@tinycloud/node-sdk 3.0.0-beta.9 → 3.0.0

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, CapabilityPresentationEnvelopeV1, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, ParsedNetworkId, ParsedSecretCatalogKey, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, l as RuntimeDelegationActivator, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, v as activateValidatedRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, z as grantAuthRequest, G as serializeDelegation } from './core-BTuD37zN.cjs';
+export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, l as RuntimeDelegationActivator, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, v as activateValidatedRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, z as grantAuthRequest, G as serializeDelegation } from './core-DufYfxi-.cjs';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import 'events';
 import '@tinycloud/sdk-services';
@@ -133,6 +133,28 @@ type NodeUserAuthorizationAuthorizeFn = (input: OpenKeyBridgeInput) => Promise<{
  */
 declare function wireOpenKeyAuthorize(openkey: OpenKeyAuthorizeTinyCloud): NodeUserAuthorizationAuthorizeFn;
 
+/**
+ * Internal helpers for TinyCloudNode.delegateTo and the legacy
+ * createDelegation compatibility shim. Exported from their own module so
+ * they are easy to unit-test without spinning up a full TinyCloudNode.
+ *
+ * None of these are part of the public API — the module path is not
+ * re-exported from `@tinycloud/node-sdk` or `@tinycloud/node-sdk/core`.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Extract the `expirationTime` field of a signed SIWE message as a `Date`.
+ *
+ * Returns `undefined` only when the SIWE genuinely has no `Expiration Time`
+ * line (RFC-4501 permits it). Propagates parse errors — the SDK always
+ * produces signed SIWEs during sign-in, so an unparseable `session.siwe`
+ * means something is actively wrong and we do not want to silently skip
+ * the expiry check.
+ */
+declare function extractSiweExpiration(siwe: string): Date | undefined;
+
 /**
  * NodeWasmBindings - Default IWasmBindings implementation for Node.js.
  *
@@ -175,4 +197,4 @@ declare class NodeWasmBindings implements IWasmBindings {
     createSessionManager(): ISessionManager;
 }
 
-export { type NodeUserAuthorizationAuthorizeFn, NodeWasmBindings, type OpenKeyAuthorizeTinyCloud, type OpenKeyBridgeInput, PrivateKeySigner, wireOpenKeyAuthorize };
+export { type NodeUserAuthorizationAuthorizeFn, NodeWasmBindings, type OpenKeyAuthorizeTinyCloud, type OpenKeyBridgeInput, PrivateKeySigner, extractSiweExpiration, wireOpenKeyAuthorize };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, CapabilityPresentationEnvelopeV1, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, ParsedNetworkId, ParsedSecretCatalogKey, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, l as RuntimeDelegationActivator, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, v as activateValidatedRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, z as grantAuthRequest, G as serializeDelegation } from './core-BTuD37zN.js';
+export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RestorableSession, l as RuntimeDelegationActivator, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, v as activateValidatedRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, z as grantAuthRequest, G as serializeDelegation } from './core-DufYfxi-.js';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import 'events';
 import '@tinycloud/sdk-services';
@@ -133,6 +133,28 @@ type NodeUserAuthorizationAuthorizeFn = (input: OpenKeyBridgeInput) => Promise<{
  */
 declare function wireOpenKeyAuthorize(openkey: OpenKeyAuthorizeTinyCloud): NodeUserAuthorizationAuthorizeFn;
 
+/**
+ * Internal helpers for TinyCloudNode.delegateTo and the legacy
+ * createDelegation compatibility shim. Exported from their own module so
+ * they are easy to unit-test without spinning up a full TinyCloudNode.
+ *
+ * None of these are part of the public API — the module path is not
+ * re-exported from `@tinycloud/node-sdk` or `@tinycloud/node-sdk/core`.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Extract the `expirationTime` field of a signed SIWE message as a `Date`.
+ *
+ * Returns `undefined` only when the SIWE genuinely has no `Expiration Time`
+ * line (RFC-4501 permits it). Propagates parse errors — the SDK always
+ * produces signed SIWEs during sign-in, so an unparseable `session.siwe`
+ * means something is actively wrong and we do not want to silently skip
+ * the expiry check.
