@tinycloud/node-sdk 2.4.0-beta.2 → 2.4.0-beta.5

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, IWasmBindings, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, discoverNetwork, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, hexDecode, hexEncode, isCapabilitySubset, isEvmAddress, isNetworkId, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as AuthDelegationArtifact, a as AuthRequestArtifact, D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, d as DelegationAuthority, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, P as PortableDelegation, R as RestorableSession, g as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, W as WasmKeyProvider, i as WasmKeyProviderConfig, j as createWasmKeyProvider, k as defaultSignStrategy, l as deserializeDelegation, m as grantAuthRequest, s as serializeDelegation } from './core-BucTrpWH.cjs';
+export { A as AuthDelegationArtifact, a as AuthRequestArtifact, D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, d as DelegationAuthority, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, P as PortableDelegation, R as RestorableSession, g as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, W as WasmKeyProvider, i as WasmKeyProviderConfig, j as createWasmKeyProvider, k as defaultSignStrategy, l as deserializeDelegation, m as grantAuthRequest, s as serializeDelegation } from './core-BSQqoLAd.cjs';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, IWasmBindings, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, discoverNetwork, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, hexDecode, hexEncode, isCapabilitySubset, isEvmAddress, isNetworkId, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as AuthDelegationArtifact, a as AuthRequestArtifact, D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, d as DelegationAuthority, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, P as PortableDelegation, R as RestorableSession, g as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, W as WasmKeyProvider, i as WasmKeyProviderConfig, j as createWasmKeyProvider, k as defaultSignStrategy, l as deserializeDelegation, m as grantAuthRequest, s as serializeDelegation } from './core-BucTrpWH.js';
+export { A as AuthDelegationArtifact, a as AuthRequestArtifact, D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, d as DelegationAuthority, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, P as PortableDelegation, R as RestorableSession, g as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, W as WasmKeyProvider, i as WasmKeyProviderConfig, j as createWasmKeyProvider, k as defaultSignStrategy, l as deserializeDelegation, m as grantAuthRequest, s as serializeDelegation } from './core-BSQqoLAd.js';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/index.js

@@ -17186,7 +17186,8 @@ import {
   verifyDidKeyEd25519Signature,
   canonicalizeAddress as canonicalizeAddress2,
   pkhDid as pkhDid2,
-  principalDidEquals
+  principalDidEquals as principalDidEquals2,
+  parseNetworkId as parseNetworkId2
 } from "@tinycloud/sdk-core";
 
 // src/authorization/NodeUserAuthorization.ts
@@ -17199,6 +17200,8 @@ import {
   DEFAULT_MANIFEST_SPACE,
   ENCRYPTION_PERMISSION_SERVICE,
   composeManifestRequest,
+  parseNetworkId,
+  principalDidEquals,
   resourceCapabilitiesToAbilitiesMap,
   resourceCapabilitiesToSpaceAbilitiesMap,
   resolveTinyCloudHosts,
@@ -17283,6 +17286,25 @@ var MemorySessionStorage = class {
 };
 
