWORK_NAME_PATTERN: () => import_sdk_core15.NETWORK_NAME_PATTERN,
+  NetworkIdError: () => import_sdk_core15.NetworkIdError,
   NodeUserAuthorization: () => NodeUserAuthorization,
   NodeWasmBindings: () => NodeWasmBindings,
-  PermissionNotInManifestError: () => import_sdk_core9.PermissionNotInManifestError,
-  PrefixedKVService: () => import_sdk_core10.PrefixedKVService,
+  PermissionNotInManifestError: () => import_sdk_core10.PermissionNotInManifestError,
+  PrefixedKVService: () => import_sdk_core11.PrefixedKVService,
   PrivateKeySigner: () => PrivateKeySigner,
-  ProtocolMismatchError: () => import_sdk_core19.ProtocolMismatchError,
-  SECRET_NAME_RE: () => import_sdk_core13.SECRET_NAME_RE,
-  SQLAction: () => import_sdk_core11.SQLAction,
-  SQLService: () => import_sdk_core11.SQLService,
-  SecretsService: () => import_sdk_core13.SecretsService,
-  ServiceContext: () => import_sdk_core20.ServiceContext,
-  SessionExpiredError: () => import_sdk_core9.SessionExpiredError,
-  SharingService: () => import_sdk_core16.SharingService,
-  SilentNotificationHandler: () => import_sdk_core8.SilentNotificationHandler,
-  Space: () => import_sdk_core18.Space,
-  SpaceErrorCodes: () => import_sdk_core18.SpaceErrorCodes,
-  SpaceService: () => import_sdk_core18.SpaceService,
-  TinyCloud: () => import_sdk_core7.TinyCloud,
+  ProtocolMismatchError: () => import_sdk_core20.ProtocolMismatchError,
+  SECRET_NAME_RE: () => import_sdk_core14.SECRET_NAME_RE,
+  SQLAction: () => import_sdk_core12.SQLAction,
+  SQLService: () => import_sdk_core12.SQLService,
+  SecretsService: () => import_sdk_core14.SecretsService,
+  ServiceContext: () => import_sdk_core21.ServiceContext,
+  SessionExpiredError: () => import_sdk_core10.SessionExpiredError,
+  SharingService: () => import_sdk_core17.SharingService,
+  SilentNotificationHandler: () => import_sdk_core9.SilentNotificationHandler,
+  Space: () => import_sdk_core19.Space,
+  SpaceErrorCodes: () => import_sdk_core19.SpaceErrorCodes,
+  SpaceService: () => import_sdk_core19.SpaceService,
+  TinyCloud: () => import_sdk_core8.TinyCloud,
   TinyCloudNode: () => TinyCloudNode,
-  UnsupportedFeatureError: () => import_sdk_core19.UnsupportedFeatureError,
-  VAULT_PERMISSION_SERVICE: () => import_sdk_core9.VAULT_PERMISSION_SERVICE,
-  VaultHeaders: () => import_sdk_core13.VaultHeaders,
-  VaultPublicSpaceKVActions: () => import_sdk_core13.VaultPublicSpaceKVActions,
-  VersionCheckError: () => import_sdk_core19.VersionCheckError,
+  UnsupportedFeatureError: () => import_sdk_core20.UnsupportedFeatureError,
+  VAULT_PERMISSION_SERVICE: () => import_sdk_core10.VAULT_PERMISSION_SERVICE,
+  VaultHeaders: () => import_sdk_core14.VaultHeaders,
+  VaultPublicSpaceKVActions: () => import_sdk_core14.VaultPublicSpaceKVActions,
+  VersionCheckError: () => import_sdk_core20.VersionCheckError,
   WasmKeyProvider: () => WasmKeyProvider,
-  addressStorageKey: () => import_sdk_core8.addressStorageKey,
-  buildCanonicalDecryptRequest: () => import_sdk_core14.buildCanonicalDecryptRequest,
-  buildDecryptAttenuation: () => import_sdk_core14.buildDecryptAttenuation,
-  buildDecryptFacts: () => import_sdk_core14.buildDecryptFacts,
-  buildDecryptInvocation: () => import_sdk_core14.buildDecryptInvocation,
-  buildNetworkId: () => import_sdk_core14.buildNetworkId,
-  buildSpaceUri: () => import_sdk_core18.buildSpaceUri,
-  canonicalHashHex: () => import_sdk_core14.canonicalHashHex,
-  canonicalSignedResponse: () => import_sdk_core14.canonicalSignedResponse,
-  canonicalizeAddress: () => import_sdk_core8.canonicalizeAddress,
-  canonicalizeDid: () => import_sdk_core8.canonicalizeDid,
-  canonicalizeDidUrl: () => import_sdk_core8.canonicalizeDidUrl,
-  canonicalizeEncryptionJson: () => import_sdk_core14.canonicalizeEncryptionJson,
-  canonicalizeNetworkId: () => import_sdk_core8.canonicalizeNetworkId,
-  canonicalizeSecretScope: () => import_sdk_core13.canonicalizeSecretScope,
-  checkDecryptInvocationInput: () => import_sdk_core14.checkDecryptInvocationInput,
-  checkNodeInfo: () => import_sdk_core19.checkNodeInfo,
-  composeManifestRequest: () => import_sdk_core9.composeManifestRequest,
-  createCapabilityKeyRegistry: () => import_sdk_core17.createCapabilityKeyRegistry,
-  createSharingService: () => import_sdk_core16.createSharingService,
-  createSpaceService: () => import_sdk_core18.createSpaceService,
-  createVaultCrypto: () => import_sdk_core13.createVaultCrypto,
+  addressStorageKey: () => import_sdk_core9.addressStorageKey,
+  buildCanonicalDecryptRequest: () => import_sdk_core15.buildCanonicalDecryptRequest,
+  buildDecryptAttenuation: () => import_sdk_core15.buildDecryptAttenuation,
+  buildDecryptFacts: () => import_sdk_core15.buildDecryptFacts,
+  buildDecryptInvocation: () => import_sdk_core15.buildDecryptInvocation,
+  buildNetworkId: () => import_sdk_core15.buildNetworkId,
+  buildSpaceUri: () => import_sdk_core19.buildSpaceUri,
+  canonicalHashHex: () => import_sdk_core15.canonicalHashHex,
+  canonicalSignedResponse: () => import_sdk_core15.canonicalSignedResponse,
+  canonicalizeAddress: () => import_sdk_core9.canonicalizeAddress,
+  canonicalizeDid: () => import_sdk_core9.canonicalizeDid,
+  canonicalizeDidUrl: () => import_sdk_core9.canonicalizeDidUrl,
+  canonicalizeEncryptionJson: () => import_sdk_core15.canonicalizeEncryptionJson,
+  canonicalizeNetworkId: () => import_sdk_core9.canonicalizeNetworkId,
+  canonicalizeSecretScope: () => import_sdk_core14.canonicalizeSecretScope,
+  checkDecryptInvocationInput: () => import_sdk_core15.checkDecryptInvocationInput,
+  checkNodeInfo: () => import_sdk_core20.checkNodeInfo,
+  composeManifestRequest: () => import_sdk_core10.composeManifestRequest,
+  createCapabilityKeyRegistry: () => import_sdk_core18.createCapabilityKeyRegistry,
+  createSharingService: () => import_sdk_core17.createSharingService,
+  createSpaceService: () => import_sdk_core19.createSpaceService,
+  createVaultCrypto: () => import_sdk_core14.createVaultCrypto,
   createWasmKeyProvider: () => createWasmKeyProvider,
-  decryptEnvelopeWithKey: () => import_sdk_core14.decryptEnvelopeWithKey,
+  decryptEnvelopeWithKey: () => import_sdk_core15.decryptEnvelopeWithKey,
   defaultSignStrategy: () => defaultSignStrategy,
-  defaultSpaceCreationHandler: () => import_sdk_core8.defaultSpaceCreationHandler,
-  deriveSignedReceiverKey: () => import_sdk_core14.deriveSignedReceiverKey,
+  defaultSpaceCreationHandler: () => import_sdk_core9.defaultSpaceCreationHandler,
+  deriveSignedReceiverKey: () => import_sdk_core15.deriveSignedReceiverKey,
   deserializeDelegation: () => deserializeDelegation,
-  didCacheKey: () => import_sdk_core8.didCacheKey,
-  didEquals: () => import_sdk_core8.didEquals,
-  discoverNetwork: () => import_sdk_core14.discoverNetwork,
-  encryptToNetwork: () => import_sdk_core14.encryptToNetwork,
-  encryptionBase64Decode: () => import_sdk_core14.encryptionBase64Decode,
-  encryptionBase64Encode: () => import_sdk_core14.encryptionBase64Encode,
-  encryptionError: () => import_sdk_core14.encryptionError,
-  encryptionUtf8Decode: () => import_sdk_core14.encryptionUtf8Decode,
-  encryptionUtf8Encode: () => import_sdk_core14.encryptionUtf8Encode,