+ */
+declare function extractSiweExpiration(siwe: string): Date | undefined;
+
 /**
  * NodeWasmBindings - Default IWasmBindings implementation for Node.js.
  *
@@ -175,4 +197,4 @@ declare class NodeWasmBindings implements IWasmBindings {
     createSessionManager(): ISessionManager;
 }
 
-export { type NodeUserAuthorizationAuthorizeFn, NodeWasmBindings, type OpenKeyAuthorizeTinyCloud, type OpenKeyBridgeInput, PrivateKeySigner, wireOpenKeyAuthorize };
+export { type NodeUserAuthorizationAuthorizeFn, NodeWasmBindings, type OpenKeyAuthorizeTinyCloud, type OpenKeyBridgeInput, PrivateKeySigner, extractSiweExpiration, wireOpenKeyAuthorize };

package/dist/index.js

@@ -19299,6 +19299,22 @@ function cloneRecapCaveats(caveats) {
     throw new Error("Verified persisted session ReCap contains invalid caveats.");
   }
 }
+function jsonFromVerifier(value) {
+  if (value === void 0) return null;
+  if (Array.isArray(value)) return value.map(jsonFromVerifier);
+  if (value instanceof Map) {
+    const entries = [...value.entries()];
+    if (!entries.every(([key2]) => typeof key2 === "string")) return value;
+    return Object.fromEntries(entries.map(([key2, nested]) => [key2, jsonFromVerifier(nested)]));
+  }
+  if (value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+    return Object.fromEntries(Object.entries(value).map(([key2, nested]) => [key2, jsonFromVerifier(nested)]));
+  }
+  return value;
+}
+function verifierRecapEntries(entries) {
+  return entries.map((entry) => Array.isArray(entry.caveats) ? { ...entry, caveats: entry.caveats.map((caveat) => jsonFromVerifier(caveat)) } : entry);
+}
 var ServiceGraphLifetime = class {
   constructor(invokeFn, invokeAnyFn, fetchFn) {
     this.invokeFn = invokeFn;
@@ -19371,18 +19387,23 @@ var UnsupportedSessionRestoreError = class extends Error {
     this.name = "UnsupportedSessionRestoreError";
   }
 };
+var InvalidRestoredSessionError = class extends Error {
+  constructor(message = "Persisted session authority is invalid or expired.") {
+    super(message);
+    this.code = "AUTH_EXPIRED";
+    this.name = "InvalidRestoredSessionError";
+  }
+};
 function canonicalRestoredVerificationMethod(canonicalVerificationMethod, persistedVerificationMethod) {
   if (typeof persistedVerificationMethod !== "string") return void 0;
   const principal = canonicalVerificationMethod.split("#", 1)[0];
   return persistedVerificationMethod === principal || persistedVerificationMethod === canonicalVerificationMethod ? canonicalVerificationMethod : void 0;
 }
 function persistedExpiry(value) {
-  if (typeof value !== "string") {
-    throw new Error("Persisted session without a SIWE expiration must include expiresAt.");
-  }
+  if (typeof value !== "string") throw new InvalidRestoredSessionError("Persisted session must include expiresAt.");
   const expiry = new Date(value);
   if (!Number.isFinite(expiry.getTime()) || expiry.getTime() <= Date.now()) {
-    throw new Error("Persisted session expiry is invalid or expired.");
+    throw new InvalidRestoredSessionError();
   }
   return expiry;
 }
@@ -19925,16 +19946,26 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   getVerifiedSessionCapabilities() {
     const session = this.currentTinyCloudSession();
-    if (!session || !session.siwe) return [];
-    return parseRecapCapabilities(
-      (siwe) => this.parseRecapWithCaveats(siwe),
-      session.siwe
-    ).map((entry) => entry.service === "tinycloud.encryption" ? {
-      service: entry.service,
-      path: entry.path,
-      actions: [...entry.actions],
-      ...entry.caveats === void 0 ? {} : { caveats: entry.caveats }
-    } : entry);
+    return session?.siwe ? this.projectSignedRecapCapabilities(session.siwe) : [];
+  }
+  /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
+  projectSignedRecapCapabilities(siwe) {
+    const projected = this.parseRecapWithCaveats(siwe).map((entry) => {
+      const normalized = parseRecapCapabilities(() => [entry], siwe)[0];
+      if (normalized.service !== "tinycloud.encryption") return normalized;
+      if (!this.isEncryptionNetworkOperation("encryption", entry.path, entry.space)) {
+        return { ...normalized, space: entry.space };
+      }
+      return {
+        service: normalized.service,
+        path: normalized.path,
+        actions: normalized.actions,
+        ...normalized.caveats === void 0 ? {} : { caveats: normalized.caveats }
+      };
+    });
+    return projected.sort(
+      (left, right) => (left.space ?? "").localeCompare(right.space ?? "") || left.service.localeCompare(right.service) || left.path.localeCompare(right.path)
+    );
   }
   /**
    * Get the Ethereum address for this user.
