@tinycloud/node-sdk 3.0.0-beta.9 → 3.0.1-beta.0

package/dist/core.d.cts

@@ -1,4 +1,4 @@
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, ParsedSecretCatalogKey, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
-export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, G as serializeDelegation } from './core-BTuD37zN.cjs';
+export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, G as serializeDelegation } from './core-DufYfxi-.cjs';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.d.ts

@@ -1,4 +1,4 @@
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, ParsedSecretCatalogKey, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PkhDidParts, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ResolvedCapabilities, ResolvedDelegate, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
-export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, G as serializeDelegation } from './core-BTuD37zN.js';
+export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, m as RuntimePermissionGrantOptions, S as SecretPermissionHint, n as SecretReadInput, o as SecretReadResult, p as SignStrategy, T as TinyCloudNode, q as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, r as UnifiedOwnerRootReceipt, s as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, W as WasmKeyProvider, t as WasmKeyProviderConfig, u as activateCompactRuntimeDelegation, w as createWasmKeyProvider, x as defaultSignStrategy, y as deserializeDelegation, G as serializeDelegation } from './core-DufYfxi-.js';
 import 'events';
 import '@tinycloud/sdk-services';

package/dist/core.js

@@ -2289,6 +2289,22 @@ function cloneRecapCaveats(caveats) {
     throw new Error("Verified persisted session ReCap contains invalid caveats.");
   }
 }
+function jsonFromVerifier(value) {
+  if (value === void 0) return null;
+  if (Array.isArray(value)) return value.map(jsonFromVerifier);
+  if (value instanceof Map) {
+    const entries = [...value.entries()];
+    if (!entries.every(([key]) => typeof key === "string")) return value;
+    return Object.fromEntries(entries.map(([key, nested]) => [key, jsonFromVerifier(nested)]));
+  }
+  if (value !== null && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+    return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, jsonFromVerifier(nested)]));
+  }
+  return value;
+}
+function verifierRecapEntries(entries) {
+  return entries.map((entry) => Array.isArray(entry.caveats) ? { ...entry, caveats: entry.caveats.map((caveat) => jsonFromVerifier(caveat)) } : entry);
+}
 var ServiceGraphLifetime = class {
   constructor(invokeFn, invokeAnyFn, fetchFn) {
     this.invokeFn = invokeFn;
@@ -2361,18 +2377,23 @@ var UnsupportedSessionRestoreError = class extends Error {
     this.name = "UnsupportedSessionRestoreError";
   }
 };
+var InvalidRestoredSessionError = class extends Error {
+  constructor(message = "Persisted session authority is invalid or expired.") {
+    super(message);
+    this.code = "AUTH_EXPIRED";
+    this.name = "InvalidRestoredSessionError";
+  }
+};
 function canonicalRestoredVerificationMethod(canonicalVerificationMethod, persistedVerificationMethod) {
   if (typeof persistedVerificationMethod !== "string") return void 0;
   const principal = canonicalVerificationMethod.split("#", 1)[0];
   return persistedVerificationMethod === principal || persistedVerificationMethod === canonicalVerificationMethod ? canonicalVerificationMethod : void 0;
 }
 function persistedExpiry(value) {
-  if (typeof value !== "string") {
-    throw new Error("Persisted session without a SIWE expiration must include expiresAt.");
-  }
+  if (typeof value !== "string") throw new InvalidRestoredSessionError("Persisted session must include expiresAt.");
   const expiry = new Date(value);
   if (!Number.isFinite(expiry.getTime()) || expiry.getTime() <= Date.now()) {
-    throw new Error("Persisted session expiry is invalid or expired.");
+    throw new InvalidRestoredSessionError();
   }
   return expiry;
 }
@@ -2915,16 +2936,26 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   getVerifiedSessionCapabilities() {
     const session = this.currentTinyCloudSession();
-    if (!session || !session.siwe) return [];
-    return parseRecapCapabilities(
-      (siwe) => this.parseRecapWithCaveats(siwe),
-      session.siwe
-    ).map((entry) => entry.service === "tinycloud.encryption" ? {
-      service: entry.service,
-      path: entry.path,
-      actions: [...entry.actions],
-      ...entry.caveats === void 0 ? {} : { caveats: entry.caveats }
-    } : entry);
+    return session?.siwe ? this.projectSignedRecapCapabilities(session.siwe) : [];
+  }
+  /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
+  projectSignedRecapCapabilities(siwe) {
+    const projected = this.parseRecapWithCaveats(siwe).map((entry) => {
+      const normalized = parseRecapCapabilities(() => [entry], siwe)[0];
+      if (normalized.service !== "tinycloud.encryption") return normalized;
+      if (!this.isEncryptionNetworkOperation("encryption", entry.path, entry.space)) {
+        return { ...normalized, space: entry.space };
+      }
+      return {
+        service: normalized.service,
+        path: normalized.path,
+        actions: normalized.actions,
+        ...normalized.caveats === void 0 ? {} : { caveats: normalized.caveats }
+      };
+    });
+    return projected.sort(
+      (left, right) => (left.space ?? "").localeCompare(right.space ?? "") || left.service.localeCompare(right.service) || left.path.localeCompare(right.path)
+    );
   }
   /**
    * Get the Ethereum address for this user.