-  ensureNetworkUsableForDecrypt: () => import_sdk_core14.ensureNetworkUsableForDecrypt,
-  expandActionShortNames: () => import_sdk_core9.expandActionShortNames,
-  expandPermissionEntries: () => import_sdk_core9.expandPermissionEntries,
-  expandPermissionEntry: () => import_sdk_core9.expandPermissionEntry,
-  generateRandomReceiverKey: () => import_sdk_core14.generateRandomReceiverKey,
-  hexDecode: () => import_sdk_core14.hexDecode,
-  hexEncode: () => import_sdk_core14.hexEncode,
-  isCapabilitySubset: () => import_sdk_core9.isCapabilitySubset,
-  isEvmAddress: () => import_sdk_core8.isEvmAddress,
-  isNetworkId: () => import_sdk_core14.isNetworkId,
-  loadManifest: () => import_sdk_core9.loadManifest,
-  makePkhSpaceId: () => import_sdk_core8.makePkhSpaceId,
-  makePublicSpaceId: () => import_sdk_core18.makePublicSpaceId,
-  networkDiscoveryKey: () => import_sdk_core14.networkDiscoveryKey,
-  openWrappedKey: () => import_sdk_core14.openWrappedKey,
-  parseCanonicalNetworkId: () => import_sdk_core8.parseCanonicalNetworkId,
-  parseExpiry: () => import_sdk_core9.parseExpiry,
-  parseNetworkId: () => import_sdk_core14.parseNetworkId,
-  parsePkhDid: () => import_sdk_core8.parsePkhDid,
-  parseSpaceUri: () => import_sdk_core18.parseSpaceUri,
-  pkhDid: () => import_sdk_core8.pkhDid,
-  principalDid: () => import_sdk_core8.principalDid,
-  principalDidEquals: () => import_sdk_core8.principalDidEquals,
-  resolveManifest: () => import_sdk_core9.resolveManifest,
-  resolveSecretListPrefix: () => import_sdk_core13.resolveSecretListPrefix,
-  resolveSecretPath: () => import_sdk_core13.resolveSecretPath,
-  resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core9.resourceCapabilitiesToSpaceAbilitiesMap,
+  didCacheKey: () => import_sdk_core9.didCacheKey,
+  didEquals: () => import_sdk_core9.didEquals,
+  discoverNetwork: () => import_sdk_core15.discoverNetwork,
+  encryptToNetwork: () => import_sdk_core15.encryptToNetwork,
+  encryptionBase64Decode: () => import_sdk_core15.encryptionBase64Decode,
+  encryptionBase64Encode: () => import_sdk_core15.encryptionBase64Encode,
+  encryptionError: () => import_sdk_core15.encryptionError,
+  encryptionUtf8Decode: () => import_sdk_core15.encryptionUtf8Decode,
+  encryptionUtf8Encode: () => import_sdk_core15.encryptionUtf8Encode,
+  ensureNetworkUsableForDecrypt: () => import_sdk_core15.ensureNetworkUsableForDecrypt,
+  expandActionShortNames: () => import_sdk_core10.expandActionShortNames,
+  expandPermissionEntries: () => import_sdk_core10.expandPermissionEntries,
+  expandPermissionEntry: () => import_sdk_core10.expandPermissionEntry,
+  generateRandomReceiverKey: () => import_sdk_core15.generateRandomReceiverKey,
+  grantAuthRequest: () => grantAuthRequest,
+  hexDecode: () => import_sdk_core15.hexDecode,
+  hexEncode: () => import_sdk_core15.hexEncode,
+  isCapabilitySubset: () => import_sdk_core10.isCapabilitySubset,
+  isEvmAddress: () => import_sdk_core9.isEvmAddress,
+  isNetworkId: () => import_sdk_core15.isNetworkId,
+  loadManifest: () => import_sdk_core10.loadManifest,
+  makePkhSpaceId: () => import_sdk_core9.makePkhSpaceId,
+  makePublicSpaceId: () => import_sdk_core19.makePublicSpaceId,
+  networkDiscoveryKey: () => import_sdk_core15.networkDiscoveryKey,
+  openWrappedKey: () => import_sdk_core15.openWrappedKey,
+  parseCanonicalNetworkId: () => import_sdk_core9.parseCanonicalNetworkId,
+  parseExpiry: () => import_sdk_core10.parseExpiry,
+  parseNetworkId: () => import_sdk_core15.parseNetworkId,
+  parsePkhDid: () => import_sdk_core9.parsePkhDid,
+  parseSpaceUri: () => import_sdk_core19.parseSpaceUri,
+  pkhDid: () => import_sdk_core9.pkhDid,
+  principalDid: () => import_sdk_core9.principalDid,
+  principalDidEquals: () => import_sdk_core9.principalDidEquals,
+  resolveManifest: () => import_sdk_core10.resolveManifest,
+  resolveSecretListPrefix: () => import_sdk_core14.resolveSecretListPrefix,
+  resolveSecretPath: () => import_sdk_core14.resolveSecretPath,
+  resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core10.resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation: () => serializeDelegation,
-  validateEnvelope: () => import_sdk_core14.validateEnvelope,
-  validateManifest: () => import_sdk_core9.validateManifest,
-  verifyDecryptResponse: () => import_sdk_core14.verifyDecryptResponse
+  validateEnvelope: () => import_sdk_core15.validateEnvelope,
+  validateManifest: () => import_sdk_core10.validateManifest,
+  verifyDecryptResponse: () => import_sdk_core15.verifyDecryptResponse
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -17256,7 +17258,7 @@ var PrivateKeySigner = class {
 };
 
 // src/TinyCloudNode.ts
-var import_sdk_core5 = require("@tinycloud/sdk-core");
+var import_sdk_core6 = require("@tinycloud/sdk-core");
 
 // src/authorization/NodeUserAuthorization.ts
 var import_sdk_core = require("@tinycloud/sdk-core");
@@ -17336,6 +17338,25 @@ var MemorySessionStorage = class {
 };
 
 // src/authorization/NodeUserAuthorization.ts
+var DECRYPT_ACTION = "tinycloud.encryption/decrypt";
+var NETWORK_CREATE_ACTION = "tinycloud.encryption/network.create";
+function didPrincipalMatches(actual, expected) {
+  try {
+    return (0, import_sdk_core.principalDidEquals)(actual, expected);
+  } catch {
+    return actual === expected;
+  }
+}
+function addRawAbility(rawAbilities, resource, action) {
+  const actions = rawAbilities[resource];
+  if (actions === void 0) {
+    rawAbilities[resource] = [action];
+    return;
+  }
+  if (!actions.includes(action)) {
+    actions.push(action);
+  }
+}
 var NodeUserAuthorization = class {
   constructor(config) {
     this.extensions = [];
@@ -17362,6 +17383,7 @@ var NodeUserAuthorization = class {
         "": [
           "tinycloud.sql/read",
           "tinycloud.sql/write",
+          "tinycloud.sql/ddl",
           "tinycloud.sql/admin",
           "tinycloud.sql/export"
         ]
@@ -17453,12 +17475,48 @@ var NodeUserAuthorization = class {
    * `siwe` is the load-bearing one because `extractSiweExpiration` returns
    * undefined for missing SIWEs and the SDK then treats the session as
    * expired-at-epoch-zero.
+   *
+   * @param hosts - The TinyCloud hosts this session was created against,
+   *   as persisted in {@link PersistedSessionData.tinycloudHosts}. When
+   *   present (and non-empty) they are adopted directly so the restored
+   *   session resolves to the same node as the original sign-in without
+   *   re-running registry/fallback resolution. When absent (old session)
+   *   hosts are resolved lazily on the first host-needing call via
+   *   {@link ensureTinyCloudHosts}.
    */
-  setRestoredTinyCloudSession(session) {
+  setRestoredTinyCloudSession(session, hosts) {
     const address = (0, import_sdk_core.canonicalizeAddress)(session.address);
     this._tinyCloudSession = { ...session, address };
     this._address = address;
     this._chainId = session.chainId;
+    if ((!this.tinycloudHosts || this.tinycloudHosts.length === 0) && hosts && hosts.length > 0) {
+      this.tinycloudHosts = [...hosts];
+    }
+  }
+  /**
+   * Ensure `tinycloudHosts` are resolved before a host-needing call.
