@tinycloud/node-sdk 3.0.0-beta.2 → 3.0.0-beta.20

package/dist/core.cjs

@@ -50,6 +50,7 @@ __export(core_exports, {
   DuckDbService: () => import_sdk_core15.DuckDbService,
   FileSessionStorage: () => FileSessionStorage,
   IdentityParseError: () => import_sdk_core11.IdentityParseError,
+  InvalidRestoredSessionError: () => InvalidRestoredSessionError,
   KVService: () => import_sdk_core13.KVService,
   ManifestValidationError: () => import_sdk_core12.ManifestValidationError,
   MemorySessionStorage: () => MemorySessionStorage,
@@ -115,6 +116,7 @@ __export(core_exports, {
   parseCanonicalNetworkId: () => import_sdk_core11.parseCanonicalNetworkId,
   parseExpiry: () => import_sdk_core12.parseExpiry,
   parsePkhDid: () => import_sdk_core11.parsePkhDid,
+  parseSecretCatalogKey: () => import_sdk_core16.parseSecretCatalogKey,
   parseSpaceUri: () => import_sdk_core19.parseSpaceUri,
   pkhDid: () => import_sdk_core11.pkhDid,
   principalDid: () => import_sdk_core11.principalDid,
@@ -2081,6 +2083,11 @@ var NodeSecretsService = class {
     if (!permission.ok) return permission;
     return options === void 0 ? this.service.list() : this.service.list(options);
   }
+  async listAll() {
+    const permission = await this.ensurePermission("", void 0, "list");
+    if (!permission.ok) return permission;
+    return this.service.listAll();
+  }
   get service() {
     return this.config.getService();
   }
@@ -2142,7 +2149,11 @@ var NodeSecretsService = class {
       (entry) => manifests.some((candidate) => {
         const resolved = (0, import_sdk_core7.resolveManifest)(candidate);
         return resolved.resources.some(
-          (resource) => resource.service === entry.service && spaceMatches(resource.space, entry.space, this.config.resolveSpace) && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
+          (resource) => resource.service === entry.service && spaceMatches(
+            resource.space,
+            entry.space,
+            this.config.resolveSpace
+          ) && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
         );
       })
     );
@@ -2275,6 +2286,22 @@ function cloneRecapCaveats(caveats) {
     throw new Error("Verified persisted session ReCap contains invalid caveats.");
   }
 }
+function jsonFromVerifier(value) {
+  if (value === void 0) return null;
+  if (Array.isArray(value)) return value.map(jsonFromVerifier);
+  if (value instanceof Map) {
+    const entries = [...value.entries()];
+    if (!entries.every(([key]) => typeof key === "string")) return value;
+    return Object.fromEntries(entries.map(([key, nested]) => [key, jsonFromVerifier(nested)]));
+  }
+  if (value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+    return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, jsonFromVerifier(nested)]));
+  }
+  return value;
+}
+function verifierRecapEntries(entries) {
+  return entries.map((entry) => Array.isArray(entry.caveats) ? { ...entry, caveats: entry.caveats.map((caveat) => jsonFromVerifier(caveat)) } : entry);
+}
 var ServiceGraphLifetime = class {
   constructor(invokeFn, invokeAnyFn, fetchFn) {
     this.invokeFn = invokeFn;
@@ -2347,18 +2374,23 @@ var UnsupportedSessionRestoreError = class extends Error {
     this.name = "UnsupportedSessionRestoreError";
   }
 };
+var InvalidRestoredSessionError = class extends Error {
+  constructor(message = "Persisted session authority is invalid or expired.") {
+    super(message);
+    this.code = "AUTH_EXPIRED";
+    this.name = "InvalidRestoredSessionError";
+  }
+};
 function canonicalRestoredVerificationMethod(canonicalVerificationMethod, persistedVerificationMethod) {
   if (typeof persistedVerificationMethod !== "string") return void 0;
   const principal = canonicalVerificationMethod.split("#", 1)[0];