@@ -20389,9 +20420,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * We must keep the full owner-scoped URI so a synthetic primary grant can
    * never cover an operation on a different owner's space.
    *
-   * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
-   * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
-   * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+   * Only top-level encryption network entries (`space: "encryption"` or
+   * absent) become `resource` ops. A network-shaped path nested under a
+   * data space remains a `spaceId` op, not raw network authority.
    * One op per action.
    *
    * Returns `[]` for session-only / restored-without-siwe modes and for any
@@ -20412,7 +20443,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         operations = entries.flatMap((entry) => {
           const service = this.invocationServiceName(entry.service);
           return entry.actions.map((action) => ({
-            ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId: entry.space },
+            ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId: entry.space },
             service,
             path: entry.path,
             action,
@@ -20574,7 +20605,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return;
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        if (/Unauthorized Action|\b401\b/.test(message)) {
+        if (/Unauthorized Action|\b(?:401|403)\b/.test(message)) {
           console.warn(
             "TinyCloud account registry sync stopped: authorization verdict is not retryable",
             error
@@ -20824,9 +20855,14 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   async restoreSession(sessionData) {
     await this.wasmBindings.ensureInitialized?.();
-    const restoredJwk = clonePersistedSessionJwk(sessionData.jwk);
+    let restoredJwk;
+    try {
+      restoredJwk = clonePersistedSessionJwk(sessionData.jwk);
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid private Ed25519 session key.");
+    }
     if (sessionData.chainId !== void 0 && (!Number.isSafeInteger(sessionData.chainId) || sessionData.chainId <= 0)) {
-      throw new Error("Persisted session chain ID must be a positive safe integer.");
+      throw new InvalidRestoredSessionError("Persisted session chain ID must be a positive safe integer.");
     }
     const stagedManager = this.wasmBindings.createSessionManager();
     const stagedReplace = stagedManager.replaceSessionKey;
@@ -20838,32 +20874,31 @@ var _TinyCloudNode = class _TinyCloudNode {
     let stagedKeyId;
     let stagedJwk;
     let canonicalVerificationMethod;
+    const keyIds = liveKeys.call(this.sessionManager);
+    if (!Array.isArray(keyIds) || !keyIds.every((keyId) => typeof keyId === "string")) {
+      throw new UnsupportedSessionRestoreError("it cannot reliably enumerate every live session signer");
+    }
+    for (const keyId of keyIds) {
+      if (keyId === this.sessionKeyId) continue;
+      const jwk = this.sessionManager.jwk(keyId);
+      if (!jwk) throw new Error("missing live session key");
+      stagedReplace.call(stagedManager, clonePersistedSessionJwk(JSON.parse(jwk)), keyId);
+    }
     try {
-      const keyIds = liveKeys.call(this.sessionManager);
-      if (!Array.isArray(keyIds) || !keyIds.every((keyId) => typeof keyId === "string")) {
-        throw new UnsupportedSessionRestoreError("it cannot reliably enumerate every live session signer");
-      }
-      for (const keyId of keyIds) {
-        if (keyId === this.sessionKeyId) continue;
-        const jwk = this.sessionManager.jwk(keyId);
-        if (!jwk) throw new Error("missing live session key");
-        stagedReplace.call(stagedManager, clonePersistedSessionJwk(JSON.parse(jwk)), keyId);
-      }
       stagedKeyId = stagedReplace.call(stagedManager, restoredJwk, this.sessionKeyId);
-      const stagedJwkJson = stagedManager.jwk(stagedKeyId);
-      if (!stagedJwkJson) throw new Error("missing restored session key");
-      stagedJwk = clonePersistedSessionJwk(JSON.parse(stagedJwkJson));
-      canonicalVerificationMethod = stagedManager.getDID(stagedKeyId);
-    } catch (error) {
-      if (error instanceof UnsupportedSessionRestoreError) throw error;