+   *
+   * Fresh sign-in resolves hosts up front; a restored session may not have
+   * (old persisted sessions predate {@link PersistedSessionData.tinycloudHosts}).
+   * This guard makes a restored session resolve the node exactly like a fresh
+   * sign-in — persisted hosts are preferred (already set by
+   * {@link setRestoredTinyCloudSession}), otherwise the registry/fallback
+   * resolution runs lazily here. Idempotent: {@link resolveTinyCloudHostsForSignIn}
+   * early-returns when hosts are already set.
+   *
+   * Throws if hosts are unset and the restored session has no address/chainId
+   * to resolve from — a real failure that must surface, not be masked.
+   */
+  async ensureTinyCloudHosts() {
+    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
+      return;
+    }
+    if (this._address === void 0 || this._chainId === void 0) {
+      throw new Error(
+        "Cannot resolve TinyCloud hosts: no address/chainId available. Sign in or restore a session first."
+      );
+    }
+    await this.resolveTinyCloudHostsForSignIn(this._address, this._chainId);
   }
   async resolveTinyCloudHostsForSignIn(address, chainId) {
     if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
@@ -17565,20 +17623,18 @@ var NodeUserAuthorization = class {
       };
     }
     const rawAbilities = {};
+    const currentDid = (0, import_sdk_core.pkhDid)(address, chainId);
     const spaceResources = request.resources.filter((entry) => {
       if (entry.service !== import_sdk_core.ENCRYPTION_PERMISSION_SERVICE) {
         return true;
       }
-      const existing = rawAbilities[entry.path];
-      if (existing === void 0) {
-        rawAbilities[entry.path] = [...entry.actions];
-      } else {
-        const seen = new Set(existing);
-        for (const action of entry.actions) {
-          if (!seen.has(action)) {
-            existing.push(action);
-            seen.add(action);
-          }
+      for (const action of entry.actions) {
+        addRawAbility(rawAbilities, entry.path, action);
+      }
+      if (entry.actions.includes(DECRYPT_ACTION)) {
+        const parsed = (0, import_sdk_core.parseNetworkId)(entry.path);
+        if (didPrincipalMatches(parsed.ownerDid, currentDid)) {
+          addRawAbility(rawAbilities, entry.path, NETWORK_CREATE_ACTION);
         }
       }
       return false;
@@ -17657,6 +17713,7 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession || !this._address || !this._chainId) {
       throw new Error("Must be signed in to host space");
     }
+    await this.ensureTinyCloudHosts();
     const host = this.primaryTinyCloudHost;
     const spaceId = targetSpaceId ?? this._tinyCloudSession.spaceId;
     const peerId = await (0, import_sdk_core.fetchPeerId)(host, spaceId);
@@ -17699,6 +17756,7 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession) {
       throw new Error("Must be signed in to ensure space exists");
     }
+    await this.ensureTinyCloudHosts();
     const host = this.primaryTinyCloudHost;
     const primarySpaceId = this._tinyCloudSession.spaceId;
     const result = await (0, import_sdk_core.activateSessionWithHost)(
@@ -17880,7 +17938,8 @@ var NodeUserAuthorization = class {
       },
       expiresAt: expirationTime.toISOString(),
       createdAt: now.toISOString(),
-      version: "1.0"
+      version: "1.0",
+      tinycloudHosts: this.tinycloudHosts
     };
     await this.sessionStorage.save(address, persistedData);
     this._session = clientSession;
@@ -18047,7 +18106,8 @@ var NodeUserAuthorization = class {
       },
       expiresAt,
       createdAt,
-      version: "1.0"
+      version: "1.0",
+      tinycloudHosts: this.tinycloudHosts
     };
     await this.sessionStorage.save(address, persistedData);
     this._session = clientSession;
@@ -18137,30 +18197,33 @@ var NodeUserAuthorization = class {
   }
 };
 
-// src/DelegatedAccess.ts
+// src/account/AccountService.ts
 var import_sdk_core2 = require("@tinycloud/sdk-core");
+
+// src/DelegatedAccess.ts
+var import_sdk_core3 = require("@tinycloud/sdk-core");
 var DelegatedAccess = class {
   constructor(session, delegation, host, invoke2, telemetry) {
     this.session = session;
     this._delegation = delegation;
     this.host = host;
-    this._serviceContext = new import_sdk_core2.ServiceContext({
+    this._serviceContext = new import_sdk_core3.ServiceContext({
       invoke: invoke2,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [host],
       telemetry
     });
     const prefix = this._delegation.path.replace(/\/$/, "");
-    this._kv = new import_sdk_core2.KVService({ prefix });
+    this._kv = new import_sdk_core3.KVService({ prefix });
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
-    this._sql = new import_sdk_core2.SQLService({});
+    this._sql = new import_sdk_core3.SQLService({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
-    this._duckdb = new import_sdk_core2.DuckDbService({});
+    this._duckdb = new import_sdk_core3.DuckDbService({});
     this._duckdb.initialize(this._serviceContext);
     this._serviceContext.registerService("duckdb", this._duckdb);
-    this._hooks = new import_sdk_core2.HooksService({});
+    this._hooks = new import_sdk_core3.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -18310,7 +18373,7 @@ function createWasmKeyProvider(sessionManager) {
 }
 
 // src/delegateToHelpers.ts
-var import_sdk_core3 = require("@tinycloud/sdk-core");
+var import_sdk_core4 = require("@tinycloud/sdk-core");
 function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   const byService = /* @__PURE__ */ new Map();
   for (const a of actions) {
@@ -18341,7 +18404,7 @@ function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   }
   return entries;
 }
-var DEFAULT_DELEGATION_EXPIRY_MS = import_sdk_core3.EXPIRY.SESSION_MS;
+var DEFAULT_DELEGATION_EXPIRY_MS = import_sdk_core4.EXPIRY.SESSION_MS;
 function resolveExpiryMs(expiry) {
   if (expiry === void 0) {
     return DEFAULT_DELEGATION_EXPIRY_MS;
@@ -18354,10 +18417,10 @@ function resolveExpiryMs(expiry) {
     }
     return expiry;
   }
-  return (0, import_sdk_core3.parseExpiry)(expiry);
+  return (0, import_sdk_core4.parseExpiry)(expiry);
 }
 function extractSiweExpiration(siwe) {
-  const parsed = new import_sdk_core3.SiweMessage(siwe);
+  const parsed = new import_sdk_core4.SiweMessage(siwe);
   if (parsed.expirationTime === void 0 || parsed.expirationTime === null) {
     return void 0;
   }
@@ -18371,7 +18434,7 @@ function extractSiweExpiration(siwe) {
 }
 
 // src/NodeSecretsService.ts
-var import_sdk_core4 = require("@tinycloud/sdk-core");
+var import_sdk_core5 = require("@tinycloud/sdk-core");
 var SECRETS_SPACE = "secrets";
 function ok() {
   return { ok: true, data: void 0 };
@@ -18404,7 +18467,7 @@ function secretActionName(action) {
 }
 function secretPermissionEntries(name, options, action, encryptionNetworkId) {
   const entries = [];
-  const path = action === "list" ? (0, import_sdk_core4.resolveSecretListPrefix)(options) : (0, import_sdk_core4.resolveSecretPath)(name, options).permissionPaths.vault;
+  const path = action === "list" ? (0, import_sdk_core5.resolveSecretListPrefix)(options) : (0, import_sdk_core5.resolveSecretPath)(name, options).permissionPaths.vault;
   entries.push({
     service: "tinycloud.kv",
     space: SECRETS_SPACE,
@@ -18483,7 +18546,7 @@ var NodeSecretsService = class {
       );
     } catch (error) {
       return secretsError(
-        import_sdk_core4.ErrorCodes.INVALID_INPUT,
+        import_sdk_core5.ErrorCodes.INVALID_INPUT,
         error instanceof Error ? error.message : String(error),
         error instanceof Error ? error : void 0
       );
@@ -18493,7 +18556,7 @@ var NodeSecretsService = class {
     }
     if (!this.config.canEscalate()) {
       return secretsError(
-        import_sdk_core4.ErrorCodes.PERMISSION_DENIED,
+        import_sdk_core5.ErrorCodes.PERMISSION_DENIED,
         `Cannot autosign ${displayActionUrn(action)} for ${target}; TinyCloudNode needs wallet mode with a signer or privateKey.`
       );
     }
@@ -18502,7 +18565,7 @@ var NodeSecretsService = class {
       return this.restoreUnlockAfterEscalation();
     } catch (error) {
       return secretsError(
-        import_sdk_core4.ErrorCodes.PERMISSION_DENIED,
+        import_sdk_core5.ErrorCodes.PERMISSION_DENIED,
         error instanceof Error ? error.message : `Autosign escalation for ${displayActionUrn(action)} on ${target} failed.`,
         error instanceof Error ? error : void 0
       );
@@ -18523,10 +18586,10 @@ var NodeSecretsService = class {
       return false;
     }
     const manifests = Array.isArray(manifest) ? manifest : [manifest];
-    const requestedEntries = (0, import_sdk_core4.expandPermissionEntries)(permissionEntries);
+    const requestedEntries = (0, import_sdk_core5.expandPermissionEntries)(permissionEntries);
     return requestedEntries.every(
       (entry) => manifests.some((candidate) => {
-        const resolved = (0, import_sdk_core4.resolveManifest)(candidate);
+        const resolved = (0, import_sdk_core5.resolveManifest)(candidate);
         return resolved.resources.some(
           (resource) => resource.service === entry.service && resource.space === entry.space && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
         );
@@ -18538,13 +18601,13 @@ var NodeSecretsService = class {
 // src/TinyCloudNode.ts
 var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
-var NETWORK_CREATE_ACTION = "tinycloud.encryption/network.create";
-var DECRYPT_ACTION = "tinycloud.encryption/decrypt";
