@tinycloud/node-sdk 2.5.1 → 2.6.0-beta.1

package/dist/core.d.cts

@@ -1,4 +1,4 @@
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
-export { D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, P as PortableDelegation, g as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, W as WasmKeyProvider, i as WasmKeyProviderConfig, j as createWasmKeyProvider, k as defaultSignStrategy, l as deserializeDelegation, s as serializeDelegation } from './core-ojeY-wet.cjs';
+export { D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, P as PortableDelegation, g as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, W as WasmKeyProvider, i as WasmKeyProviderConfig, j as createWasmKeyProvider, k as defaultSignStrategy, l as deserializeDelegation, s as serializeDelegation } from './core-Cr-zD1lk.cjs';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.d.ts

@@ -1,4 +1,4 @@
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
-export { D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, P as PortableDelegation, g as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, W as WasmKeyProvider, i as WasmKeyProviderConfig, j as createWasmKeyProvider, k as defaultSignStrategy, l as deserializeDelegation, s as serializeDelegation } from './core-ojeY-wet.js';
+export { D as DelegateToOptions, b as DelegateToResult, c as DelegatedAccess, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, e as NodeUserAuthorization, f as NodeUserAuthorizationConfig, P as PortableDelegation, g as RuntimePermissionGrantOptions, S as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, W as WasmKeyProvider, i as WasmKeyProviderConfig, j as createWasmKeyProvider, k as defaultSignStrategy, l as deserializeDelegation, s as serializeDelegation } from './core-Cr-zD1lk.js';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.js

@@ -237,7 +237,13 @@ import {
   EXPIRY,
   canonicalizeAddress,
   makePkhSpaceId,
-  pkhDid
+  pkhDid,
+  KV,
+  SQL,
+  DUCKDB,
+  CAPABILITIES,
+  HOOKS,
+  ENCRYPTION
 } from "@tinycloud/sdk-core";
 
 // src/authorization/strategies.ts
@@ -245,8 +251,8 @@ import { createOpenKeyCallbackSigningStrategy } from "@tinycloud/sdk-core";
 var defaultSignStrategy = { type: "auto-sign" };
 
 // src/authorization/NodeUserAuthorization.ts
-var DECRYPT_ACTION = "tinycloud.encryption/decrypt";
-var NETWORK_CREATE_ACTION = "tinycloud.encryption/network.create";
+var DECRYPT_ACTION = ENCRYPTION.DECRYPT;
+var NETWORK_CREATE_ACTION = ENCRYPTION.NETWORK_CREATE;
 function didPrincipalMatches(actual, expected) {
   try {
     return principalDidEquals(actual, expected);
@@ -279,44 +285,27 @@ var NodeUserAuthorization = class {
     this.spacePrefix = config.spacePrefix ?? "default";
     this.defaultActions = config.defaultActions ?? {
       kv: {
-        "": [
-          "tinycloud.kv/put",
-          "tinycloud.kv/get",
-          "tinycloud.kv/del",
-          "tinycloud.kv/list",
-          "tinycloud.kv/metadata"
-        ]
+        "": [KV.PUT, KV.GET, KV.DEL, KV.LIST, KV.METADATA]
       },
       sql: {
-        "": [
-          "tinycloud.sql/read",
-          "tinycloud.sql/write",
-          "tinycloud.sql/schema",
-          "tinycloud.sql/admin",
-          "tinycloud.sql/export"
-        ]
+        "": [SQL.READ, SQL.WRITE, SQL.SCHEMA, SQL.ADMIN, SQL.EXPORT]
       },
       duckdb: {
         "": [
-          "tinycloud.duckdb/read",
-          "tinycloud.duckdb/write",
-          "tinycloud.duckdb/admin",
-          "tinycloud.duckdb/describe",
-          "tinycloud.duckdb/export",
-          "tinycloud.duckdb/import",
-          "tinycloud.duckdb/execute"
+          DUCKDB.READ,
+          DUCKDB.WRITE,
+          DUCKDB.ADMIN,
+          DUCKDB.DESCRIBE,
+          DUCKDB.EXPORT,
+          DUCKDB.IMPORT,
+          DUCKDB.EXECUTE
         ]
       },
       capabilities: {