 // src/authorization/NodeUserAuthorization.ts
+var DECRYPT_ACTION = "tinycloud.encryption/decrypt";
+var NETWORK_CREATE_ACTION = "tinycloud.encryption/network.create";
+function didPrincipalMatches(actual, expected) {
+  try {
+    return principalDidEquals(actual, expected);
+  } catch {
+    return actual === expected;
+  }
+}
+function addRawAbility(rawAbilities, resource, action) {
+  const actions = rawAbilities[resource];
+  if (actions === void 0) {
+    rawAbilities[resource] = [action];
+    return;
+  }
+  if (!actions.includes(action)) {
+    actions.push(action);
+  }
+}
 var NodeUserAuthorization = class {
   constructor(config) {
     this.extensions = [];
@@ -17512,20 +17534,18 @@ var NodeUserAuthorization = class {
       };
     }
     const rawAbilities = {};
+    const currentDid = pkhDid(address, chainId);
     const spaceResources = request.resources.filter((entry) => {
       if (entry.service !== ENCRYPTION_PERMISSION_SERVICE) {
         return true;
       }
-      const existing = rawAbilities[entry.path];
-      if (existing === void 0) {
-        rawAbilities[entry.path] = [...entry.actions];
-      } else {
-        const seen = new Set(existing);
-        for (const action of entry.actions) {
-          if (!seen.has(action)) {
-            existing.push(action);
-            seen.add(action);
-          }
+      for (const action of entry.actions) {
+        addRawAbility(rawAbilities, entry.path, action);
+      }
+      if (entry.actions.includes(DECRYPT_ACTION)) {
+        const parsed = parseNetworkId(entry.path);
+        if (didPrincipalMatches(parsed.ownerDid, currentDid)) {
+          addRawAbility(rawAbilities, entry.path, NETWORK_CREATE_ACTION);
         }
       }
       return false;
@@ -18501,13 +18521,13 @@ var NodeSecretsService = class {
 // src/TinyCloudNode.ts
 var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
-var NETWORK_CREATE_ACTION = "tinycloud.encryption/network.create";
-var DECRYPT_ACTION = "tinycloud.encryption/decrypt";
+var NETWORK_CREATE_ACTION2 = "tinycloud.encryption/network.create";
+var DECRYPT_ACTION2 = "tinycloud.encryption/decrypt";
 var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
 var DEFAULT_SESSION_EXPIRATION_MS = EXPIRY3.SESSION_MS;
-function didPrincipalMatches(actual, expected) {
+function didPrincipalMatches2(actual, expected) {
   try {
-    return principalDidEquals(actual, expected);
+    return principalDidEquals2(actual, expected);
   } catch {
     return actual === expected;
   }
@@ -18881,6 +18901,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
     this.initializeServices();
+    await this.ensureRequestedEncryptionNetworks();
     if (this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
       await this.ensureOwnedSpaceHosted(this.ownedSpaceId("secrets"));
     }
@@ -18917,6 +18938,31 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     }
   }
+  requestedEncryptionNetworkIds() {
+    const request = this.capabilityRequest;
+    if (!request) {
+      return [];
+    }
+    const networkIds = /* @__PURE__ */ new Set();
+    for (const resource of request.resources) {
+      if (resource.service === ENCRYPTION_PERMISSION_SERVICE2 && resource.path.startsWith("urn:tinycloud:encryption:") && resource.actions.includes(DECRYPT_ACTION2)) {
+        networkIds.add(resource.path);
+      }
+    }
+    return [...networkIds];
+  }
+  async ensureRequestedEncryptionNetworks() {
+    if (!this.signer || !this.auth) {
+      return;
+    }
+    for (const networkId of this.requestedEncryptionNetworkIds()) {
+      const parsed = parseNetworkId2(networkId);
+      if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
+        continue;
+      }
+      await this.ensureEncryptionNetwork(networkId);
+    }
+  }
   async ensureOwnedSpaceHosted(spaceId) {
     if (!this.auth) {
       throw new Error("Owned space hosting requires wallet mode");
@@ -19385,7 +19431,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           const signed2 = await this.signRawNetworkAuthorization({
             targetNode: input.targetNode,
             networkId: input.networkId,
-            action: DECRYPT_ACTION,
+            action: DECRYPT_ACTION2,
             facts: input.facts
           });
           return {
@@ -19402,7 +19448,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       wellKnown: {
         fetchWellKnown: async (principal, discoveryKey) => {
-          if (!this._address || !didPrincipalMatches(principal, this.did)) {
+          if (!this._address || !didPrincipalMatches2(principal, this.did)) {
             return null;
           }
           if (!this.config.host) {
@@ -19909,12 +19955,12 @@ var _TinyCloudNode = class _TinyCloudNode {
         crypto2.sha256,
         body
       ),
-      action: NETWORK_CREATE_ACTION
+      action: NETWORK_CREATE_ACTION2
     };
     const signed2 = await this.signRawNetworkAuthorization({
       targetNode,
       networkId,
-      action: NETWORK_CREATE_ACTION,
+      action: NETWORK_CREATE_ACTION2,
       facts
     });
     const response = await fetch(`${this.config.host}/encryption/networks`, {
@@ -19935,12 +19981,19 @@ var _TinyCloudNode = class _TinyCloudNode {
     const created = await response.json();
     return created.descriptor;
   }
-  async ensureEncryptionNetwork(name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
-    const existing = await this.getEncryptionNetwork(name);
+  async ensureEncryptionNetwork(nameOrNetworkId = DEFAULT_ENCRYPTION_NETWORK_NAME) {
+    const networkId = nameOrNetworkId.startsWith("urn:tinycloud:encryption:") ? nameOrNetworkId : this.getDefaultEncryptionNetworkId(nameOrNetworkId);
+    const existing = await this.getEncryptionNetwork(networkId);
     if (existing) {
       return existing;
     }
-    return this.createEncryptionNetwork(name);
+    const parsed = parseNetworkId2(networkId);
+    if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
+      throw new Error(
+        `Cannot create encryption network ${networkId}: owner ${parsed.ownerDid} does not match signed-in DID ${this.did}`
+      );
+    }
+    return this.createEncryptionNetwork(parsed.name);
   }
   /**
    * App-facing secrets API backed by the `secrets` space vault.
@@ -20088,7 +20141,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new SessionExpiredError(delegation.expiry);
     }
     const expectedDids = [session.verificationMethod, this.sessionDid];
-    if (!expectedDids.some((did) => didPrincipalMatches(delegation.delegateDID, did))) {
+    if (!expectedDids.some((did) => didPrincipalMatches2(delegation.delegateDID, did))) {
       throw new Error(
         `Runtime delegation targets ${delegation.delegateDID} but this session key is ${session.verificationMethod}.`
       );
@@ -20617,7 +20670,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     const target = request.delegationTargets.find(
-      (entry) => didPrincipalMatches(entry.did, did)
+      (entry) => didPrincipalMatches2(entry.did, did)
     );
     if (!target) {
       throw new Error(`No manifest delegation target found for DID ${did}`);
@@ -21067,7 +21120,23 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (granted.resource !== void 0 || requested.resource !== void 0) {
       return granted.resource !== void 0 && requested.resource !== void 0 && granted.resource === requested.resource && this.pathContains(granted.path, requested.path);
     }
-    return granted.spaceId !== void 0 && requested.spaceId !== void 0 && granted.spaceId === requested.spaceId && this.pathContains(granted.path, requested.path);
+    return granted.spaceId !== void 0 && requested.spaceId !== void 0 && this.spaceIdsEqual(granted.spaceId, requested.spaceId) && this.pathContains(granted.path, requested.path);
+  }
+  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. The embedded
+  // EIP-155 address is case-insensitive, but the CLI canonicalizes it to
+  // lowercase when building a space URI while stored runtime delegations keep
+  // the EIP-55 checksummed form — so a byte-for-byte compare spuriously rejects
+  // an otherwise-valid grant. Lowercase ONLY the `eip155:<chain>:0x<addr>`
+  // segment and leave everything else (crucially the case-sensitive space NAME)
+  // byte-exact. Mirrors the CLI's `normalizeSpaceForCompare` (OPENKEY_SCOPE_MISMATCH fix).
+  spaceIdsEqual(a, b) {
+    return this.normalizeSpaceAddress(a) === this.normalizeSpaceAddress(b);
+  }
+  normalizeSpaceAddress(space) {
+    return space.replace(
+      /(eip155:\d+:)(0x[0-9a-fA-F]{40})/,
+      (_match, prefix, addr) => prefix + addr.toLowerCase()
+    );
   }
   actionContains(grantedAction, requestedAction) {
     if (grantedAction === requestedAction) {
@@ -21331,7 +21400,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const targetHost = delegation.host ?? this.config.host;
     if (this.isSessionOnly) {
       const myDid = this.did;
-      if (!didPrincipalMatches(delegation.delegateDID, myDid)) {
+      if (!didPrincipalMatches2(delegation.delegateDID, myDid)) {
         throw new Error(
           `Delegation targets ${delegation.delegateDID} but this user's DID is ${myDid}. The delegation must target this user's DID.`
         );
@@ -21562,7 +21631,7 @@ import {
   parsePkhDid,
   pkhDid as pkhDid3,
   principalDid,
-  principalDidEquals as principalDidEquals2,
+  principalDidEquals as principalDidEquals3,
   parseCanonicalNetworkId
 } from "@tinycloud/sdk-core";
 