+var NETWORK_CREATE_ACTION2 = "tinycloud.encryption/network.create";
+var DECRYPT_ACTION2 = "tinycloud.encryption/decrypt";
 var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
-var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core5.EXPIRY.SESSION_MS;
-function didPrincipalMatches(actual, expected) {
+var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core6.EXPIRY.SESSION_MS;
+function didPrincipalMatches2(actual, expected) {
   try {
-    return (0, import_sdk_core5.principalDidEquals)(actual, expected);
+    return (0, import_sdk_core6.principalDidEquals)(actual, expected);
   } catch {
     return actual === expected;
   }
@@ -18710,12 +18773,12 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Failed to get session key JWK");
     }
     this.sessionKeyJwk = JSON.parse(jwkStr);
-    this._capabilityRegistry = new import_sdk_core5.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core6.CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({
       sessionManager: this.sessionManager
     });
-    this.notificationHandler = config.notificationHandler ?? new import_sdk_core5.SilentNotificationHandler();
-    this._sharingService = new import_sdk_core5.SharingService({
+    this.notificationHandler = config.notificationHandler ?? new import_sdk_core6.SilentNotificationHandler();
+    this._sharingService = new import_sdk_core6.SharingService({
       hosts: [this.config.host],
       // session: undefined - not needed for receive()
       invoke: this.invokeWithRuntimePermissions,
@@ -18725,8 +18788,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       // delegationManager: undefined - not needed for receive()
       createKVService: (config2) => {
         const prefix = config2.pathPrefix?.replace(/\/$/, "");
-        const kvService = new import_sdk_core5.KVService({ prefix });
-        const kvContext = new import_sdk_core5.ServiceContext({
+        const kvService = new import_sdk_core6.KVService({ prefix });
+        const kvContext = new import_sdk_core6.ServiceContext({
           invoke: config2.invoke,
           fetch: config2.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config2.hosts,
@@ -18786,7 +18849,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       capabilityRequest: config.capabilityRequest,
       includeAccountRegistryPermissions: config.includeAccountRegistryPermissions
     });
-    this.tc = new import_sdk_core5.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core6.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: config.telemetry
     });
@@ -18847,7 +18910,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   get did() {
     if (this._address) {
-      return (0, import_sdk_core5.pkhDid)(this._address, this._chainId);
+      return (0, import_sdk_core6.pkhDid)(this._address, this._chainId);
     }
     return this.sessionManager.getDID(this.sessionKeyId);
   }
@@ -18881,6 +18944,37 @@ var _TinyCloudNode = class _TinyCloudNode {
   get spaceId() {
     return this.auth?.tinyCloudSession?.spaceId;
   }
+  /**
+   * Get the account space ID for this wallet identity.
+   * Available after wallet-backed sign-in or a restored session with address metadata.
+   */
+  get accountSpaceId() {
+    if (!this._address) {
+      return void 0;
+    }
+    return this.wasmBindings.makeSpaceId(this._address, this._chainId, import_sdk_core6.ACCOUNT_REGISTRY_SPACE);
+  }
+  /**
+   * Account-level application and delegation helpers.
+   */
+  get account() {
+    if (!this._account) {
+      this._account = new import_sdk_core2.AccountService({
+        getDid: () => this.did,
+        getHost: () => this.hosts[0] ?? this.config.host,
+        getPrimarySpaceId: () => this.spaceId,
+        getAccountSpaceId: () => this.accountSpaceId,
+        getSpaces: () => this.spaces,
+        getAccountDb: () => this.accountSpaceId ? this.sqlForSpace(this.accountSpaceId).db("account") : void 0,
+        ensureAccountSpaceHosted: async () => {
+          if (this.accountSpaceId && this.auth) {
+            await this.ensureOwnedSpaceHostedById(this.accountSpaceId);
+          }
+        }
+      });
+    }
+    return this._account;
+  }
   /**
    * Get the current TinyCloud session.
    * Available after signIn().
@@ -18902,7 +18996,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     await this.wasmBindings.ensureInitialized?.();
-    this._address = (0, import_sdk_core5.canonicalizeAddress)(await this.signer.getAddress());
+    this._address = (0, import_sdk_core6.canonicalizeAddress)(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
     this._kv = void 0;
     this._sql = void 0;
@@ -18918,10 +19012,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
     this.initializeServices();
+    await this.ensureRequestedEncryptionNetworks();
     if (this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
-      await this.ensureOwnedSpaceHosted(this.ownedSpaceId("secrets"));
+      await this.ensureOwnedSpaceHostedById(this.ownedSpaceId("secrets"));
     }
-    await this.writeManifestRegistryRecords();
+    this.scheduleAccountRegistrySync();
     this.notificationHandler.success("Successfully signed in");
   }
   ownedSpaceId(name) {
@@ -18938,23 +19033,69 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.signer) {
       throw new Error("Manifest registry write requires wallet mode");
     }
-    const accountSpaceId = this.ownedSpaceId(import_sdk_core5.ACCOUNT_REGISTRY_SPACE);
-    await this.ensureOwnedSpaceHosted(accountSpaceId);
-    const accountKV = this.spaces.get(accountSpaceId).kv;
-    for (const record of request.registryRecords) {
-      const result = await accountKV.put(record.key, {
-        app_id: record.app_id,
-        manifests: record.manifests,
-        updated_at: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      if (!result.ok) {
-        throw new Error(
-          `Failed to write manifest registry record ${record.key}: ${result.error.message}`
-        );
+    const accountSpaceId = this.ownedSpaceId(import_sdk_core6.ACCOUNT_REGISTRY_SPACE);
+    await this.ensureOwnedSpaceHostedById(accountSpaceId);
+    const result = await this.account.applications.register(request.manifests);
+    if (!result.ok) {
+      throw new Error(
+        `Failed to write manifest registry records: ${result.error.message}`
+      );
+    }
+  }
+  scheduleAccountRegistrySync() {
+    void this.withAccountRegistryRetry(async () => {
+      await this.writeManifestRegistryRecords();
+      const spaces = await this.account.spaces.syncAccessible();
+      if (!spaces.ok) {
+        throw new Error(`Failed to sync account spaces: ${spaces.error.message}`);
+      }
+    });
+  }
+  async withAccountRegistryRetry(task) {
+    const delays = [250, 1e3, 3e3];
+    let lastError;
+    for (let attempt = 0; attempt < delays.length; attempt += 1) {
+      try {
+        await task();
+        return;
+      } catch (error) {
+        lastError = error;
+        if (attempt < delays.length - 1) {
+          await new Promise((resolve) => setTimeout(resolve, delays[attempt]));
+        }
+      }
+    }
+    console.warn(
+      "TinyCloud account registry sync failed after retries",
+      lastError
+    );
+  }
+  requestedEncryptionNetworkIds() {
+    const request = this.capabilityRequest;
+    if (!request) {
+      return [];
+    }
+    const networkIds = /* @__PURE__ */ new Set();
+    for (const resource of request.resources) {
+      if (resource.service === import_sdk_core6.ENCRYPTION_PERMISSION_SERVICE && resource.path.startsWith("urn:tinycloud:encryption:") && resource.actions.includes(DECRYPT_ACTION2)) {
+        networkIds.add(resource.path);
       }
     }
+    return [...networkIds];
   }
-  async ensureOwnedSpaceHosted(spaceId) {
+  async ensureRequestedEncryptionNetworks() {
+    if (!this.signer || !this.auth) {
+      return;
+    }
+    for (const networkId of this.requestedEncryptionNetworkIds()) {
+      const parsed = (0, import_sdk_core6.parseNetworkId)(networkId);
+      if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
+        continue;
+      }
+      await this.ensureEncryptionNetwork(networkId);
+    }
+  }
+  async ensureOwnedSpaceHostedById(spaceId) {
     if (!this.auth) {
       throw new Error("Owned space hosting requires wallet mode");
     }
@@ -18966,7 +19107,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!host) {
       throw new Error("Owned space hosting requires a TinyCloud host");
     }
-    const activation = await (0, import_sdk_core5.activateSessionWithHost)(host, session.delegationHeader);
+    const activation = await (0, import_sdk_core6.activateSessionWithHost)(host, session.delegationHeader);
     if (activation.success && !activation.skipped?.includes(spaceId)) {
       return;
     }
@@ -18980,7 +19121,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error(`Failed to create owned space: ${spaceId}`);
     }
     await new Promise((resolve) => setTimeout(resolve, 100));
-    const retry = await (0, import_sdk_core5.activateSessionWithHost)(host, session.delegationHeader);
+    const retry = await (0, import_sdk_core6.activateSessionWithHost)(host, session.delegationHeader);
     if (!retry.success || retry.skipped?.includes(spaceId)) {
       throw new Error(
         `Failed to activate session after creating owned space ${spaceId}: ${retry.error ?? "space was skipped"}`
@@ -18997,7 +19138,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * caller is the root authority of their own owned spaces, so no additional
    * delegation is required.