   return persistedVerificationMethod === principal || persistedVerificationMethod === canonicalVerificationMethod ? canonicalVerificationMethod : void 0;
 }
 function persistedExpiry(value) {
-  if (typeof value !== "string") {
-    throw new Error("Persisted session without a SIWE expiration must include expiresAt.");
-  }
+  if (typeof value !== "string") throw new InvalidRestoredSessionError("Persisted session must include expiresAt.");
   const expiry = new Date(value);
   if (!Number.isFinite(expiry.getTime()) || expiry.getTime() <= Date.now()) {
-    throw new Error("Persisted session expiry is invalid or expired.");
+    throw new InvalidRestoredSessionError();
   }
   return expiry;
 }
@@ -2837,6 +2869,29 @@ var _TinyCloudNode = class _TinyCloudNode {
     const authHosts = this.auth?.hosts ?? [];
     return authHosts.length > 0 ? authHosts : [this.config.host];
   }
+  /** The registry-resolved Node endpoint and the identity returned by that exact Node. */
+  async activeNodeIdentity() {
+    const host = this.hosts[0];
+    if (host === void 0) throw new Error("TinyCloud node host has not been resolved");
+    const parsed = new URL(host);
+    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && (parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost")) || parsed.origin !== host) {
+      throw new Error("TinyCloud node host is not a canonical origin");
+    }
+    const nodeDid = await this.fetchNodeId();
+    if (!nodeDid.startsWith("did:key:z")) throw new Error("TinyCloud node identity is not a did:key");
+    return Object.freeze({ origin: parsed.origin, nodeDid });
+  }
+  /** Publish the active owner Node as a session-signed registry record. */
+  async publishActiveNodeLocation(registryUrl, fetchFn = globalThis.fetch.bind(globalThis)) {
+    const node = await this.activeNodeIdentity();
+    return (0, import_sdk_core8.publishLocationRecord)({
+      registryUrl,
+      subject: this.credentialHolderDid,
+      nodeOrigin: node.origin,
+      signer: { type: "did:key", signBytes: (bytes) => this.signSessionBytes(bytes) },
+      fetch: fetchFn
+    });
+  }
   /**
    * Get the primary identity DID for this user.
    * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -2878,16 +2933,26 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   getVerifiedSessionCapabilities() {
     const session = this.currentTinyCloudSession();
-    if (!session || !session.siwe) return [];
-    return (0, import_sdk_core8.parseRecapCapabilities)(
-      (siwe) => this.parseRecapWithCaveats(siwe),
-      session.siwe
-    ).map((entry) => entry.service === "tinycloud.encryption" ? {
-      service: entry.service,
-      path: entry.path,
-      actions: [...entry.actions],
-      ...entry.caveats === void 0 ? {} : { caveats: entry.caveats }
-    } : entry);
+    return session?.siwe ? this.projectSignedRecapCapabilities(session.siwe) : [];
+  }
+  /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
+  projectSignedRecapCapabilities(siwe) {
+    const projected = this.parseRecapWithCaveats(siwe).map((entry) => {
+      const normalized = (0, import_sdk_core8.parseRecapCapabilities)(() => [entry], siwe)[0];
+      if (normalized.service !== "tinycloud.encryption") return normalized;
+      if (!this.isEncryptionNetworkOperation("encryption", entry.path, entry.space)) {
+        return { ...normalized, space: entry.space };
+      }
+      return {
+        service: normalized.service,
+        path: normalized.path,
+        actions: normalized.actions,
+        ...normalized.caveats === void 0 ? {} : { caveats: normalized.caveats }
+      };
+    });
+    return projected.sort(
+      (left, right) => (left.space ?? "").localeCompare(right.space ?? "") || left.service.localeCompare(right.service) || left.path.localeCompare(right.path)
+    );
   }
   /**
    * Get the Ethereum address for this user.
