@tinycloud/node-sdk 3.0.0-beta.8 → 3.0.0

package/dist/{core-WJQ9KiSD.d.cts → core-DufYfxi-.d.cts}

@@ -1,4 +1,5 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ShareDeliveryAuthorizationReceipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -183,7 +184,7 @@ interface NodeUserAuthorizationConfig {
     spacePrefix?: string;
     /** Default actions for sessions */
     defaultActions?: Record<string, Record<string, string[]>>;
-    /** Session expiration time in milliseconds (default: 1 hour) */
+    /** Session expiration time in milliseconds (default: 30 days, `EXPIRY.SESSION_MS`) */
     sessionExpirationMs?: number;
     /** Automatically create space if it doesn't exist (default: false) */
     autoCreateSpace?: boolean;
@@ -955,39 +956,6 @@ declare class DelegatedAccess {
     get restorable(): RestorableSession;
 }
 
-/**
- * TinyCloudNode - High-level API for Node.js users.
- *
- * Each user has their own TinyCloudNode instance with their own key.
- * This class provides a simplified interface for:
- * - Signing in and managing sessions
- * - Key-value storage operations on own space
- * - Creating and using delegations
- *
- * @example
- * ```typescript
- * const alice = new TinyCloudNode({
- *   privateKey: process.env.ALICE_PRIVATE_KEY,
- *   host: "https://node.tinycloud.xyz",
- *   prefix: "myapp",
- * });
- *
- * await alice.signIn();
- * await alice.kv.put("greeting", "Hello, world!");
- *
- * // Delegate access to Bob
- * const delegation = await alice.createDelegation({
- *   path: "shared/",
- *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
- *   delegateDID: bob.did,
- * });
- *
- * // Bob uses the delegation
- * const access = await bob.useDelegation(delegation);
- * const data = await access.kv.get("shared/data");
- * ```
- */
-
 declare const BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
 declare const BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
 declare const ACCEPTED_MARKER_VERSIONS: readonly number[];
@@ -1072,6 +1040,10 @@ declare class UnsupportedSessionRestoreError extends Error {
     readonly code: "RESTORE_SESSION_KEY_REPLACEMENT_UNSUPPORTED";
     constructor(reason?: string);
 }
+declare class InvalidRestoredSessionError extends Error {
+    readonly code: "AUTH_EXPIRED";
+    constructor(message?: string);
+}
 /**
  * Configuration for TinyCloudNode.
  * All fields are optional - TinyCloudNode can work with zero configuration.
@@ -1103,7 +1075,7 @@ interface TinyCloudNodeConfig {
     prefix?: string;
     /** Domain for SIWE messages (default: derived from host) */
     domain?: string;
-    /** Session expiration time in milliseconds (default: 1 hour) */
+    /** Session expiration time in milliseconds (default: 30 days, `EXPIRY.SESSION_MS`) */
     sessionExpirationMs?: number;
     /** Whether to automatically create space if it doesn't exist (default: false) */
     autoCreateSpace?: boolean;
@@ -1157,7 +1129,8 @@ interface TinyCloudNodeConfig {
  * Options for {@link TinyCloudNode.delegateTo}.
  *
  * `expiry` accepts either an ms-format duration string (e.g. `"7d"`, `"1h"`)
- * or a raw number of milliseconds. When omitted, the default is 1 hour.
+ * or a raw number of milliseconds. When omitted, the default is
+ * `EXPIRY.SESSION_MS` (30 days), still capped at the session's own expiry.
  *
  * `forceWalletSign` bypasses the derivability check and sends the
  * delegation through the legacy wallet-signed SIWE path, which always
@@ -1382,6 +1355,13 @@ declare class TinyCloudNode {
     get manifest(): Manifest | Manifest[] | undefined;
     get capabilityRequest(): ComposedManifestRequest | undefined;
     get hosts(): string[];
+    /** The registry-resolved Node endpoint and the identity returned by that exact Node. */
+    activeNodeIdentity(): Promise<{
+        readonly origin: string;
+        readonly nodeDid: string;
+    }>;
+    /** Publish the active owner Node as a session-signed registry record. */
+    publishActiveNodeLocation(registryUrl: string, fetchFn?: typeof fetch): Promise<_tinycloud_sdk_core.LocationRecord>;
     /**
      * Get the primary identity DID for this user.
      * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -1410,6 +1390,8 @@ declare class TinyCloudNode {
      * rather than treating a malformed session as unrestricted authority.
      */
     getVerifiedSessionCapabilities(): PermissionEntry[];
+    /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
+    private projectSignedRecapCapabilities;
     /**
      * Get the Ethereum address for this user.
      */
@@ -1470,9 +1452,9 @@ declare class TinyCloudNode {
      * We must keep the full owner-scoped URI so a synthetic primary grant can
      * never cover an operation on a different owner's space.
      *
-     * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
-     * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
-     * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+     * Only top-level encryption network entries (`space: "encryption"` or
+     * absent) become `resource` ops. A network-shaped path nested under a
+     * data space remains a `spaceId` op, not raw network authority.
      * One op per action.
      *
      * Returns `[]` for session-only / restored-without-siwe modes and for any
@@ -1813,33 +1795,12 @@ declare class TinyCloudNode {
     createOwnerDelegation(params: CreateOwnerDelegationParams, assertActive?: () => void): Promise<OwnerDelegationReceipt>;
     /** Register a signed policy and sibling roots with this Node's Policy/v3 runtime. */
     registerPolicy(params: Omit<RegisterPolicyV3Input, "nodeOrigin" | "fetch">): Promise<RegisterPolicyV3Receipt>;
-    /** @deprecated Policy/v2 delivery transport is retired. Use authorizeShareDeliveryV3. */
-    authorizeShareDelivery(input: {
-        readonly envelopeCid: string;
-        readonly shareCid: string;
-        readonly shareId: string;
-        readonly registrationCid: string;
-        readonly policyCid: string;
-        readonly delegationCid: string;
-        readonly enforcementDelegationCid: string;
-        readonly resourcePath: string;
-        readonly recipientEmail: string;
-        readonly shareUrl: string;
-        readonly documentName: string;
-        readonly idempotencyKey: string;
-        readonly expiresAt: string;
-        /** The enrolled receipt key from the node trust bundle. */
-        readonly nodeProof: {
-            readonly kid: string;
-            readonly publicKey: Uint8Array;
-        };
-        /** The trusted OpenCredentials witness origin from the same trust bundle as `nodeProof`. */
-        readonly credentialsAudience: string;
-    }): Promise<ShareDeliveryAuthorizationReceipt>;
     /** Authorize one short-lived v3 delivery against the signed v3 envelope and registered roots. */
     authorizeShareDeliveryV3(input: {
         readonly envelope: Record<string, CanonicalJson | undefined>;
+        /** Canonical sealed recipient envelope: version || nonce || ciphertext+tag. */
         readonly sealedEnvelope: string;
+        /** Base64url 32-byte envelope key; it must also be the URL fragment key. */
         readonly envelopeKey: string;
         readonly shareCid: string;
         readonly resourcePath: string;
@@ -1847,11 +1808,9 @@ declare class TinyCloudNode {
         readonly shareUrl: string;
         readonly documentName: string;
         readonly expiresAt: string;
-        readonly nodeProof: {
-            readonly kid: string;
-            readonly publicKey: Uint8Array;
-        };
-        readonly credentialsAudience: string;
+        readonly deliveryAudience: string;
+        /** Stable caller retry identity. It is hashed into the protocol's 16-byte JTI. */
+        readonly idempotencyKey: string;
     }): Promise<ShareDeliveryAuthorizationV3Receipt>;
     private createRootDelegationForSharing;
     /**
@@ -2266,6 +2225,8 @@ declare class TinyCloudNode {
     private isEncryptionPermissionEntry;
     private permissionsToRawAbilities;
     private permissionOperations;
+    /** Raw network authority cannot be covered by a nested encryption space. */
+    private signedCapabilitySubset;
     private sessionCoversPermissionEntries;
     private permissionEntriesToOperations;
     private findRuntimeGrantsForPermissionEntries;
@@ -2387,7 +2348,7 @@ declare class TinyCloudNode {
         delegateDID: string;