    *
-   * Unlike {@link ensureOwnedSpaceHosted}, this always submits the host
+   * Unlike {@link ensureOwnedSpaceHostedById}, this always submits the host
    * delegation rather than inferring hosting from session activation: a space
    * the current session has never referenced is reported neither as
    * `activated` nor `skipped`, so activation-based detection would wrongly
@@ -19022,7 +19163,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!hosted) {
       throw new Error(`Failed to host owned space: ${spaceId}`);
     }
-    const activation = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activation = await (0, import_sdk_core6.activateSessionWithHost)(
       host,
       this.auth.tinyCloudSession.delegationHeader
     );
@@ -19031,8 +19172,40 @@ var _TinyCloudNode = class _TinyCloudNode {
         `Failed to activate session for owned space ${spaceId}: ${activation.error ?? "space was skipped"}`
       );
     }
+    void this.account.spaces.register({
+      spaceId,
+      name,
+      ownerDid: this.did,
+      type: "owned",
+      permissions: ["*"],
+      status: "active"
+    }).catch(() => {
+    });
     return spaceId;
   }
+  /**
+   * Ensure one of this user's owned spaces (e.g. `"secrets"`) is hosted on the
+   * server.
+   *
+   * At sign-in, a full-authority session auto-hosts the owner's `secrets`
+   * space, but a session created with a manifest / capabilityRequest does not.
+   * Such a session can therefore hold valid `tinycloud.kv/*` capabilities for
+   * the owned `secrets` space yet still fail its first scoped
+   * `secrets.put(...)` with `404 Space not found`, because the space was never
+   * registered on the node.
+   *
+   * Calling this resolves `name` to the owner's owned-space URI
+   * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`) and hosts it via the
+   * host-SIWE delegation flow. The host SIWE is idempotent server-side, so it
+   * is safe to call whether or not the space already exists; do not gate it on
+   * a prior existence check. Must be called after {@link signIn}.
+   *
+   * @param name - The owned space name (e.g. `"secrets"`).
+   * @returns The hosted owned-space URI.
+   */
+  async ensureOwnedSpaceHosted(name) {
+    return this.hostOwnedSpace(name);
+  }
   /**
    * Restore a previously established session from stored delegation data.
    *
@@ -19055,30 +19228,38 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
-    const restoredAddress = sessionData.address ? (0, import_sdk_core5.canonicalizeAddress)(sessionData.address) : void 0;
+    const restoredAddress = sessionData.address ? (0, import_sdk_core6.canonicalizeAddress)(sessionData.address) : void 0;
     if (restoredAddress) {
       this._address = restoredAddress;
     }
     if (sessionData.chainId) {
       this._chainId = sessionData.chainId;
     }
-    this._serviceContext = new import_sdk_core5.ServiceContext({
+    const resolvedHost = await this.resolveRestoredHost(
+      sessionData.tinycloudHosts,
+      restoredAddress,
+      sessionData.chainId
+    );
+    if (resolvedHost) {
+      this.config.host = resolvedHost;
+    }
+    this._serviceContext = new import_sdk_core6.ServiceContext({
       invoke: this.invokeWithRuntimePermissions,
       invokeAny: this.invokeAnyWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [this.config.host],
       telemetry: this.config.telemetry
     });
-    this._kv = new import_sdk_core5.KVService({});
+    this._kv = new import_sdk_core6.KVService({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
-    this._sql = new import_sdk_core5.SQLService({});
+    this._sql = new import_sdk_core6.SQLService({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
-    this._duckdb = new import_sdk_core5.DuckDbService({});
+    this._duckdb = new import_sdk_core6.DuckDbService({});
     this._duckdb.initialize(this._serviceContext);
     this._serviceContext.registerService("duckdb", this._duckdb);
-    this._hooks = new import_sdk_core5.HooksService({});
+    this._hooks = new import_sdk_core6.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -19107,12 +19288,45 @@ var _TinyCloudNode = class _TinyCloudNode {
         signature: sessionData.signature ?? ""
       };
       if (this.auth) {
-        this.auth.setRestoredTinyCloudSession(tcSession);
+        this.auth.setRestoredTinyCloudSession(
+          tcSession,
+          this.config.host ? [this.config.host] : void 0
+        );
       } else {
         this._restoredTcSession = tcSession;
       }
     }
   }
+  /**
+   * Resolve the host a restored session should target.
+   *
+   * Mirrors fresh sign-in host resolution but for the restore path:
+   * an explicit/pinned host always wins, then the hosts the session was
+   * persisted with, then a lazy registry/fallback resolution for sessions
+   * that predate the persisted `tinycloudHosts` field. Returns `undefined`
+   * only when there's nothing to resolve from (no explicit host, no
+   * persisted hosts, and no address/chainId) — in which case the existing
+   * `config.host` (default) is left in place.
+   *
+   * Resolution failures are surfaced, not swallowed: a genuinely broken
+   * registry lookup throws rather than silently falling back to a wrong host.