-      throw new Error("Persisted session has an invalid private Ed25519 session key.");
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid private Ed25519 session key.");
     }
+    const stagedJwkJson = stagedManager.jwk(stagedKeyId);
+    if (!stagedJwkJson) throw new Error("missing restored session key");
+    stagedJwk = clonePersistedSessionJwk(JSON.parse(stagedJwkJson));
+    canonicalVerificationMethod = stagedManager.getDID(stagedKeyId);
     const restoredVerificationMethod = canonicalRestoredVerificationMethod(
       canonicalVerificationMethod,
       sessionData.verificationMethod
     );
     if (!restoredVerificationMethod) {
-      throw new Error(
+      throw new InvalidRestoredSessionError(
         "Persisted session verification method does not match its private Ed25519 session key."
       );
     }
@@ -20875,26 +20910,37 @@ var _TinyCloudNode = class _TinyCloudNode {
     ];
     const hasPersistedProof = proofValues.every((value) => value !== void 0);
     if (!hasPersistedProof && (proofValues.some((value) => value !== void 0) || sessionData.expiresAt !== void 0)) {
-      throw new Error("Persisted session authority metadata is incomplete.");
+      throw new InvalidRestoredSessionError("Persisted session authority metadata is incomplete.");
+    }
+    let restoredAddress;
+    try {
+      restoredAddress = hasPersistedProof ? canonicalizeAddress2(sessionData.address) : void 0;
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid wallet address.");
     }
-    const restoredAddress = hasPersistedProof ? canonicalizeAddress2(sessionData.address) : void 0;
     let stagedSessionExpiry = /* @__PURE__ */ new Date(0);
     let stagedRecap = [];
     if (hasPersistedProof) {
       if (typeof this.wasmBindings.validatePersistedSession !== "function") {
         throw new UnsupportedSessionRestoreError("it cannot verify persisted SIWE authority");
       }
-      const verified = this.wasmBindings.validatePersistedSession({
-        delegationHeader: sessionData.delegationHeader,
-        delegationCid: sessionData.delegationCid,
-        spaceId: sessionData.spaceId,
-        jwk: stagedJwk,
-        address: restoredAddress,
-        chainId: sessionData.chainId,
-        siwe: sessionData.siwe,
-        signature: sessionData.signature
-      });
-      const exactRecap = verified.verifiedRecap;
+      const verified = (() => {
+        try {
+          return this.wasmBindings.validatePersistedSession({
+            delegationHeader: sessionData.delegationHeader,
+            delegationCid: sessionData.delegationCid,
+            spaceId: sessionData.spaceId,
+            jwk: stagedJwk,
+            address: restoredAddress,
+            chainId: sessionData.chainId,
+            siwe: sessionData.siwe,
+            signature: sessionData.signature
+          });
+        } catch (error) {
+          throw new InvalidRestoredSessionError(error instanceof Error ? error.message : String(error));
+        }
+      })();
+      const exactRecap = Array.isArray(verified.verifiedRecap) ? verifierRecapEntries(verified.verifiedRecap) : verified.verifiedRecap;
       if (!Array.isArray(exactRecap) || !exactRecap.every(
         (entry) => entry !== null && typeof entry === "object" && typeof entry.service === "string" && typeof entry.space === "string" && typeof entry.path === "string" && Array.isArray(entry.actions) && entry.actions.every((action) => typeof action === "string") && Array.isArray(entry.caveats) && entry.caveats.every(
           (caveat) => caveat !== null && typeof caveat === "object" && !Array.isArray(caveat)
@@ -20914,7 +20960,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const signedExpiry = verified.expiresAt === void 0 ? void 0 : persistedExpiry(verified.expiresAt);
       const persistedPolicyExpiry = sessionData.expiresAt === void 0 ? void 0 : persistedExpiry(sessionData.expiresAt);
       if (signedExpiry && persistedPolicyExpiry && !sameInstant(signedExpiry, persistedPolicyExpiry)) {
-        throw new Error("Persisted session expiry does not match its signed SIWE authority.");
+        throw new InvalidRestoredSessionError("Persisted session expiry does not match its signed SIWE authority.");