         /** Whether to prevent the recipient from creating further sub-delegations */
         disableSubDelegation?: boolean;
-        /** Expiration time in milliseconds from now (must be before parent's expiry) */
+        /** Expiration in milliseconds from now; defaults to the parent's own expiry, the longest allowed. */
         expiryMs?: number;
         /** Explicit multi-resource projection, including encryption networks. */
         resources?: Array<{
@@ -2507,4 +2468,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, serializeDelegation as G, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RuntimeDelegationActivator as l, type RuntimePermissionGrantOptions as m, type SecretReadInput as n, type SecretReadResult as o, type SignStrategy as p, type TinyCloudNodeConfig as q, type UnifiedOwnerRootReceipt as r, UnsupportedSessionRestoreError as s, type WasmKeyProviderConfig as t, activateCompactRuntimeDelegation as u, activateValidatedRuntimeDelegation as v, createWasmKeyProvider as w, defaultSignStrategy as x, deserializeDelegation as y, grantAuthRequest as z };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, serializeDelegation as G, InvalidRestoredSessionError as I, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RuntimeDelegationActivator as l, type RuntimePermissionGrantOptions as m, type SecretReadInput as n, type SecretReadResult as o, type SignStrategy as p, type TinyCloudNodeConfig as q, type UnifiedOwnerRootReceipt as r, UnsupportedSessionRestoreError as s, type WasmKeyProviderConfig as t, activateCompactRuntimeDelegation as u, activateValidatedRuntimeDelegation as v, createWasmKeyProvider as w, defaultSignStrategy as x, deserializeDelegation as y, grantAuthRequest as z };

package/dist/{core-WJQ9KiSD.d.ts → core-DufYfxi-.d.ts}

@@ -1,4 +1,5 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ShareDeliveryAuthorizationReceipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignRequest, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, PermissionEntry, TelemetryConfig, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, INotificationHandler, IENSResolver, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction } from '@tinycloud/sdk-services';
 
@@ -183,7 +184,7 @@ interface NodeUserAuthorizationConfig {
     spacePrefix?: string;
     /** Default actions for sessions */
     defaultActions?: Record<string, Record<string, string[]>>;
-    /** Session expiration time in milliseconds (default: 1 hour) */
+    /** Session expiration time in milliseconds (default: 30 days, `EXPIRY.SESSION_MS`) */
     sessionExpirationMs?: number;
     /** Automatically create space if it doesn't exist (default: false) */
     autoCreateSpace?: boolean;
@@ -955,39 +956,6 @@ declare class DelegatedAccess {
     get restorable(): RestorableSession;
 }
 
-/**
- * TinyCloudNode - High-level API for Node.js users.
- *
- * Each user has their own TinyCloudNode instance with their own key.
- * This class provides a simplified interface for:
- * - Signing in and managing sessions
- * - Key-value storage operations on own space
- * - Creating and using delegations
- *
- * @example
- * ```typescript
- * const alice = new TinyCloudNode({
- *   privateKey: process.env.ALICE_PRIVATE_KEY,
- *   host: "https://node.tinycloud.xyz",
- *   prefix: "myapp",
- * });
- *
- * await alice.signIn();
- * await alice.kv.put("greeting", "Hello, world!");
- *
- * // Delegate access to Bob
- * const delegation = await alice.createDelegation({
- *   path: "shared/",
- *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
- *   delegateDID: bob.did,
- * });
- *
- * // Bob uses the delegation
- * const access = await bob.useDelegation(delegation);
- * const data = await access.kv.get("shared/data");
- * ```
- */
-
 declare const BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
 declare const BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
 declare const ACCEPTED_MARKER_VERSIONS: readonly number[];
@@ -1072,6 +1040,10 @@ declare class UnsupportedSessionRestoreError extends Error {
     readonly code: "RESTORE_SESSION_KEY_REPLACEMENT_UNSUPPORTED";
     constructor(reason?: string);
 }
+declare class InvalidRestoredSessionError extends Error {
+    readonly code: "AUTH_EXPIRED";
+    constructor(message?: string);
+}
 /**
  * Configuration for TinyCloudNode.