@@ -3379,9 +3410,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * We must keep the full owner-scoped URI so a synthetic primary grant can
    * never cover an operation on a different owner's space.
    *
-   * Mirrors {@link operationsFromDelegation}'s op shape: encryption network
-   * entries (`urn:tinycloud:encryption:` paths) become `resource` ops; every
-   * other entry becomes a `spaceId` op carrying the raw recap `space` URI.
+   * Only top-level encryption network entries (`space: "encryption"` or
+   * absent) become `resource` ops. A network-shaped path nested under a
+   * data space remains a `spaceId` op, not raw network authority.
    * One op per action.
    *
    * Returns `[]` for session-only / restored-without-siwe modes and for any
@@ -3402,7 +3433,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         operations = entries.flatMap((entry) => {
           const service = this.invocationServiceName(entry.service);
           return entry.actions.map((action) => ({
-            ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId: entry.space },
+            ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId: entry.space },
             service,
             path: entry.path,
             action,
@@ -3564,7 +3595,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return;
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        if (/Unauthorized Action|\b401\b/.test(message)) {
+        if (/Unauthorized Action|\b(?:401|403)\b/.test(message)) {
           console.warn(
             "TinyCloud account registry sync stopped: authorization verdict is not retryable",
             error
@@ -3814,9 +3845,14 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   async restoreSession(sessionData) {
     await this.wasmBindings.ensureInitialized?.();
-    const restoredJwk = clonePersistedSessionJwk(sessionData.jwk);
+    let restoredJwk;
+    try {
+      restoredJwk = clonePersistedSessionJwk(sessionData.jwk);
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid private Ed25519 session key.");
+    }
     if (sessionData.chainId !== void 0 && (!Number.isSafeInteger(sessionData.chainId) || sessionData.chainId <= 0)) {
-      throw new Error("Persisted session chain ID must be a positive safe integer.");
+      throw new InvalidRestoredSessionError("Persisted session chain ID must be a positive safe integer.");
     }
     const stagedManager = this.wasmBindings.createSessionManager();
     const stagedReplace = stagedManager.replaceSessionKey;
@@ -3828,32 +3864,31 @@ var _TinyCloudNode = class _TinyCloudNode {
     let stagedKeyId;
     let stagedJwk;
     let canonicalVerificationMethod;
+    const keyIds = liveKeys.call(this.sessionManager);
+    if (!Array.isArray(keyIds) || !keyIds.every((keyId) => typeof keyId === "string")) {
+      throw new UnsupportedSessionRestoreError("it cannot reliably enumerate every live session signer");
+    }
+    for (const keyId of keyIds) {
+      if (keyId === this.sessionKeyId) continue;
+      const jwk = this.sessionManager.jwk(keyId);
+      if (!jwk) throw new Error("missing live session key");
+      stagedReplace.call(stagedManager, clonePersistedSessionJwk(JSON.parse(jwk)), keyId);
+    }
     try {
-      const keyIds = liveKeys.call(this.sessionManager);
-      if (!Array.isArray(keyIds) || !keyIds.every((keyId) => typeof keyId === "string")) {
-        throw new UnsupportedSessionRestoreError("it cannot reliably enumerate every live session signer");
-      }
-      for (const keyId of keyIds) {
-        if (keyId === this.sessionKeyId) continue;
-        const jwk = this.sessionManager.jwk(keyId);
-        if (!jwk) throw new Error("missing live session key");
-        stagedReplace.call(stagedManager, clonePersistedSessionJwk(JSON.parse(jwk)), keyId);
-      }
       stagedKeyId = stagedReplace.call(stagedManager, restoredJwk, this.sessionKeyId);
-      const stagedJwkJson = stagedManager.jwk(stagedKeyId);
-      if (!stagedJwkJson) throw new Error("missing restored session key");
-      stagedJwk = clonePersistedSessionJwk(JSON.parse(stagedJwkJson));
-      canonicalVerificationMethod = stagedManager.getDID(stagedKeyId);
-    } catch (error) {
-      if (error instanceof UnsupportedSessionRestoreError) throw error;
-      throw new Error("Persisted session has an invalid private Ed25519 session key.");
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid private Ed25519 session key.");
     }
+    const stagedJwkJson = stagedManager.jwk(stagedKeyId);
+    if (!stagedJwkJson) throw new Error("missing restored session key");
+    stagedJwk = clonePersistedSessionJwk(JSON.parse(stagedJwkJson));
+    canonicalVerificationMethod = stagedManager.getDID(stagedKeyId);
     const restoredVerificationMethod = canonicalRestoredVerificationMethod(
       canonicalVerificationMethod,
       sessionData.verificationMethod
     );
     if (!restoredVerificationMethod) {
-      throw new Error(
+      throw new InvalidRestoredSessionError(
         "Persisted session verification method does not match its private Ed25519 session key."