-        "": ["tinycloud.capabilities/read"]
+        "": [CAPABILITIES.READ]
       },
       hooks: {
-        "": [
-          "tinycloud.hooks/subscribe",
-          "tinycloud.hooks/register",
-          "tinycloud.hooks/list",
-          "tinycloud.hooks/unregister"
-        ]
+        "": [HOOKS.SUBSCRIBE, HOOKS.REGISTER, HOOKS.LIST, HOOKS.UNREGISTER]
       }
     };
     this.sessionExpirationMs = config.sessionExpirationMs ?? EXPIRY.SESSION_MS;
@@ -516,20 +505,17 @@ var NodeUserAuthorization = class {
           [secretsSpaceId]: {
             kv: {
               "vault/secrets/": [
-                "tinycloud.kv/get",
-                "tinycloud.kv/put",
-                "tinycloud.kv/del",
-                "tinycloud.kv/list",
-                "tinycloud.kv/metadata"
+                KV.GET,
+                KV.PUT,
+                KV.DEL,
+                KV.LIST,
+                KV.METADATA
               ]
             }
           }
         },
         rawAbilities: {
-          [defaultNetworkId]: [
-            "tinycloud.encryption/decrypt",
-            "tinycloud.encryption/network.create"
-          ]
+          [defaultNetworkId]: [DECRYPT_ACTION, NETWORK_CREATE_ACTION]
         }
       };
     }
@@ -1205,6 +1191,10 @@ import {
   isCapabilitySubset,
   parseRecapCapabilities,
   SERVICE_LONG_TO_SHORT,
+  KV as KV2,
+  SQL as SQL2,
+  DUCKDB as DUCKDB2,
+  ENCRYPTION as ENCRYPTION2,
   EXPIRY as EXPIRY3,
   canonicalHashHex,
   canonicalizeEncryptionJson,
@@ -1650,9 +1640,27 @@ var NodeSecretsService = class {
 // src/TinyCloudNode.ts
 var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
-var NETWORK_CREATE_ACTION2 = "tinycloud.encryption/network.create";
-var DECRYPT_ACTION2 = "tinycloud.encryption/decrypt";
+var NETWORK_CREATE_ACTION2 = ENCRYPTION2.NETWORK_CREATE;
+var DECRYPT_ACTION2 = ENCRYPTION2.DECRYPT;
 var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
+var ROOT_DELEGATION_ACTIONS = [
+  KV2.PUT,
+  KV2.GET,
+  KV2.DEL,
+  KV2.LIST,
+  KV2.METADATA,
+  SQL2.READ,
+  SQL2.WRITE,
+  SQL2.ADMIN,
+  SQL2.ALL,
+  DUCKDB2.READ,
+  DUCKDB2.WRITE,
+  DUCKDB2.ADMIN,
+  DUCKDB2.DESCRIBE,
+  DUCKDB2.EXPORT,
+  DUCKDB2.IMPORT,
+  DUCKDB2.ALL
+];
 var DEFAULT_SESSION_EXPIRATION_MS = EXPIRY3.SESSION_MS;
 function isOpenKeyAutoSignStrategy(strategy) {
   return strategy?.openKeyAutoSign === true;
@@ -2124,6 +2132,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
     this.initializeServices();
+    const primarySession = this.currentTinyCloudSession();
+    if (primarySession) {
+      this.registerPrimarySessionGrant(primarySession);
+    }
     const bootstrapped = await this.bootstrapAccountIfNeeded();
     await this.ensureRequestedEncryptionNetworks();
     if (!bootstrapped && this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
@@ -2367,7 +2379,107 @@ var _TinyCloudNode = class _TinyCloudNode {
         host: this.config.host
       },
       operations,
-      expiresAt
+      expiresAt,
+      provenance: "bootstrap"
+    });
+  }
+  /**
+   * Map the base session's OWN recap into runtime permission operations.
+   *
+   * Uses the RAW `parseRecapFromSiwe` binding — NOT `parseRecapCapabilities`,
+   * whose `normalizeSpace` collapses `tinycloud:pkh:...:<owner>:<space>` to a
+   * bare short name and would conflate two owners' identically-named spaces.
+   * We must keep the full owner-scoped URI so a synthetic primary grant can
+   * never cover an operation on a different owner's space.
+   *
+   * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
+   * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
+   * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+   * One op per action.
+   *
+   * Returns `[]` for session-only / restored-without-siwe modes and for any
+   * unparseable SIWE — the primary grant is simply not registered in that case.