  * All fields are optional - TinyCloudNode can work with zero configuration.
@@ -1103,7 +1075,7 @@ interface TinyCloudNodeConfig {
     prefix?: string;
     /** Domain for SIWE messages (default: derived from host) */
     domain?: string;
-    /** Session expiration time in milliseconds (default: 1 hour) */
+    /** Session expiration time in milliseconds (default: 30 days, `EXPIRY.SESSION_MS`) */
     sessionExpirationMs?: number;
     /** Whether to automatically create space if it doesn't exist (default: false) */
     autoCreateSpace?: boolean;
@@ -1157,7 +1129,8 @@ interface TinyCloudNodeConfig {
  * Options for {@link TinyCloudNode.delegateTo}.
  *
  * `expiry` accepts either an ms-format duration string (e.g. `"7d"`, `"1h"`)
- * or a raw number of milliseconds. When omitted, the default is 1 hour.
+ * or a raw number of milliseconds. When omitted, the default is
+ * `EXPIRY.SESSION_MS` (30 days), still capped at the session's own expiry.
  *
  * `forceWalletSign` bypasses the derivability check and sends the
  * delegation through the legacy wallet-signed SIWE path, which always
@@ -1382,6 +1355,13 @@ declare class TinyCloudNode {
     get manifest(): Manifest | Manifest[] | undefined;
     get capabilityRequest(): ComposedManifestRequest | undefined;
     get hosts(): string[];
+    /** The registry-resolved Node endpoint and the identity returned by that exact Node. */
+    activeNodeIdentity(): Promise<{
+        readonly origin: string;
+        readonly nodeDid: string;
+    }>;
+    /** Publish the active owner Node as a session-signed registry record. */
+    publishActiveNodeLocation(registryUrl: string, fetchFn?: typeof fetch): Promise<_tinycloud_sdk_core.LocationRecord>;
     /**
      * Get the primary identity DID for this user.
      * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -1410,6 +1390,8 @@ declare class TinyCloudNode {
      * rather than treating a malformed session as unrestricted authority.
      */
     getVerifiedSessionCapabilities(): PermissionEntry[];
+    /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
+    private projectSignedRecapCapabilities;
     /**
      * Get the Ethereum address for this user.
      */
@@ -1470,9 +1452,9 @@ declare class TinyCloudNode {
      * We must keep the full owner-scoped URI so a synthetic primary grant can
      * never cover an operation on a different owner's space.
      *
-     * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
-     * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
-     * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+     * Only top-level encryption network entries (`space: "encryption"` or
+     * absent) become `resource` ops. A network-shaped path nested under a
+     * data space remains a `spaceId` op, not raw network authority.
      * One op per action.