       );
     }
@@ -3865,26 +3900,37 @@ var _TinyCloudNode = class _TinyCloudNode {
     ];
     const hasPersistedProof = proofValues.every((value) => value !== void 0);
     if (!hasPersistedProof && (proofValues.some((value) => value !== void 0) || sessionData.expiresAt !== void 0)) {
-      throw new Error("Persisted session authority metadata is incomplete.");
+      throw new InvalidRestoredSessionError("Persisted session authority metadata is incomplete.");
+    }
+    let restoredAddress;
+    try {
+      restoredAddress = hasPersistedProof ? canonicalizeAddress2(sessionData.address) : void 0;
+    } catch {
+      throw new InvalidRestoredSessionError("Persisted session has an invalid wallet address.");
     }
-    const restoredAddress = hasPersistedProof ? canonicalizeAddress2(sessionData.address) : void 0;
     let stagedSessionExpiry = /* @__PURE__ */ new Date(0);
     let stagedRecap = [];
     if (hasPersistedProof) {
       if (typeof this.wasmBindings.validatePersistedSession !== "function") {
         throw new UnsupportedSessionRestoreError("it cannot verify persisted SIWE authority");
       }
-      const verified = this.wasmBindings.validatePersistedSession({
-        delegationHeader: sessionData.delegationHeader,
-        delegationCid: sessionData.delegationCid,
-        spaceId: sessionData.spaceId,
-        jwk: stagedJwk,
-        address: restoredAddress,
-        chainId: sessionData.chainId,
-        siwe: sessionData.siwe,
-        signature: sessionData.signature
-      });
-      const exactRecap = verified.verifiedRecap;
+      const verified = (() => {
+        try {
+          return this.wasmBindings.validatePersistedSession({
+            delegationHeader: sessionData.delegationHeader,
+            delegationCid: sessionData.delegationCid,
+            spaceId: sessionData.spaceId,
+            jwk: stagedJwk,
+            address: restoredAddress,
+            chainId: sessionData.chainId,
+            siwe: sessionData.siwe,
+            signature: sessionData.signature
+          });
+        } catch (error) {
+          throw new InvalidRestoredSessionError(error instanceof Error ? error.message : String(error));
+        }
+      })();
+      const exactRecap = Array.isArray(verified.verifiedRecap) ? verifierRecapEntries(verified.verifiedRecap) : verified.verifiedRecap;
       if (!Array.isArray(exactRecap) || !exactRecap.every(
         (entry) => entry !== null && typeof entry === "object" && typeof entry.service === "string" && typeof entry.space === "string" && typeof entry.path === "string" && Array.isArray(entry.actions) && entry.actions.every((action) => typeof action === "string") && Array.isArray(entry.caveats) && entry.caveats.every(
           (caveat) => caveat !== null && typeof caveat === "object" && !Array.isArray(caveat)
@@ -3904,7 +3950,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const signedExpiry = verified.expiresAt === void 0 ? void 0 : persistedExpiry(verified.expiresAt);
       const persistedPolicyExpiry = sessionData.expiresAt === void 0 ? void 0 : persistedExpiry(sessionData.expiresAt);
       if (signedExpiry && persistedPolicyExpiry && !sameInstant(signedExpiry, persistedPolicyExpiry)) {
-        throw new Error("Persisted session expiry does not match its signed SIWE authority.");
+        throw new InvalidRestoredSessionError("Persisted session expiry does not match its signed SIWE authority.");
       }
       stagedSessionExpiry = signedExpiry ?? persistedPolicyExpiry ?? persistedExpiry(void 0);
     }
@@ -4001,7 +4047,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     operations = recap.flatMap((entry) => {
       const service = this.invocationServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId: entry.space },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId: entry.space },
         service,
         path: entry.path,
         action,
@@ -4097,7 +4143,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const delegations = input.recap.map((entry) => ({
         cid: session.delegationCid,
         delegateDID: session.verificationMethod,
-        spaceId: entry.space,
+        spaceId: this.spaceIdsEqual(entry.space, session.spaceId) ? session.spaceId : entry.space,
         path: entry.path,
         actions: [...entry.actions],
         caveats: cloneRecapCaveats(entry.caveats),
@@ -4787,16 +4833,11 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          let permissionHint;