@@ -21775,7 +21844,7 @@ import {
 } from "@tinycloud/sdk-core";
 import {
   EncryptionService as EncryptionService2,
-  parseNetworkId,
+  parseNetworkId as parseNetworkId3,
   buildNetworkId,
   isNetworkId,
   networkDiscoveryKey,
@@ -21810,7 +21879,7 @@ import {
   DEFAULT_KEY_VERSION,
   DECRYPT_FACT_TYPE,
   DECRYPT_RESULT_TYPE,
-  DECRYPT_ACTION as DECRYPT_ACTION2,
+  DECRYPT_ACTION as DECRYPT_ACTION3,
   ENCRYPTION_SERVICE,
   ENCRYPTION_SERVICE_SHORT,
   encryptionError
@@ -21849,7 +21918,7 @@ export {
   AutoApproveSpaceCreationHandler2 as AutoApproveSpaceCreationHandler,
   CapabilityKeyRegistry2 as CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
-  DECRYPT_ACTION2 as DECRYPT_ACTION,
+  DECRYPT_ACTION3 as DECRYPT_ACTION,
   DECRYPT_FACT_TYPE,
   DECRYPT_RESULT_TYPE,
   DEFAULT_ENCRYPTION_ALG,
@@ -21958,12 +22027,12 @@ export {
   openWrappedKey,
   parseCanonicalNetworkId,
   parseExpiry2 as parseExpiry,
-  parseNetworkId,
+  parseNetworkId3 as parseNetworkId,
   parsePkhDid,
   parseSpaceUri,
   pkhDid3 as pkhDid,
   principalDid,
-  principalDidEquals2 as principalDidEquals,
+  principalDidEquals3 as principalDidEquals,
   resolveManifest2 as resolveManifest,
   resolveSecretListPrefix2 as resolveSecretListPrefix,
   resolveSecretPath2 as resolveSecretPath,