      *
      * Returns `[]` for session-only / restored-without-siwe modes and for any
@@ -1813,33 +1795,12 @@ declare class TinyCloudNode {
     createOwnerDelegation(params: CreateOwnerDelegationParams, assertActive?: () => void): Promise<OwnerDelegationReceipt>;
     /** Register a signed policy and sibling roots with this Node's Policy/v3 runtime. */
     registerPolicy(params: Omit<RegisterPolicyV3Input, "nodeOrigin" | "fetch">): Promise<RegisterPolicyV3Receipt>;
-    /** @deprecated Policy/v2 delivery transport is retired. Use authorizeShareDeliveryV3. */
-    authorizeShareDelivery(input: {
-        readonly envelopeCid: string;
-        readonly shareCid: string;
-        readonly shareId: string;
-        readonly registrationCid: string;
-        readonly policyCid: string;
-        readonly delegationCid: string;
-        readonly enforcementDelegationCid: string;
-        readonly resourcePath: string;
-        readonly recipientEmail: string;
-        readonly shareUrl: string;
-        readonly documentName: string;
-        readonly idempotencyKey: string;
-        readonly expiresAt: string;
-        /** The enrolled receipt key from the node trust bundle. */
-        readonly nodeProof: {
-            readonly kid: string;
-            readonly publicKey: Uint8Array;
-        };
-        /** The trusted OpenCredentials witness origin from the same trust bundle as `nodeProof`. */
-        readonly credentialsAudience: string;
-    }): Promise<ShareDeliveryAuthorizationReceipt>;
     /** Authorize one short-lived v3 delivery against the signed v3 envelope and registered roots. */
     authorizeShareDeliveryV3(input: {
         readonly envelope: Record<string, CanonicalJson | undefined>;
+        /** Canonical sealed recipient envelope: version || nonce || ciphertext+tag. */
         readonly sealedEnvelope: string;
+        /** Base64url 32-byte envelope key; it must also be the URL fragment key. */
         readonly envelopeKey: string;
         readonly shareCid: string;
         readonly resourcePath: string;
@@ -1847,11 +1808,9 @@ declare class TinyCloudNode {
         readonly shareUrl: string;
         readonly documentName: string;
         readonly expiresAt: string;
-        readonly nodeProof: {
-            readonly kid: string;
-            readonly publicKey: Uint8Array;
-        };
-        readonly credentialsAudience: string;
+        readonly deliveryAudience: string;
+        /** Stable caller retry identity. It is hashed into the protocol's 16-byte JTI. */
+        readonly idempotencyKey: string;
     }): Promise<ShareDeliveryAuthorizationV3Receipt>;
     private createRootDelegationForSharing;
     /**
@@ -2266,6 +2225,8 @@ declare class TinyCloudNode {
     private isEncryptionPermissionEntry;
     private permissionsToRawAbilities;
     private permissionOperations;
+    /** Raw network authority cannot be covered by a nested encryption space. */
+    private signedCapabilitySubset;
     private sessionCoversPermissionEntries;
     private permissionEntriesToOperations;
     private findRuntimeGrantsForPermissionEntries;
@@ -2387,7 +2348,7 @@ declare class TinyCloudNode {
         delegateDID: string;
         /** Whether to prevent the recipient from creating further sub-delegations */
         disableSubDelegation?: boolean;
-        /** Expiration time in milliseconds from now (must be before parent's expiry) */
+        /** Expiration in milliseconds from now; defaults to the parent's own expiry, the longest allowed. */
         expiryMs?: number;
         /** Explicit multi-resource projection, including encryption networks. */
         resources?: Array<{
@@ -2507,4 +2468,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, serializeDelegation as G, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RuntimeDelegationActivator as l, type RuntimePermissionGrantOptions as m, type SecretReadInput as n, type SecretReadResult as o, type SignStrategy as p, type TinyCloudNodeConfig as q, type UnifiedOwnerRootReceipt as r, UnsupportedSessionRestoreError as s, type WasmKeyProviderConfig as t, activateCompactRuntimeDelegation as u, activateValidatedRuntimeDelegation as v, createWasmKeyProvider as w, defaultSignStrategy as x, deserializeDelegation as y, grantAuthRequest as z };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, serializeDelegation as G, InvalidRestoredSessionError as I, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RuntimeDelegationActivator as l, type RuntimePermissionGrantOptions as m, type SecretReadInput as n, type SecretReadResult as o, type SignStrategy as p, type TinyCloudNodeConfig as q, type UnifiedOwnerRootReceipt as r, UnsupportedSessionRestoreError as s, type WasmKeyProviderConfig as t, activateCompactRuntimeDelegation as u, activateValidatedRuntimeDelegation as v, createWasmKeyProvider as w, defaultSignStrategy as x, deserializeDelegation as y, grantAuthRequest as z };