-          if (response.status === 401 || response.status === 403) {
-            try {
-              const body = await response.json();
-              const record = typeof body === "object" && body !== null ? body : void 0;
-              const nested = typeof record?.error === "object" && record.error !== null ? record.error : void 0;
-              permissionHint = parsePermissionHint(record?.permissionHint) ?? parsePermissionHint(nested?.permissionHint);
-            } catch {
-            }
-          }
+          const permissionHint = response.status === 401 || response.status === 403 ? parsePermissionHint({
+            service: "tinycloud.encryption",
+            path: networkId,
+            actions: ["tinycloud.encryption/decrypt"]
+          }) : void 0;
           throw new DecryptTransportResponseError(response.status, permissionHint);
         }
         return await response.json();
@@ -5235,13 +5276,20 @@ var _TinyCloudNode = class _TinyCloudNode {
     const session = this.currentTinyCloudSession();
     const serviceSession = this._serviceContext?.session;
     if (!session || !serviceSession) throw new Error("Share delivery requires an authenticated session");
+    const idempotencyBytes = new TextEncoder().encode(input.idempotencyKey);
+    if (idempotencyBytes.byteLength === 0 || idempotencyBytes.byteLength > 512) {
+      throw new Error("Share delivery idempotency key is invalid");
+    }
+    const jtiDigest = new Uint8Array(await crypto.subtle.digest("SHA-256", idempotencyBytes));
     const body = {
       envelope: input.envelope,
+      sealedEnvelope: input.sealedEnvelope,
+      envelopeKey: input.envelopeKey,
       shareCid: input.shareCid,
       recipientEmail: input.recipientEmail,
       shareUrl: input.shareUrl,
       documentName: input.documentName,
-      jti: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+      jti: base64UrlEncode(jtiDigest.slice(0, 16)),
       expiresAt: new Date(input.expiresAt).toISOString().replace(/\.\d{3}Z$/, "Z")
     };
     const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalizeEncryptionJson(body)))));
@@ -5724,7 +5772,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           continue;
         }
         let space;
-        if (service !== "tinycloud.encryption") {
+        if (service !== "tinycloud.encryption" || operation.resource === void 0) {
           if (typeof operation.spaceId !== "string") continue;
           try {
             space = this.resolvePermissionSpace(operation.spaceId, session);
@@ -6269,11 +6317,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return { delegation: delegation2, prompted: true };
     }
-    const granted = parseRecapCapabilities(
-      (siwe) => this.parseRecapWithCaveats(siwe),
-      session.siwe
-    );
-    const { subset, missing } = isCapabilitySubset(expandedEntries, granted);
+    const granted = this.projectSignedRecapCapabilities(session.siwe);
+    const { subset, missing } = this.signedCapabilitySubset(expandedEntries, granted);
     if (!subset) {
       const runtimeOperations = this.permissionEntriesToOperations(expandedEntries, session);
       const runtimeGrant = this.findGrantForOperations(
@@ -6593,7 +6638,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return abilities;
   }
   isEncryptionPermissionEntry(entry) {
-    return entry.service === ENCRYPTION_PERMISSION_SERVICE2 && entry.path.startsWith("urn:tinycloud:encryption:");
+    return entry.service === ENCRYPTION_PERMISSION_SERVICE2 && this.isEncryptionNetworkOperation("encryption", entry.path, entry.space);
   }
   permissionsToRawAbilities(entries) {
     const rawAbilities = {};
@@ -6617,7 +6662,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return entries.flatMap((entry) => {
       const service = this.shortServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId },
         service,
         path: entry.path,
         action,
@@ -6625,13 +6670,21 @@ var _TinyCloudNode = class _TinyCloudNode {
       }));
     });
   }
+  /** Raw network authority cannot be covered by a nested encryption space. */
+  signedCapabilitySubset(requested, granted) {
+    const rawGranted = granted.filter((entry) => this.isEncryptionPermissionEntry(entry)).map((entry) => ({ ...entry, space: "encryption" }));
+    const spaceGranted = granted.filter((entry) => !this.isEncryptionPermissionEntry(entry));
+    const missing = requested.filter((entry) => {