@@ -3342,9 +3407,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * We must keep the full owner-scoped URI so a synthetic primary grant can
    * never cover an operation on a different owner's space.
    *
-   * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
-   * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
-   * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+   * Only top-level encryption network entries (`space: "encryption"` or
+   * absent) become `resource` ops. A network-shaped path nested under a
+   * data space remains a `spaceId` op, not raw network authority.
    * One op per action.
    *
    * Returns `[]` for session-only / restored-without-siwe modes and for any
@@ -3365,7 +3430,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         operations = entries.flatMap((entry) => {
           const service = this.invocationServiceName(entry.service);
           return entry.actions.map((action) => ({
-            ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId: entry.space },
+            ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId: entry.space },
             service,
             path: entry.path,
             action,
@@ -3527,7 +3592,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return;
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        if (/Unauthorized Action|\b401\b/.test(message)) {
+        if (/Unauthorized Action|\b(?:401|403)\b/.test(message)) {
           console.warn(
             "TinyCloud account registry sync stopped: authorization verdict is not retryable",
             error
@@ -3777,9 +3842,14 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   async restoreSession(sessionData) {
     await this.wasmBindings.ensureInitialized?.();
-    const restoredJwk = clonePersistedSessionJwk(sessionData.jwk);
+    let restoredJwk;
+    try {
+      restoredJwk = clonePersistedSessionJwk(sessionData.jwk);
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid private Ed25519 session key.");
+    }
     if (sessionData.chainId !== void 0 && (!Number.isSafeInteger(sessionData.chainId) || sessionData.chainId <= 0)) {
-      throw new Error("Persisted session chain ID must be a positive safe integer.");
+      throw new InvalidRestoredSessionError("Persisted session chain ID must be a positive safe integer.");
     }
     const stagedManager = this.wasmBindings.createSessionManager();
     const stagedReplace = stagedManager.replaceSessionKey;
@@ -3791,32 +3861,31 @@ var _TinyCloudNode = class _TinyCloudNode {
     let stagedKeyId;
     let stagedJwk;
     let canonicalVerificationMethod;
+    const keyIds = liveKeys.call(this.sessionManager);
+    if (!Array.isArray(keyIds) || !keyIds.every((keyId) => typeof keyId === "string")) {
+      throw new UnsupportedSessionRestoreError("it cannot reliably enumerate every live session signer");
+    }
+    for (const keyId of keyIds) {
+      if (keyId === this.sessionKeyId) continue;
+      const jwk = this.sessionManager.jwk(keyId);
+      if (!jwk) throw new Error("missing live session key");
+      stagedReplace.call(stagedManager, clonePersistedSessionJwk(JSON.parse(jwk)), keyId);
+    }
     try {
-      const keyIds = liveKeys.call(this.sessionManager);
-      if (!Array.isArray(keyIds) || !keyIds.every((keyId) => typeof keyId === "string")) {
-        throw new UnsupportedSessionRestoreError("it cannot reliably enumerate every live session signer");
-      }
-      for (const keyId of keyIds) {
-        if (keyId === this.sessionKeyId) continue;
-        const jwk = this.sessionManager.jwk(keyId);
-        if (!jwk) throw new Error("missing live session key");
-        stagedReplace.call(stagedManager, clonePersistedSessionJwk(JSON.parse(jwk)), keyId);
-      }
       stagedKeyId = stagedReplace.call(stagedManager, restoredJwk, this.sessionKeyId);
-      const stagedJwkJson = stagedManager.jwk(stagedKeyId);
-      if (!stagedJwkJson) throw new Error("missing restored session key");
-      stagedJwk = clonePersistedSessionJwk(JSON.parse(stagedJwkJson));
-      canonicalVerificationMethod = stagedManager.getDID(stagedKeyId);
-    } catch (error) {
-      if (error instanceof UnsupportedSessionRestoreError) throw error;
-      throw new Error("Persisted session has an invalid private Ed25519 session key.");
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid private Ed25519 session key.");
     }
+    const stagedJwkJson = stagedManager.jwk(stagedKeyId);
+    if (!stagedJwkJson) throw new Error("missing restored session key");
+    stagedJwk = clonePersistedSessionJwk(JSON.parse(stagedJwkJson));
+    canonicalVerificationMethod = stagedManager.getDID(stagedKeyId);
     const restoredVerificationMethod = canonicalRestoredVerificationMethod(
       canonicalVerificationMethod,
       sessionData.verificationMethod
     );
     if (!restoredVerificationMethod) {
-      throw new Error(
+      throw new InvalidRestoredSessionError(
         "Persisted session verification method does not match its private Ed25519 session key."