+   */
+  async resolveRestoredHost(persistedHosts, address, chainId) {
+    if (this.explicitHost) {
+      return this.explicitHost;
+    }
+    if (persistedHosts && persistedHosts.length > 0) {
+      return persistedHosts[0];
+    }
+    if (address === void 0 || chainId === void 0) {
+      return void 0;
+    }
+    const resolved = await (0, import_sdk_core6.resolveTinyCloudHosts)((0, import_sdk_core6.pkhDid)(address, chainId), {
+      registryUrl: this.config.tinycloudRegistryUrl,
+      fallbackHosts: this.config.tinycloudFallbackHosts
+    });
+    return resolved.hosts[0];
+  }
   /**
    * Resolve the currently-active TinyCloudSession, preferring the auth
    * layer's value (wallet mode) and falling back to the node-level
@@ -19177,7 +19391,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       capabilityRequest: this.config.capabilityRequest,
       includeAccountRegistryPermissions: this.config.includeAccountRegistryPermissions
     });
-    this.tc = new import_sdk_core5.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core6.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: this.config.telemetry
     });
@@ -19222,7 +19436,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       capabilityRequest: this.config.capabilityRequest,
       includeAccountRegistryPermissions: this.config.includeAccountRegistryPermissions
     });
-    this.tc = new import_sdk_core5.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core6.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: this.config.telemetry
     });
@@ -19238,28 +19452,28 @@ var _TinyCloudNode = class _TinyCloudNode {
       return;
     }
     this.tc.initializeServices(this.invokeWithRuntimePermissions, [this.config.host]);
-    this._serviceContext = new import_sdk_core5.ServiceContext({
+    this._serviceContext = new import_sdk_core6.ServiceContext({
       invoke: this.invokeWithRuntimePermissions,
       invokeAny: this.invokeAnyWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [this.config.host],
       telemetry: this.config.telemetry
     });
-    this._kv = new import_sdk_core5.KVService({});
+    this._kv = new import_sdk_core6.KVService({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
     const features = this.nodeFeatures;
     if (features.length === 0 || features.includes("sql")) {
-      this._sql = new import_sdk_core5.SQLService({});
+      this._sql = new import_sdk_core6.SQLService({});
       this._sql.initialize(this._serviceContext);
       this._serviceContext.registerService("sql", this._sql);
     }
     if (features.length === 0 || features.includes("duckdb")) {
-      this._duckdb = new import_sdk_core5.DuckDbService({});
+      this._duckdb = new import_sdk_core6.DuckDbService({});
       this._duckdb.initialize(this._serviceContext);
       this._serviceContext.registerService("duckdb", this._duckdb);
     }
-    this._hooks = new import_sdk_core5.HooksService({});
+    this._hooks = new import_sdk_core6.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -19277,9 +19491,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.initializeV2Services(serviceSession);
   }
   createSpaceScopedKVService(spaceId) {
-    const kvService = new import_sdk_core5.KVService({});
+    const kvService = new import_sdk_core6.KVService({});
     if (this._serviceContext) {
-      const spaceScopedContext = new import_sdk_core5.ServiceContext({
+      const spaceScopedContext = new import_sdk_core6.ServiceContext({
         invoke: this._serviceContext.invoke,
         fetch: this._serviceContext.fetch,
         hosts: this._serviceContext.hosts,
@@ -19344,7 +19558,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         const shared = wasm.vault_x25519_dh(receiverPrivateKey, peerPublic);
         return columnDecrypt(shared, ciphertext);
       },
-      verifyNodeSignature: (nodeId, message, signature2) => (0, import_sdk_core5.verifyDidKeyEd25519Signature)(nodeId, message, signature2)
+      verifyNodeSignature: (nodeId, message, signature2) => (0, import_sdk_core6.verifyDidKeyEd25519Signature)(nodeId, message, signature2)
     };
   }
   async fetchNodeId() {
@@ -19415,19 +19629,19 @@ var _TinyCloudNode = class _TinyCloudNode {
         return await response.json();
       }
     };
-    return new import_sdk_core5.EncryptionService({
+    return new import_sdk_core6.EncryptionService({
       crypto: crypto2,
       signer: {
         signDecryptInvocation: async (input) => {
           const signed2 = await this.signRawNetworkAuthorization({
             targetNode: input.targetNode,
             networkId: input.networkId,
-            action: DECRYPT_ACTION,
+            action: DECRYPT_ACTION2,
             facts: input.facts
           });
           return {
             ...signed2,
-            canonicalBody: (0, import_sdk_core5.canonicalizeEncryptionJson)(
+            canonicalBody: (0, import_sdk_core6.canonicalizeEncryptionJson)(
               input.body
             )
           };
@@ -19439,14 +19653,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       wellKnown: {
         fetchWellKnown: async (principal, discoveryKey) => {
-          if (!this._address || !didPrincipalMatches(principal, this.did)) {
+          if (!this._address || !didPrincipalMatches2(principal, this.did)) {
             return null;
           }
           if (!this.config.host) {
             return null;
           }
-          const publicSpaceId = (0, import_sdk_core5.makePublicSpaceId)(this._address, this._chainId);
-          const result = await import_sdk_core5.TinyCloud.readPublicSpace(this.config.host, publicSpaceId, discoveryKey);
+          const publicSpaceId = (0, import_sdk_core6.makePublicSpaceId)(this._address, this._chainId);
+          const result = await import_sdk_core6.TinyCloud.readPublicSpace(this.config.host, publicSpaceId, discoveryKey);
           if (!result.ok) {
             return null;
           }
@@ -19469,7 +19683,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   createVaultService(spaceId, kv) {
     const wasm = this.wasmBindings;
-    const vaultCrypto = (0, import_sdk_core5.createVaultCrypto)({
+    const vaultCrypto = (0, import_sdk_core6.createVaultCrypto)({
       vault_encrypt: wasm.vault_encrypt,
       vault_decrypt: wasm.vault_decrypt,
       vault_derive_key: wasm.vault_derive_key,
@@ -19479,7 +19693,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       vault_sha256: wasm.vault_sha256
     });
     const self2 = this;
-    return new import_sdk_core5.DataVaultService({
+    return new import_sdk_core6.DataVaultService({
       spaceId,
       crypto: vaultCrypto,
       encryption: {
@@ -19502,8 +19716,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         get publicKV() {
           return self2._publicKV ?? self2.tc.publicKV;
         },
-        readPublicSpace: (host, targetSpaceId, key2) => import_sdk_core5.TinyCloud.readPublicSpace(host, targetSpaceId, key2),
-        makePublicSpaceId: import_sdk_core5.TinyCloud.makePublicSpaceId,
+        readPublicSpace: (host, targetSpaceId, key2) => import_sdk_core6.TinyCloud.readPublicSpace(host, targetSpaceId, key2),
+        makePublicSpaceId: import_sdk_core6.TinyCloud.makePublicSpaceId,
         did: this.did,
         address: this._address ?? "",
         chainId: this._chainId,
@@ -19516,7 +19730,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @internal
    */
   initializeV2Services(serviceSession) {
-    this._capabilityRegistry = new import_sdk_core5.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core6.CapabilityKeyRegistry();
     const tcSession = this.auth?.tinyCloudSession;
     if (tcSession && this._address) {
       const sessionKey = {
@@ -19590,13 +19804,13 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       this._capabilityRegistry.registerKey(sessionKey, delegations);
     }
-    this._delegationManager = new import_sdk_core5.DelegationManager({
+    this._delegationManager = new import_sdk_core6.DelegationManager({
       hosts: [this.config.host],
       session: serviceSession,
       invoke: this.invokeWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis)
     });
-    this._spaceService = new import_sdk_core5.SpaceService({
+    this._spaceService = new import_sdk_core6.SpaceService({
       hosts: [this.config.host],
       session: serviceSession,
       invoke: this.wasmBindings.invoke,
@@ -19648,6 +19862,9 @@ var _TinyCloudNode = class _TinyCloudNode {
             }
           };
         }
+      },
+      onSpaceRegistered: async (space) => {
+        await this.account.spaces.register(space);
       }
     });
     this._sharingService.updateConfig({
@@ -19753,7 +19970,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...prepared,
         signature: signature2
       });
-      const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+      const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
         host,
         delegationSession.delegationHeader
       );
@@ -19763,7 +19980,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       return {
         cid: delegationSession.delegationCid,
         delegateDID: params.shareKeyDID,
-        delegatorDID: (0, import_sdk_core5.pkhDid)(session.address, session.chainId),
+        delegatorDID: (0, import_sdk_core6.pkhDid)(session.address, session.chainId),
         spaceId: params.spaceId,
         path: params.path,
         actions: params.actions,
@@ -19820,7 +20037,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._sql) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("sql")) {
-        throw new import_sdk_core5.UnsupportedFeatureError("sql", this.config.host, features);
+        throw new import_sdk_core6.UnsupportedFeatureError("sql", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -19844,8 +20061,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._serviceContext || !this._serviceContext.session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    const sql = new import_sdk_core5.SQLService({});
-    const spaceScopedContext = new import_sdk_core5.ServiceContext({
+    const sql = new import_sdk_core6.SQLService({});
+    const spaceScopedContext = new import_sdk_core6.ServiceContext({
       invoke: this._serviceContext.invoke,
       fetch: this._serviceContext.fetch,
       hosts: this._serviceContext.hosts,
@@ -19873,8 +20090,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._serviceContext || !this._serviceContext.session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    const kv = new import_sdk_core5.KVService({});
-    const spaceScopedContext = new import_sdk_core5.ServiceContext({
+    const kv = new import_sdk_core6.KVService({});
+    const spaceScopedContext = new import_sdk_core6.ServiceContext({
       invoke: this._serviceContext.invoke,
       fetch: this._serviceContext.fetch,
       hosts: this._serviceContext.hosts
@@ -19890,7 +20107,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._duckdb) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("duckdb")) {
-        throw new import_sdk_core5.UnsupportedFeatureError("duckdb", this.config.host, features);
+        throw new import_sdk_core6.UnsupportedFeatureError("duckdb", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -19942,16 +20159,16 @@ var _TinyCloudNode = class _TinyCloudNode {
       type: NETWORK_ADMIN_TYPE,
       targetNode,
       networkId,
-      bodyHash: (0, import_sdk_core5.canonicalHashHex)(
+      bodyHash: (0, import_sdk_core6.canonicalHashHex)(
         crypto2.sha256,
         body
       ),
-      action: NETWORK_CREATE_ACTION
+      action: NETWORK_CREATE_ACTION2
     };
     const signed2 = await this.signRawNetworkAuthorization({
       targetNode,
       networkId,
-      action: NETWORK_CREATE_ACTION,
+      action: NETWORK_CREATE_ACTION2,
       facts
     });
     const response = await fetch(`${this.config.host}/encryption/networks`, {
@@ -19960,7 +20177,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         Authorization: signed2.authorization,
         "Content-Type": "application/json"
       },
-      body: (0, import_sdk_core5.canonicalizeEncryptionJson)(
+      body: (0, import_sdk_core6.canonicalizeEncryptionJson)(
         body
       )
     });
@@ -19972,12 +20189,19 @@ var _TinyCloudNode = class _TinyCloudNode {
     const created = await response.json();
     return created.descriptor;
   }
-  async ensureEncryptionNetwork(name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
-    const existing = await this.getEncryptionNetwork(name);
+  async ensureEncryptionNetwork(nameOrNetworkId = DEFAULT_ENCRYPTION_NETWORK_NAME) {
+    const networkId = nameOrNetworkId.startsWith("urn:tinycloud:encryption:") ? nameOrNetworkId : this.getDefaultEncryptionNetworkId(nameOrNetworkId);
+    const existing = await this.getEncryptionNetwork(networkId);
     if (existing) {
       return existing;
     }
-    return this.createEncryptionNetwork(name);
+    const parsed = (0, import_sdk_core6.parseNetworkId)(networkId);
+    if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
+      throw new Error(
+        `Cannot create encryption network ${networkId}: owner ${parsed.ownerDid} does not match signed-in DID ${this.did}`
+      );
+    }
+    return this.createEncryptionNetwork(parsed.name);
   }
   /**
    * App-facing secrets API backed by the `secrets` space vault.