       }
       stagedSessionExpiry = signedExpiry ?? persistedPolicyExpiry ?? persistedExpiry(void 0);
     }
@@ -21011,7 +21057,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     operations = recap.flatMap((entry) => {
       const service = this.invocationServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId: entry.space },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId: entry.space },
         service,
         path: entry.path,
         action,
@@ -21107,7 +21153,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const delegations = input.recap.map((entry) => ({
         cid: session.delegationCid,
         delegateDID: session.verificationMethod,
-        spaceId: entry.space,
+        spaceId: this.spaceIdsEqual(entry.space, session.spaceId) ? session.spaceId : entry.space,
         path: entry.path,
         actions: [...entry.actions],
         caveats: cloneRecapCaveats(entry.caveats),
@@ -21797,16 +21843,11 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          let permissionHint;
-          if (response.status === 401 || response.status === 403) {
-            try {
-              const body = await response.json();
-              const record = typeof body === "object" && body !== null ? body : void 0;
-              const nested = typeof record?.error === "object" && record.error !== null ? record.error : void 0;
-              permissionHint = parsePermissionHint(record?.permissionHint) ?? parsePermissionHint(nested?.permissionHint);
-            } catch {
-            }
-          }
+          const permissionHint = response.status === 401 || response.status === 403 ? parsePermissionHint({
+            service: "tinycloud.encryption",
+            path: networkId,
+            actions: ["tinycloud.encryption/decrypt"]
+          }) : void 0;
           throw new DecryptTransportResponseError(response.status, permissionHint);
         }
         return await response.json();
@@ -22245,13 +22286,20 @@ var _TinyCloudNode = class _TinyCloudNode {
     const session = this.currentTinyCloudSession();
     const serviceSession = this._serviceContext?.session;
     if (!session || !serviceSession) throw new Error("Share delivery requires an authenticated session");
+    const idempotencyBytes = new TextEncoder().encode(input.idempotencyKey);
+    if (idempotencyBytes.byteLength === 0 || idempotencyBytes.byteLength > 512) {
+      throw new Error("Share delivery idempotency key is invalid");
+    }
+    const jtiDigest = new Uint8Array(await crypto.subtle.digest("SHA-256", idempotencyBytes));
     const body = {
       envelope: input.envelope,
+      sealedEnvelope: input.sealedEnvelope,
+      envelopeKey: input.envelopeKey,
       shareCid: input.shareCid,
       recipientEmail: input.recipientEmail,
       shareUrl: input.shareUrl,
       documentName: input.documentName,
-      jti: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+      jti: base64UrlEncode(jtiDigest.slice(0, 16)),
       expiresAt: new Date(input.expiresAt).toISOString().replace(/\.\d{3}Z$/, "Z")
     };
     const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalizeEncryptionJson(body)))));
@@ -22734,7 +22782,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           continue;
         }
         let space;
-        if (service !== "tinycloud.encryption") {
+        if (service !== "tinycloud.encryption" || operation.resource === void 0) {
           if (typeof operation.spaceId !== "string") continue;
           try {
             space = this.resolvePermissionSpace(operation.spaceId, session);
@@ -23279,11 +23327,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return { delegation: delegation2, prompted: true };
     }
-    const granted = parseRecapCapabilities(
-      (siwe) => this.parseRecapWithCaveats(siwe),
-      session.siwe
-    );
-    const { subset, missing } = isCapabilitySubset(expandedEntries, granted);
+    const granted = this.projectSignedRecapCapabilities(session.siwe);
+    const { subset, missing } = this.signedCapabilitySubset(expandedEntries, granted);
     if (!subset) {
       const runtimeOperations = this.permissionEntriesToOperations(expandedEntries, session);