       );
     }
@@ -3828,26 +3897,37 @@ var _TinyCloudNode = class _TinyCloudNode {
     ];
     const hasPersistedProof = proofValues.every((value) => value !== void 0);
     if (!hasPersistedProof && (proofValues.some((value) => value !== void 0) || sessionData.expiresAt !== void 0)) {
-      throw new Error("Persisted session authority metadata is incomplete.");
+      throw new InvalidRestoredSessionError("Persisted session authority metadata is incomplete.");
+    }
+    let restoredAddress;
+    try {
+      restoredAddress = hasPersistedProof ? (0, import_sdk_core8.canonicalizeAddress)(sessionData.address) : void 0;
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid wallet address.");
     }
-    const restoredAddress = hasPersistedProof ? (0, import_sdk_core8.canonicalizeAddress)(sessionData.address) : void 0;
     let stagedSessionExpiry = /* @__PURE__ */ new Date(0);
     let stagedRecap = [];
     if (hasPersistedProof) {
       if (typeof this.wasmBindings.validatePersistedSession !== "function") {
         throw new UnsupportedSessionRestoreError("it cannot verify persisted SIWE authority");
       }
-      const verified = this.wasmBindings.validatePersistedSession({
-        delegationHeader: sessionData.delegationHeader,
-        delegationCid: sessionData.delegationCid,
-        spaceId: sessionData.spaceId,
-        jwk: stagedJwk,
-        address: restoredAddress,
-        chainId: sessionData.chainId,
-        siwe: sessionData.siwe,
-        signature: sessionData.signature
-      });
-      const exactRecap = verified.verifiedRecap;
+      const verified = (() => {
+        try {
+          return this.wasmBindings.validatePersistedSession({
+            delegationHeader: sessionData.delegationHeader,
+            delegationCid: sessionData.delegationCid,
+            spaceId: sessionData.spaceId,
+            jwk: stagedJwk,
+            address: restoredAddress,
+            chainId: sessionData.chainId,
+            siwe: sessionData.siwe,
+            signature: sessionData.signature
+          });
+        } catch (error) {
+          throw new InvalidRestoredSessionError(error instanceof Error ? error.message : String(error));
+        }
+      })();
+      const exactRecap = Array.isArray(verified.verifiedRecap) ? verifierRecapEntries(verified.verifiedRecap) : verified.verifiedRecap;
       if (!Array.isArray(exactRecap) || !exactRecap.every(
         (entry) => entry !== null && typeof entry === "object" && typeof entry.service === "string" && typeof entry.space === "string" && typeof entry.path === "string" && Array.isArray(entry.actions) && entry.actions.every((action) => typeof action === "string") && Array.isArray(entry.caveats) && entry.caveats.every(
           (caveat) => caveat !== null && typeof caveat === "object" && !Array.isArray(caveat)
@@ -3867,7 +3947,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const signedExpiry = verified.expiresAt === void 0 ? void 0 : persistedExpiry(verified.expiresAt);
       const persistedPolicyExpiry = sessionData.expiresAt === void 0 ? void 0 : persistedExpiry(sessionData.expiresAt);
       if (signedExpiry && persistedPolicyExpiry && !sameInstant(signedExpiry, persistedPolicyExpiry)) {
-        throw new Error("Persisted session expiry does not match its signed SIWE authority.");
+        throw new InvalidRestoredSessionError("Persisted session expiry does not match its signed SIWE authority.");
       }
       stagedSessionExpiry = signedExpiry ?? persistedPolicyExpiry ?? persistedExpiry(void 0);
     }
@@ -3964,7 +4044,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     operations = recap.flatMap((entry) => {
       const service = this.invocationServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId: entry.space },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId: entry.space },
         service,
         path: entry.path,
         action,
@@ -4060,7 +4140,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const delegations = input.recap.map((entry) => ({