+   */
+  recapOperationsFromSession(session) {
+    const siwe = session.siwe;
+    if (!siwe) {
+      return [];
+    }
+    if (this._recapOperationsCache?.siwe === siwe) {
+      return this._recapOperationsCache.operations;
+    }
+    let operations = [];
+    try {
+      const entries = this.wasmBindings.parseRecapFromSiwe(siwe);
+      if (Array.isArray(entries)) {
+        operations = entries.flatMap((entry) => {
+          const service = this.invocationServiceName(entry.service);
+          return entry.actions.map((action) => ({
+            ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId: entry.space },
+            service,
+            path: entry.path,
+            action
+          }));
+        });
+      }
+    } catch {
+      operations = [];
+    }
+    this._recapOperationsCache = { siwe, operations };
+    return operations;
+  }
+  /**
+   * Register the base (primary) session's own recap as a synthetic runtime
+   * grant tagged `provenance: "primary"` so it always out-ranks other covering
+   * grants in {@link findGrantForOperations}. This closes the selection-design
+   * hazard where a broad — possibly broken — bootstrap/delegated grant could
+   * hijack an operation the primary session itself already authorized (TC-111).
+   *
+   * Two safety exclusions:
+   *  - Ops whose space is in `lastActivationSkippedSpaceIds` are dropped: the
+   *    node refused to activate those spaces this sign-in even though the recap
+   *    claims them. Including them would let the synthetic primary out-rank a
+   *    working grant and 401 (the "skipped-activation inverted hijack").
+   *  - Encryption `resource` ops are kept as-is (space-independent).
+   *
+   * No-ops when nothing remains after exclusion. Callers (`signIn`,
+   * `restoreSession`) clear `runtimePermissionGrants` first, so no dupes.
+   */
+  registerPrimarySessionGrant(session) {
+    const skipped = this.auth ? this.auth.lastActivationSkippedSpaceIds ?? [] : [];
+    const operations = this.recapOperationsFromSession(session).filter(
+      (operation) => operation.spaceId === void 0 || !skipped.some((spaceId) => this.spaceIdsEqual(spaceId, operation.spaceId))
+    );
+    if (operations.length === 0) {
+      return;
+    }
+    const expiresAt = extractSiweExpiration(session.siwe) ?? this.getSessionExpiry();
+    const actions = [...new Set(operations.map((operation) => operation.action))];
+    this.runtimePermissionGrants.push({
+      session: {
+        delegationHeader: session.delegationHeader,
+        delegationCid: session.delegationCid,
+        spaceId: session.spaceId,
+        verificationMethod: session.verificationMethod,
+        jwk: session.jwk
+      },
+      delegation: {
+        cid: session.delegationCid,
+        delegationHeader: session.delegationHeader,
+        delegateDID: session.verificationMethod,
+        delegatorDID: this.did,
+        spaceId: session.spaceId,
+        path: "",
+        actions,
+        expiry: expiresAt,
+        allowSubDelegation: true,
+        ownerAddress: session.address,
+        chainId: session.chainId,
+        host: this.config.host
+      },
+      operations,
+      expiresAt,
+      provenance: "primary"
     });
   }
   async writeManifestRegistryRecords() {
@@ -2703,6 +2815,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       } else {
         this._restoredTcSession = tcSession;
       }
+      this.registerPrimarySessionGrant(tcSession);
     }
   }
   /**
@@ -3174,24 +3287,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         spaceId: tcSession.spaceId,
         path: "",
         // Root access
-        actions: [
-          "tinycloud.kv/put",
-          "tinycloud.kv/get",
-          "tinycloud.kv/del",
-          "tinycloud.kv/list",
-          "tinycloud.kv/metadata",
-          "tinycloud.sql/read",
-          "tinycloud.sql/write",
-          "tinycloud.sql/admin",
-          "tinycloud.sql/*",
-          "tinycloud.duckdb/read",
-          "tinycloud.duckdb/write",
-          "tinycloud.duckdb/admin",
-          "tinycloud.duckdb/describe",
-          "tinycloud.duckdb/export",
-          "tinycloud.duckdb/import",
-          "tinycloud.duckdb/*"
-        ],
+        actions: [...ROOT_DELEGATION_ACTIONS],
         expiry: this.getSessionExpiry(),
         isRevoked: false,
         allowSubDelegation: true
@@ -3204,24 +3300,7 @@ var _TinyCloudNode = class _TinyCloudNode {
             delegateDID: tcSession.verificationMethod,
             spaceId,
             path: "",
-            actions: [
-              "tinycloud.kv/put",
-              "tinycloud.kv/get",
-              "tinycloud.kv/del",
-              "tinycloud.kv/list",
-              "tinycloud.kv/metadata",
-              "tinycloud.sql/read",
-              "tinycloud.sql/write",
-              "tinycloud.sql/admin",