@@ -20004,7 +20228,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Not signed in. Call signIn() first.");
     }
     if (!this._baseSecrets) {
-      this._baseSecrets = new import_sdk_core5.SecretsService(() => this.space("secrets").vault);
+      this._baseSecrets = new import_sdk_core6.SecretsService(() => this.space("secrets").vault);
     }
     return this._baseSecrets;
   }
@@ -20119,19 +20343,19 @@ var _TinyCloudNode = class _TinyCloudNode {
   async useRuntimeDelegation(delegation) {
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core5.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core6.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     if (delegation.expiry.getTime() <= Date.now()) {
-      throw new import_sdk_core5.SessionExpiredError(delegation.expiry);
+      throw new import_sdk_core6.SessionExpiredError(delegation.expiry);
     }
     const expectedDids = [session.verificationMethod, this.sessionDid];
-    if (!expectedDids.some((did) => didPrincipalMatches(delegation.delegateDID, did))) {
+    if (!expectedDids.some((did) => didPrincipalMatches2(delegation.delegateDID, did))) {
       throw new Error(
         `Runtime delegation targets ${delegation.delegateDID} but this session key is ${session.verificationMethod}.`
       );
     }
     const targetHost = delegation.host ?? this.config.host;
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       targetHost,
       delegation.delegationHeader
     );
@@ -20158,13 +20382,13 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core5.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core6.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     const sessionExpiry = extractSiweExpiration(session.siwe);
     if (sessionExpiry !== void 0) {
       const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
       if (sessionExpiry.getTime() <= Date.now() + marginMs) {
-        throw new import_sdk_core5.SessionExpiredError(sessionExpiry);
+        throw new import_sdk_core6.SessionExpiredError(sessionExpiry);
       }
     }
     const expanded = this.expandPermissionEntries(permissions);
@@ -20227,7 +20451,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...prepared,
         signature: signature2
       });
-      const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+      const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
         this.config.host,
         delegatedSession.delegationHeader
       );
@@ -20400,7 +20624,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     ];
     const abilities = { kv: { "": kvActions } };
     const now = /* @__PURE__ */ new Date();
-    const expiryMs = import_sdk_core5.EXPIRY.EPHEMERAL_MS;
+    const expiryMs = import_sdk_core6.EXPIRY.EPHEMERAL_MS;
     const expirationTime = new Date(now.getTime() + expiryMs);
     const prepared = this.wasmBindings.prepareSession({
       abilities,
@@ -20418,7 +20642,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       this.config.host,
       delegationSession.delegationHeader
     );
@@ -20445,8 +20669,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       }]);
     }
     if (this._serviceContext) {
-      const publicKV = new import_sdk_core5.KVService({ prefix: "" });
-      const publicContext = new import_sdk_core5.ServiceContext({
+      const publicKV = new import_sdk_core6.KVService({ prefix: "" });
+      const publicContext = new import_sdk_core6.ServiceContext({
         invoke: this.invokeWithRuntimePermissions,
         fetch: this._serviceContext.fetch,
         hosts: this._serviceContext.hosts,
@@ -20573,14 +20797,14 @@ var _TinyCloudNode = class _TinyCloudNode {
   async delegateTo(did, permissions, options) {
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core5.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core6.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     const sessionExpiry = extractSiweExpiration(session.siwe);
     if (sessionExpiry !== void 0) {
       const now2 = Date.now();
       const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
       if (sessionExpiry.getTime() <= now2 + marginMs) {
-        throw new import_sdk_core5.SessionExpiredError(sessionExpiry);
+        throw new import_sdk_core6.SessionExpiredError(sessionExpiry);
       }
     }
     if (!Array.isArray(permissions) || permissions.length === 0) {
@@ -20609,11 +20833,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return { delegation: delegation2, prompted: true };
     }
-    const granted = (0, import_sdk_core5.parseRecapCapabilities)(
+    const granted = (0, import_sdk_core6.parseRecapCapabilities)(
       (siwe) => this.wasmBindings.parseRecapFromSiwe(siwe),
       session.siwe
     );
-    const { subset, missing } = (0, import_sdk_core5.isCapabilitySubset)(expandedEntries, granted);
+    const { subset, missing } = (0, import_sdk_core6.isCapabilitySubset)(expandedEntries, granted);
     if (!subset) {
       const runtimeGrant = this.findGrantForOperations(
         this.permissionEntriesToOperations(expandedEntries, session)
@@ -20621,7 +20845,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (runtimeGrant) {
         const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
         if (runtimeGrant.expiresAt.getTime() <= Date.now() + marginMs) {
-          throw new import_sdk_core5.SessionExpiredError(runtimeGrant.expiresAt);
+          throw new import_sdk_core6.SessionExpiredError(runtimeGrant.expiresAt);
         }
         const runtimeExpiration = runtimeGrant.expiresAt < effectiveExpiration ? runtimeGrant.expiresAt : effectiveExpiration;
         const delegation2 = await this.createDelegationViaRuntimeGrant(
@@ -20632,7 +20856,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         return { delegation: delegation2, prompted: false };
       }
-      throw new import_sdk_core5.PermissionNotInManifestError(missing, granted);
+      throw new import_sdk_core6.PermissionNotInManifestError(missing, granted);
     }
     const delegation = await this.createDelegationViaWasmPath(
       did,
@@ -20654,7 +20878,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     const target = request.delegationTargets.find(
-      (entry) => didPrincipalMatches(entry.did, did)
+      (entry) => didPrincipalMatches2(entry.did, did)
     );
     if (!target) {
       throw new Error(`No manifest delegation target found for DID ${did}`);
@@ -20714,7 +20938,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const spaceId = resolvedSpaces.size === 1 ? [...resolvedSpaces][0] : session.spaceId;
     const abilities = {};
     for (const entry of entries) {
-      const shortService = import_sdk_core5.SERVICE_LONG_TO_SHORT[entry.service];
+      const shortService = import_sdk_core6.SERVICE_LONG_TO_SHORT[entry.service];
       if (shortService === void 0) {
         throw new Error(
           `delegateTo: unknown service '${entry.service}' \u2014 no short-form mapping`
@@ -20754,7 +20978,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     const primary = result.resources[0];
     const delegationHeader = { Authorization: result.delegation };
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       this.config.host,
       delegationHeader
     );
@@ -20789,7 +21013,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primary = result.resources[0];
     const delegationHeader = { Authorization: result.delegation };
     const targetHost = grant.delegation.host ?? this.config.host;
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       targetHost,
       delegationHeader
     );
@@ -20830,10 +21054,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this.wasmBindings.makeSpaceId(session.address, session.chainId, space);
   }
   expandPermissionEntries(permissions) {
-    return (0, import_sdk_core5.expandPermissionEntries)(permissions);
+    return (0, import_sdk_core6.expandPermissionEntries)(permissions);
   }
   shortServiceName(service) {
-    const short = import_sdk_core5.SERVICE_LONG_TO_SHORT[service];
+    const short = import_sdk_core6.SERVICE_LONG_TO_SHORT[service];
     if (short === void 0) {
       throw new Error(
         `unknown service '${service}' \u2014 no short-form mapping`
@@ -20859,7 +21083,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return abilities;
   }
   isEncryptionPermissionEntry(entry) {
-    return entry.service === import_sdk_core5.ENCRYPTION_PERMISSION_SERVICE && entry.path.startsWith("urn:tinycloud:encryption:");
+    return entry.service === import_sdk_core6.ENCRYPTION_PERMISSION_SERVICE && entry.path.startsWith("urn:tinycloud:encryption:");
   }
   permissionsToRawAbilities(entries) {
     const rawAbilities = {};
@@ -20892,11 +21116,11 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   sessionCoversPermissionEntries(session, entries) {
     try {
-      const granted = (0, import_sdk_core5.parseRecapCapabilities)(
+      const granted = (0, import_sdk_core6.parseRecapCapabilities)(
         (siwe) => this.wasmBindings.parseRecapFromSiwe(siwe),
         session.siwe
       );
-      return (0, import_sdk_core5.isCapabilitySubset)(entries, granted).subset;
+      return (0, import_sdk_core6.isCapabilitySubset)(entries, granted).subset;
     } catch {
       return false;
     }
@@ -21104,7 +21328,23 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (granted.resource !== void 0 || requested.resource !== void 0) {
       return granted.resource !== void 0 && requested.resource !== void 0 && granted.resource === requested.resource && this.pathContains(granted.path, requested.path);
     }
-    return granted.spaceId !== void 0 && requested.spaceId !== void 0 && granted.spaceId === requested.spaceId && this.pathContains(granted.path, requested.path);
+    return granted.spaceId !== void 0 && requested.spaceId !== void 0 && this.spaceIdsEqual(granted.spaceId, requested.spaceId) && this.pathContains(granted.path, requested.path);
+  }
+  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. The embedded
+  // EIP-155 address is case-insensitive, but the CLI canonicalizes it to
+  // lowercase when building a space URI while stored runtime delegations keep
+  // the EIP-55 checksummed form — so a byte-for-byte compare spuriously rejects
+  // an otherwise-valid grant. Lowercase ONLY the `eip155:<chain>:0x<addr>`
+  // segment and leave everything else (crucially the case-sensitive space NAME)
+  // byte-exact. Mirrors the CLI's `normalizeSpaceForCompare` (OPENKEY_SCOPE_MISMATCH fix).