         cid: session.delegationCid,
         delegateDID: session.verificationMethod,
-        spaceId: entry.space,
+        spaceId: this.spaceIdsEqual(entry.space, session.spaceId) ? session.spaceId : entry.space,
         path: entry.path,
         actions: [...entry.actions],
         caveats: cloneRecapCaveats(entry.caveats),
@@ -4750,16 +4830,11 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          let permissionHint;
-          if (response.status === 401 || response.status === 403) {
-            try {
-              const body = await response.json();
-              const record = typeof body === "object" && body !== null ? body : void 0;
-              const nested = typeof record?.error === "object" && record.error !== null ? record.error : void 0;
-              permissionHint = (0, import_sdk_services.parsePermissionHint)(record?.permissionHint) ?? (0, import_sdk_services.parsePermissionHint)(nested?.permissionHint);
-            } catch {
-            }
-          }
+          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services.parsePermissionHint)({
+            service: "tinycloud.encryption",
+            path: networkId,
+            actions: ["tinycloud.encryption/decrypt"]
+          }) : void 0;
           throw new import_sdk_core8.DecryptTransportResponseError(response.status, permissionHint);
         }
         return await response.json();
@@ -5184,63 +5259,62 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
   }
-  /** Register a policy that is already bound to an activated owner delegation. */
-  async registerOwnerSharePolicy(params) {
+  /** Register a signed policy and sibling roots with this Node's Policy/v3 runtime. */
+  async registerPolicy(params) {
     this._serviceGraph.assertActive();
-    if (params.policy.bytes.byteLength > 2 * 1024 * 1024) throw new Error("Owner share policy is too large");
-    const response = await fetch(`${this.config.host}/share/v2/policies`, {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        policy: { bytes: base64UrlEncode(params.policy.bytes), cid: params.policy.cid, proof: params.policy.proof },
-        ownerDelegation: { cid: params.ownerDelegation.delegationCid, dagCbor: base64UrlEncode(params.ownerDelegation.signedDagCbor) },
-        enforcementDelegation: params.enforcementDelegation,
-        contentSourceDigest: params.contentSourceDigest
-      })
+    return (0, import_sdk_core8.registerPolicyV3)({
+      ...params,
+      nodeOrigin: this.config.host,
+      fetch: globalThis.fetch.bind(globalThis)
     });
-    if (!response.ok) {
-      let code = "";
-      try {
-        const body = await response.clone().json();
-        if (typeof body.error?.code === "string") code = ` ${body.error.code}`;
-      } catch {
-      }
-      throw new Error(`Owner share policy registration failed: ${response.status}${code}`);
-    }
-    const responseBytes = new Uint8Array(await response.arrayBuffer());
-    return (0, import_sdk_core8.validateOwnerSharePolicyRegistrationBytes)(responseBytes, params);
   }
-  /** Authorize a short-lived, one-use v2 delivery using the authenticated invocation chain. */
-  async authorizeShareDelivery(input) {
+  /** Authorize one short-lived v3 delivery against the signed v3 envelope and registered roots. */
+  async authorizeShareDeliveryV3(input) {
     const session = this.currentTinyCloudSession();
     const serviceSession = this._serviceContext?.session;
     if (!session || !serviceSession) throw new Error("Share delivery requires an authenticated session");
+    const idempotencyBytes = new TextEncoder().encode(input.idempotencyKey);
+    if (idempotencyBytes.byteLength === 0 || idempotencyBytes.byteLength > 512) {
+      throw new Error("Share delivery idempotency key is invalid");
+    }
+    const jtiDigest = new Uint8Array(await crypto.subtle.digest("SHA-256", idempotencyBytes));
     const body = {
-      envelopeCid: input.envelopeCid,
+      envelope: input.envelope,
+      sealedEnvelope: input.sealedEnvelope,