-              "tinycloud.sql/*",
-              "tinycloud.duckdb/read",
-              "tinycloud.duckdb/write",
-              "tinycloud.duckdb/admin",
-              "tinycloud.duckdb/describe",
-              "tinycloud.duckdb/export",
-              "tinycloud.duckdb/import",
-              "tinycloud.duckdb/*"
-            ],
+            actions: [...ROOT_DELEGATION_ACTIONS],
             expiry: this.getSessionExpiry(),
             isRevoked: false,
             allowSubDelegation: true
@@ -3775,7 +3854,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   getRuntimePermissionDelegations(permissions) {
     this.pruneExpiredRuntimePermissionGrants();
     if (permissions === void 0) {
-      return this.runtimePermissionGrants.map((grant) => grant.delegation);
+      return this.runtimePermissionGrants.filter((grant) => grant.provenance !== "primary").map((grant) => grant.delegation);
     }
     const session = this.currentTinyCloudSession();
     if (!session || !Array.isArray(permissions) || permissions.length === 0) {
@@ -3927,7 +4006,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         },
         delegation,
         operations: this.permissionOperations(delegatedEntries, spaceId),
-        expiresAt
+        expiresAt,
+        provenance: "runtime"
       });
       delegations.push(delegation);
     }
@@ -4065,13 +4145,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Public space not enabled. Set enablePublicSpace: true in config.");
     }
     await this.auth.hostPublicSpace(publicSpaceId);
-    const kvActions = [
-      "tinycloud.kv/put",
-      "tinycloud.kv/get",
-      "tinycloud.kv/del",
-      "tinycloud.kv/list",
-      "tinycloud.kv/metadata"
-    ];
+    const kvActions = [KV2.PUT, KV2.GET, KV2.DEL, KV2.LIST, KV2.METADATA];
     const abilities = { kv: { "": kvActions } };
     const now = /* @__PURE__ */ new Date();
     const expiryMs = EXPIRY3.EPHEMERAL_MS;
@@ -4594,7 +4668,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       return grants;
     }
     for (const operation of operations) {
-      const grant = this.findGrantForOperation(operation);
+      const grant = this.findGrantForOperation(operation, { excludePrimary: true });
       if (!grant) {
         return [];
       }
@@ -4634,7 +4708,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       delegation,
       operations,
-      expiresAt: delegation.expiry
+      expiresAt: delegation.expiry,
+      provenance: "delegated"
     };
   }
   installRuntimeGrantFromServiceSession(delegation, session, expiresAt) {
@@ -4649,7 +4724,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       session,
       delegation,
       operations,
-      expiresAt
+      expiresAt,
+      provenance: "delegated"
     });
   }
   delegatedResourcesForEntries(entries, spaceId) {
@@ -4749,21 +4825,28 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     return grant?.session ?? fallback;
   }
-  findGrantForOperations(operations) {
+  findGrantForOperations(operations, options) {
     if (operations.length === 0) {
       return void 0;
     }
     this.pruneExpiredRuntimePermissionGrants();
-    return this.runtimePermissionGrants.find((grant) => {
+    const covering = this.runtimePermissionGrants.filter((grant) => {
+      if (options?.excludePrimary && grant.provenance === "primary") {
+        return false;
+      }
       return operations.every(
         (operation) => grant.operations.some(
           (granted) => this.operationCovers(granted, operation)
         )
       );
     });
+    if (covering.length === 0) {
+      return void 0;
+    }
+    return covering.find((grant) => grant.provenance === "primary") ?? covering[0];
   }
-  findGrantForOperation(operation) {
-    return this.findGrantForOperations([operation]);
+  findGrantForOperation(operation, options) {
+    return this.findGrantForOperations([operation], options);
   }
   pruneExpiredRuntimePermissionGrants() {
     const now = Date.now();
@@ -5000,7 +5083,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         session.chainId
       );
       const publicAbilities = {
-        kv: { "": ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/metadata"] }
+        kv: { "": [KV2.GET, KV2.PUT, KV2.METADATA] }
       };
       const publicPrepared = this.wasmBindings.prepareSession({
         abilities: publicAbilities,
@@ -5028,7 +5111,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           delegationHeader: publicSession.delegationHeader,
           spaceId: publicSpaceId,
           path: "",
-          actions: ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/metadata"],
+          actions: [KV2.GET, KV2.PUT, KV2.METADATA],
           disableSubDelegation: params.disableSubDelegation ?? false,
           expiry: expirationTime,
           delegateDID: params.delegateDID,