       const runtimeGrant = this.findGrantForOperations(
@@ -23603,7 +23648,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return abilities;
   }
   isEncryptionPermissionEntry(entry) {
-    return entry.service === ENCRYPTION_PERMISSION_SERVICE2 && entry.path.startsWith("urn:tinycloud:encryption:");
+    return entry.service === ENCRYPTION_PERMISSION_SERVICE2 && this.isEncryptionNetworkOperation("encryption", entry.path, entry.space);
   }
   permissionsToRawAbilities(entries) {
     const rawAbilities = {};
@@ -23627,7 +23672,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return entries.flatMap((entry) => {
       const service = this.shortServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId },
         service,
         path: entry.path,
         action,
@@ -23635,13 +23680,21 @@ var _TinyCloudNode = class _TinyCloudNode {
       }));
     });
   }
+  /** Raw network authority cannot be covered by a nested encryption space. */
+  signedCapabilitySubset(requested, granted) {
+    const rawGranted = granted.filter((entry) => this.isEncryptionPermissionEntry(entry)).map((entry) => ({ ...entry, space: "encryption" }));
+    const spaceGranted = granted.filter((entry) => !this.isEncryptionPermissionEntry(entry));
+    const missing = requested.filter((entry) => {
+      const raw = this.isEncryptionPermissionEntry(entry);
+      const comparable = raw ? { ...entry, space: "encryption" } : entry;
+      return !isCapabilitySubset([comparable], raw ? rawGranted : spaceGranted).subset;
+    });
+    return { subset: missing.length === 0, missing };
+  }
   sessionCoversPermissionEntries(session, entries) {
     try {
-      const granted = parseRecapCapabilities(
-        (siwe) => this.parseRecapWithCaveats(siwe),
-        session.siwe
-      );
-      return isCapabilitySubset(entries, granted).subset;
+      const granted = this.projectSignedRecapCapabilities(session.siwe);
+      return this.signedCapabilitySubset(entries, granted).subset;
     } catch {
       return false;
     }
@@ -23651,7 +23704,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const spaceId = this.resolvePermissionSpace(entry.space, session);
       const service = this.shortServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId },
         service,
         path: entry.path,
         action,
@@ -23740,7 +23793,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return resources.flatMap((resource) => {
       const service = this.invocationServiceName(resource.service);
       return resource.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, resource.path) ? { resource: resource.path } : { spaceId: resource.space },
+        ...this.isEncryptionNetworkOperation(service, resource.path, resource.space) ? { resource: resource.path } : { spaceId: resource.space },
         service,
         path: resource.path,
         action,
@@ -23801,7 +23854,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     for (const resource of resources) {
       const service = this.invocationServiceName(resource.service);
-      if (this.isEncryptionNetworkOperation(service, resource.path)) {
+      if (this.isEncryptionNetworkOperation(service, resource.path, resource.space)) {
         rawAbilities[_a = resource.path] ?? (rawAbilities[_a] = []);
         addActions(rawAbilities[resource.path], resource.actions);
         continue;
@@ -23870,21 +23923,15 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return granted.spaceId !== void 0 && requested.spaceId !== void 0 && this.spaceIdsEqual(granted.spaceId, requested.spaceId) && this.pathContains(granted.path, requested.path);
   }
-  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. The embedded
-  // EIP-155 address is case-insensitive, but the CLI canonicalizes it to
-  // lowercase when building a space URI while stored runtime delegations keep
-  // the EIP-55 checksummed form — so a byte-for-byte compare spuriously rejects
-  // an otherwise-valid grant. Lowercase ONLY the `eip155:<chain>:0x<addr>`
-  // segment and leave everything else (crucially the case-sensitive space NAME)
-  // byte-exact. Mirrors the CLI's `normalizeSpaceForCompare` (OPENKEY_SCOPE_MISMATCH fix).