+      envelopeKey: input.envelopeKey,
       shareCid: input.shareCid,
-      shareId: input.shareId,
-      registrationCid: input.registrationCid,
-      policyCid: input.policyCid,
-      delegationCid: input.delegationCid,
-      enforcementDelegationCid: input.enforcementDelegationCid,
       recipientEmail: input.recipientEmail,
       shareUrl: input.shareUrl,
       documentName: input.documentName,
-      jti: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
-      idempotencyKey: input.idempotencyKey,
-      expiresAt: input.expiresAt
+      jti: base64UrlEncode(jtiDigest.slice(0, 16)),
+      expiresAt: new Date(input.expiresAt).toISOString().replace(/\.\d{3}Z$/, "Z")
     };
     const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, import_sdk_core8.canonicalizeEncryptionJson)(body)))));
     const request = { ...body, requestBodyDigest };
     const authorization = authorizationHeader(this.invokeAnyWithRuntimePermissions(serviceSession, [{ spaceId: session.spaceId, service: "kv", path: input.resourcePath, action: "tinycloud.kv/get" }]));
-    const response = await fetch(`${this.config.host}/share/v2/deliveries/authorize`, {
+    const response = await fetch(`${this.config.host}/policy/v3/deliveries/authorize`, {
       method: "POST",
       headers: { accept: "application/json", "content-type": "application/json", authorization },
       body: (0, import_sdk_core8.canonicalizeEncryptionJson)(request)
     });
-    if (!response.ok) throw new Error(`Share delivery authorization failed: ${response.status}`);
-    const responseBytes = new Uint8Array(await response.arrayBuffer());
-    return (0, import_sdk_core8.validateShareDeliveryAuthorizationBytes)(responseBytes, { request, nodeProof: input.nodeProof, credentialsAudience: input.credentialsAudience });
+    if (!response.ok) throw new Error(`V3 share delivery authorization failed: ${response.status}`);
+    const verified = (0, import_sdk_core8.validateShareDeliveryAuthorizationV3Bytes)(new Uint8Array(await response.arrayBuffer()), {
+      request,
+      senderKeyDid: this.credentialHolderDid,
+      deliveryAudience: input.deliveryAudience
+    });
+    const requestDigest = new Uint8Array(await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(`${import_sdk_core8.CREDENTIAL_INVITATION_REQUEST_DOMAIN}${(0, import_sdk_core8.canonicalizeEncryptionJson)(verified.request)}`)
+    ));
+    return {
+      ...verified,
+      proof: {
+        alg: "EdDSA",
+        kid: this.credentialHolderDid,
+        signature: base64UrlEncode(await this.signSessionBytes(requestDigest))
+      }
+    };
   }
   async createRootDelegationForSharing(params, assertActive) {
     try {
@@ -5695,7 +5769,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           continue;
         }
         let space;
-        if (service !== "tinycloud.encryption") {
+        if (service !== "tinycloud.encryption" || operation.resource === void 0) {
           if (typeof operation.spaceId !== "string") continue;
           try {
             space = this.resolvePermissionSpace(operation.spaceId, session);
@@ -6240,11 +6314,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return { delegation: delegation2, prompted: true };
     }
-    const granted = (0, import_sdk_core8.parseRecapCapabilities)(
-      (siwe) => this.parseRecapWithCaveats(siwe),
-      session.siwe
-    );
-    const { subset, missing } = (0, import_sdk_core8.isCapabilitySubset)(expandedEntries, granted);
+    const granted = this.projectSignedRecapCapabilities(session.siwe);
+    const { subset, missing } = this.signedCapabilitySubset(expandedEntries, granted);
     if (!subset) {
       const runtimeOperations = this.permissionEntriesToOperations(expandedEntries, session);
       const runtimeGrant = this.findGrantForOperations(
@@ -6564,7 +6635,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return abilities;
   }
   isEncryptionPermissionEntry(entry) {