+  spaceIdsEqual(a, b) {
+    return this.normalizeSpaceAddress(a) === this.normalizeSpaceAddress(b);
+  }
+  normalizeSpaceAddress(space) {
+    return space.replace(
+      /(eip155:\d+:)(0x[0-9a-fA-F]{40})/,
+      (_match, prefix, addr) => prefix + addr.toLowerCase()
+    );
   }
   actionContains(grantedAction, requestedAction) {
     if (grantedAction === requestedAction) {
@@ -21211,7 +21451,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (resolvedDelegateDID.endsWith(".eth") && this.config.ensResolver) {
       const address = await this.config.ensResolver.resolveAddress(resolvedDelegateDID);
       if (!address) throw new Error(`Could not resolve ENS name: ${resolvedDelegateDID}`);
-      resolvedDelegateDID = (0, import_sdk_core5.pkhDid)(address, 1);
+      resolvedDelegateDID = (0, import_sdk_core6.pkhDid)(address, 1);
     }
     const entries = legacyParamsToPermissionEntries(
       params.actions,
@@ -21226,7 +21466,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return result.delegation;
     } catch (err) {
-      if (err instanceof import_sdk_core5.PermissionNotInManifestError) {
+      if (err instanceof import_sdk_core6.PermissionNotInManifestError) {
       } else {
         throw err;
       }
@@ -21283,7 +21523,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       this.config.host,
       delegationSession.delegationHeader
     );
@@ -21305,7 +21545,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     const hasKvActions = params.actions.some((a) => a.startsWith("tinycloud.kv/"));
     if (hasKvActions && params.includePublicSpace !== false) {
-      const publicSpaceId = (0, import_sdk_core5.makePublicSpaceId)(
+      const publicSpaceId = (0, import_sdk_core6.makePublicSpaceId)(
         this.wasmBindings.ensureEip55(session.address),
         session.chainId
       );
@@ -21328,7 +21568,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...publicPrepared,
         signature: publicSignature
       });
-      const publicActivateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+      const publicActivateResult = await (0, import_sdk_core6.activateSessionWithHost)(
         this.config.host,
         publicSession.delegationHeader
       );
@@ -21368,7 +21608,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const targetHost = delegation.host ?? this.config.host;
     if (this.isSessionOnly) {
       const myDid = this.did;
-      if (!didPrincipalMatches(delegation.delegateDID, myDid)) {
+      if (!didPrincipalMatches2(delegation.delegateDID, myDid)) {
         throw new Error(
           `Delegation targets ${delegation.delegateDID} but this user's DID is ${myDid}. The delegation must target this user's DID.`
         );
@@ -21433,7 +21673,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       targetHost,
       invokerSession.delegationHeader
     );
@@ -21539,7 +21779,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       targetHost,
       subDelegationSession.delegationHeader
     );
@@ -21581,11 +21821,11 @@ TinyCloudNode.registerNodeDefaults({
 });
 
 // src/index.ts
-var import_sdk_core7 = require("@tinycloud/sdk-core");
 var import_sdk_core8 = require("@tinycloud/sdk-core");
+var import_sdk_core9 = require("@tinycloud/sdk-core");
 
 // src/storage/FileSessionStorage.ts
-var import_sdk_core6 = require("@tinycloud/sdk-core");
+var import_sdk_core7 = require("@tinycloud/sdk-core");
 var import_fs = require("fs");
 var import_path = require("path");
 var FileSessionStorage = class {
@@ -21640,7 +21880,7 @@ var FileSessionStorage = class {
     try {
       const data = (0, import_fs.readFileSync)(filePath, "utf-8");
       const parsed = JSON.parse(data);
-      const validation = (0, import_sdk_core6.validatePersistedSessionData)(parsed);
+      const validation = (0, import_sdk_core7.validatePersistedSessionData)(parsed);
       if (!validation.ok) {
         console.warn(`Invalid session data for ${address}:`, validation.error.message);
         (0, import_fs.unlinkSync)(filePath);
@@ -21705,9 +21945,35 @@ var FileSessionStorage = class {
 };
 
 // src/index.ts
-var import_sdk_core9 = require("@tinycloud/sdk-core");
+var import_sdk_core10 = require("@tinycloud/sdk-core");
 
 // src/delegation.ts
+async function grantAuthRequest(authority, request, options) {
+  if (request.kind !== "tinycloud.auth.request") {
+    throw new Error(
+      `grantAuthRequest expects a tinycloud.auth.request artifact, got "${request.kind}".`
+    );
+  }
+  if (!Array.isArray(request.requested) || request.requested.length === 0) {
+    throw new Error("grantAuthRequest request has no requested capabilities.");
+  }
+  const expiry = options?.expiry ?? request.requestedExpiry;
+  const result = await authority.delegateTo(
+    request.sessionDid,
+    request.requested,
+    expiry !== void 0 ? { expiry } : void 0
+  );
+  return {
+    kind: "tinycloud.auth.delegation",
+    version: 1,
+    requestId: request.requestId,
+    delegationCid: result.delegation.cid,
+    delegation: result.delegation,
+    permissions: request.requested,
+    expiry: result.delegation.expiry.toISOString(),
+    prompted: result.prompted
+  };
+}
 function serializeDelegation(delegation) {
   return JSON.stringify({
     ...delegation,
@@ -21724,7 +21990,6 @@ function deserializeDelegation(data) {
 }
 
 // src/index.ts
-var import_sdk_core10 = require("@tinycloud/sdk-core");
 var import_sdk_core11 = require("@tinycloud/sdk-core");
 var import_sdk_core12 = require("@tinycloud/sdk-core");
 var import_sdk_core13 = require("@tinycloud/sdk-core");
@@ -21735,10 +22000,12 @@ var import_sdk_core17 = require("@tinycloud/sdk-core");
 var import_sdk_core18 = require("@tinycloud/sdk-core");
 var import_sdk_core19 = require("@tinycloud/sdk-core");
 var import_sdk_core20 = require("@tinycloud/sdk-core");
+var import_sdk_core21 = require("@tinycloud/sdk-core");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE,
+  AccountService,
   AutoApproveSpaceCreationHandler,
   CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
@@ -21838,6 +22105,7 @@ var import_sdk_core20 = require("@tinycloud/sdk-core");
   expandPermissionEntries,
   expandPermissionEntry,
   generateRandomReceiverKey,
+  grantAuthRequest,
   hexDecode,
   hexEncode,
   isCapabilitySubset,