+  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. Compare
+  // only the embedded EIP-155 address without case sensitivity; chain, name,
+  // and all non-PKH space identifiers remain byte-exact.
   spaceIdsEqual(a, b) {
     return this.normalizeSpaceAddress(a) === this.normalizeSpaceAddress(b);
   }
   normalizeSpaceAddress(space) {
-    return space.replace(
-      /(eip155:\d+:)(0x[0-9a-fA-F]{40})/,
-      (_match, prefix, addr) => prefix + addr.toLowerCase()
-    );
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
   }
   actionContains(grantedAction, requestedAction) {
     if (grantedAction === requestedAction) {
@@ -23901,10 +23948,11 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   /** Prefer the v2 caveat-preserving parser while retaining old custom WASM. */
   parseRecapWithCaveats(siwe) {
-    return this.wasmBindings.parseVerifiedRecapFromSiwe?.(siwe) ?? this.wasmBindings.parseRecapFromSiwe(siwe);
+    const verified = this.wasmBindings.parseVerifiedRecapFromSiwe?.(siwe);
+    return verified == null ? this.wasmBindings.parseRecapFromSiwe(siwe) : verifierRecapEntries(verified);
   }
-  isEncryptionNetworkOperation(service, path) {
-    return service === "encryption" && path.startsWith("urn:tinycloud:encryption:");
+  isEncryptionNetworkOperation(service, path, space) {
+    return service === "encryption" && (space === void 0 || space === "encryption") && path.startsWith("urn:tinycloud:encryption:");
   }
   operationFromInvokeAnyEntry(entry) {
     const service = this.invocationServiceName(entry.service);
@@ -23917,7 +23965,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...entry.caveats === void 0 ? {} : { caveats: cloneRecapCaveats(entry.caveats) }
       };
     }
-    if (this.isEncryptionNetworkOperation(service, entry.path)) {
+    if (entry.spaceId === void 0 && this.isEncryptionNetworkOperation(service, entry.path)) {
       return {
         resource: entry.path,
         service,
@@ -24202,8 +24250,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const jwk = mySession.jwk;
     const { abilities, rawAbilities } = this.buildActivationAbilities(delegation);
     const now = /* @__PURE__ */ new Date();
-    const maxExpiry = new Date(now.getTime() + 60 * 60 * 1e3);
-    const expirationTime = delegation.expiry < maxExpiry ? delegation.expiry : maxExpiry;
+    const expirationTime = delegation.expiry;
     const prepared = this.wasmBindings.prepareSession({
       abilities,
       address: this.wasmBindings.ensureEip55(mySession.address),
@@ -24307,8 +24354,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     const now = /* @__PURE__ */ new Date();
-    const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
-    const requestedExpiry = new Date(now.getTime() + expiryMs);
+    const requestedExpiry = params.expiryMs === void 0 ? parentDelegation.expiry : new Date(now.getTime() + params.expiryMs);
     const actualExpiry = requestedExpiry > parentDelegation.expiry ? parentDelegation.expiry : requestedExpiry;
     const abilities = {};
     const rawAbilities = {};
@@ -25113,6 +25159,7 @@ export {
   FileSessionStorage,
   HooksService3 as HooksService,
   IdentityParseError,
+  InvalidRestoredSessionError,
   KVService3 as KVService,
   ManifestValidationError,
   MemorySessionStorage,
@@ -25192,6 +25239,7 @@ export {
   expandActionShortNames,
   expandPermissionEntries2 as expandPermissionEntries,
   expandPermissionEntry,
+  extractSiweExpiration,
   generateRandomReceiverKey,
   getTinyCloudDebugLogs,
   grantAuthRequest,