-    return entry.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE && entry.path.startsWith("urn:tinycloud:encryption:");
+    return entry.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE && this.isEncryptionNetworkOperation("encryption", entry.path, entry.space);
   }
   permissionsToRawAbilities(entries) {
     const rawAbilities = {};
@@ -6588,7 +6659,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return entries.flatMap((entry) => {
       const service = this.shortServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId },
         service,
         path: entry.path,
         action,
@@ -6596,13 +6667,21 @@ var _TinyCloudNode = class _TinyCloudNode {
       }));
     });
   }
+  /** Raw network authority cannot be covered by a nested encryption space. */
+  signedCapabilitySubset(requested, granted) {
+    const rawGranted = granted.filter((entry) => this.isEncryptionPermissionEntry(entry)).map((entry) => ({ ...entry, space: "encryption" }));
+    const spaceGranted = granted.filter((entry) => !this.isEncryptionPermissionEntry(entry));
+    const missing = requested.filter((entry) => {
+      const raw = this.isEncryptionPermissionEntry(entry);
+      const comparable = raw ? { ...entry, space: "encryption" } : entry;
+      return !(0, import_sdk_core8.isCapabilitySubset)([comparable], raw ? rawGranted : spaceGranted).subset;
+    });
+    return { subset: missing.length === 0, missing };
+  }
   sessionCoversPermissionEntries(session, entries) {
     try {
-      const granted = (0, import_sdk_core8.parseRecapCapabilities)(
-        (siwe) => this.parseRecapWithCaveats(siwe),
-        session.siwe
-      );
-      return (0, import_sdk_core8.isCapabilitySubset)(entries, granted).subset;
+      const granted = this.projectSignedRecapCapabilities(session.siwe);
+      return this.signedCapabilitySubset(entries, granted).subset;
     } catch {
       return false;
     }
@@ -6612,7 +6691,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const spaceId = this.resolvePermissionSpace(entry.space, session);
       const service = this.shortServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId },
         service,
         path: entry.path,
         action,
@@ -6701,7 +6780,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return resources.flatMap((resource) => {
       const service = this.invocationServiceName(resource.service);
       return resource.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, resource.path) ? { resource: resource.path } : { spaceId: resource.space },
+        ...this.isEncryptionNetworkOperation(service, resource.path, resource.space) ? { resource: resource.path } : { spaceId: resource.space },
         service,
         path: resource.path,
         action,
@@ -6762,7 +6841,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     for (const resource of resources) {
       const service = this.invocationServiceName(resource.service);
-      if (this.isEncryptionNetworkOperation(service, resource.path)) {
+      if (this.isEncryptionNetworkOperation(service, resource.path, resource.space)) {
         rawAbilities[_a = resource.path] ?? (rawAbilities[_a] = []);
         addActions(rawAbilities[resource.path], resource.actions);
         continue;
@@ -6831,21 +6910,15 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return granted.spaceId !== void 0 && requested.spaceId !== void 0 && this.spaceIdsEqual(granted.spaceId, requested.spaceId) && this.pathContains(granted.path, requested.path);
   }
-  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. The embedded
-  // EIP-155 address is case-insensitive, but the CLI canonicalizes it to
-  // lowercase when building a space URI while stored runtime delegations keep
-  // the EIP-55 checksummed form — so a byte-for-byte compare spuriously rejects
-  // an otherwise-valid grant. Lowercase ONLY the `eip155:<chain>:0x<addr>`
-  // segment and leave everything else (crucially the case-sensitive space NAME)
-  // byte-exact. Mirrors the CLI's `normalizeSpaceForCompare` (OPENKEY_SCOPE_MISMATCH fix).
+  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. Compare
+  // only the embedded EIP-155 address without case sensitivity; chain, name,
+  // and all non-PKH space identifiers remain byte-exact.
   spaceIdsEqual(a, b) {
     return this.normalizeSpaceAddress(a) === this.normalizeSpaceAddress(b);
   }
   normalizeSpaceAddress(space) {
-    return space.replace(
-      /(eip155:\d+:)(0x[0-9a-fA-F]{40})/,
-      (_match, prefix, addr) => prefix + addr.toLowerCase()
-    );
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
   }
   actionContains(grantedAction, requestedAction) {
     if (grantedAction === requestedAction) {
@@ -6862,10 +6935,11 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   /** Prefer the v2 caveat-preserving parser while retaining old custom WASM. */
   parseRecapWithCaveats(siwe) {
-    return this.wasmBindings.parseVerifiedRecapFromSiwe?.(siwe) ?? this.wasmBindings.parseRecapFromSiwe(siwe);
+    const verified = this.wasmBindings.parseVerifiedRecapFromSiwe?.(siwe);
+    return verified == null ? this.wasmBindings.parseRecapFromSiwe(siwe) : verifierRecapEntries(verified);
   }
-  isEncryptionNetworkOperation(service, path) {
-    return service === "encryption" && path.startsWith("urn:tinycloud:encryption:");
+  isEncryptionNetworkOperation(service, path, space) {
+    return service === "encryption" && (space === void 0 || space === "encryption") && path.startsWith("urn:tinycloud:encryption:");
   }
   operationFromInvokeAnyEntry(entry) {
     const service = this.invocationServiceName(entry.service);
@@ -6878,7 +6952,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...entry.caveats === void 0 ? {} : { caveats: cloneRecapCaveats(entry.caveats) }
       };
     }
-    if (this.isEncryptionNetworkOperation(service, entry.path)) {
+    if (entry.spaceId === void 0 && this.isEncryptionNetworkOperation(service, entry.path)) {
       return {
         resource: entry.path,
         service,
@@ -7163,8 +7237,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const jwk = mySession.jwk;
     const { abilities, rawAbilities } = this.buildActivationAbilities(delegation);
     const now = /* @__PURE__ */ new Date();
-    const maxExpiry = new Date(now.getTime() + 60 * 60 * 1e3);
-    const expirationTime = delegation.expiry < maxExpiry ? delegation.expiry : maxExpiry;
+    const expirationTime = delegation.expiry;
     const prepared = this.wasmBindings.prepareSession({
       abilities,
       address: this.wasmBindings.ensureEip55(mySession.address),
@@ -7268,8 +7341,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     const now = /* @__PURE__ */ new Date();
-    const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
-    const requestedExpiry = new Date(now.getTime() + expiryMs);
+    const requestedExpiry = params.expiryMs === void 0 ? parentDelegation.expiry : new Date(now.getTime() + params.expiryMs);
     const actualExpiry = requestedExpiry > parentDelegation.expiry ? parentDelegation.expiry : requestedExpiry;
     const abilities = {};
     const rawAbilities = {};
@@ -7725,6 +7797,7 @@ var import_sdk_core21 = require("@tinycloud/sdk-core");
   DuckDbService,
   FileSessionStorage,
   IdentityParseError,
+  InvalidRestoredSessionError,
   KVService,
   ManifestValidationError,
   MemorySessionStorage,
@@ -7790,6 +7863,7 @@ var import_sdk_core21 = require("@tinycloud/sdk-core");
   parseCanonicalNetworkId,
   parseExpiry,
   parsePkhDid,
+  parseSecretCatalogKey,
   parseSpaceUri,
   pkhDid,
   principalDid,