+      const raw = this.isEncryptionPermissionEntry(entry);
+      const comparable = raw ? { ...entry, space: "encryption" } : entry;
+      return !isCapabilitySubset([comparable], raw ? rawGranted : spaceGranted).subset;
+    });
+    return { subset: missing.length === 0, missing };
+  }
   sessionCoversPermissionEntries(session, entries) {
     try {
-      const granted = parseRecapCapabilities(
-        (siwe) => this.parseRecapWithCaveats(siwe),
-        session.siwe
-      );
-      return isCapabilitySubset(entries, granted).subset;
+      const granted = this.projectSignedRecapCapabilities(session.siwe);
+      return this.signedCapabilitySubset(entries, granted).subset;
     } catch {
       return false;
     }
@@ -6641,7 +6694,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       const spaceId = this.resolvePermissionSpace(entry.space, session);
       const service = this.shortServiceName(entry.service);
       return entry.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, entry.path) ? { resource: entry.path } : { spaceId },
+        ...this.isEncryptionNetworkOperation(service, entry.path, entry.space) ? { resource: entry.path } : { spaceId },
         service,
         path: entry.path,
         action,
@@ -6730,7 +6783,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return resources.flatMap((resource) => {
       const service = this.invocationServiceName(resource.service);
       return resource.actions.map((action) => ({
-        ...this.isEncryptionNetworkOperation(service, resource.path) ? { resource: resource.path } : { spaceId: resource.space },
+        ...this.isEncryptionNetworkOperation(service, resource.path, resource.space) ? { resource: resource.path } : { spaceId: resource.space },
         service,
         path: resource.path,
         action,
@@ -6791,7 +6844,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     for (const resource of resources) {
       const service = this.invocationServiceName(resource.service);
-      if (this.isEncryptionNetworkOperation(service, resource.path)) {
+      if (this.isEncryptionNetworkOperation(service, resource.path, resource.space)) {
         rawAbilities[_a = resource.path] ?? (rawAbilities[_a] = []);
         addActions(rawAbilities[resource.path], resource.actions);
         continue;
@@ -6860,21 +6913,15 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return granted.spaceId !== void 0 && requested.spaceId !== void 0 && this.spaceIdsEqual(granted.spaceId, requested.spaceId) && this.pathContains(granted.path, requested.path);
   }
-  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. The embedded
-  // EIP-155 address is case-insensitive, but the CLI canonicalizes it to
-  // lowercase when building a space URI while stored runtime delegations keep
-  // the EIP-55 checksummed form — so a byte-for-byte compare spuriously rejects
-  // an otherwise-valid grant. Lowercase ONLY the `eip155:<chain>:0x<addr>`
-  // segment and leave everything else (crucially the case-sensitive space NAME)
-  // byte-exact. Mirrors the CLI's `normalizeSpaceForCompare` (OPENKEY_SCOPE_MISMATCH fix).
+  // Space IDs are `tinycloud:pkh:eip155:<chain>:<0xADDR>:<name>`. Compare
+  // only the embedded EIP-155 address without case sensitivity; chain, name,
+  // and all non-PKH space identifiers remain byte-exact.
   spaceIdsEqual(a, b) {
     return this.normalizeSpaceAddress(a) === this.normalizeSpaceAddress(b);
   }
   normalizeSpaceAddress(space) {
-    return space.replace(
-      /(eip155:\d+:)(0x[0-9a-fA-F]{40})/,
-      (_match, prefix, addr) => prefix + addr.toLowerCase()
-    );
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
   }
   actionContains(grantedAction, requestedAction) {
     if (grantedAction === requestedAction) {
@@ -6891,10 +6938,11 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   /** Prefer the v2 caveat-preserving parser while retaining old custom WASM. */
   parseRecapWithCaveats(siwe) {
-    return this.wasmBindings.parseVerifiedRecapFromSiwe?.(siwe) ?? this.wasmBindings.parseRecapFromSiwe(siwe);
+    const verified = this.wasmBindings.parseVerifiedRecapFromSiwe?.(siwe);
+    return verified == null ? this.wasmBindings.parseRecapFromSiwe(siwe) : verifierRecapEntries(verified);
   }
-  isEncryptionNetworkOperation(service, path) {
-    return service === "encryption" && path.startsWith("urn:tinycloud:encryption:");
+  isEncryptionNetworkOperation(service, path, space) {
+    return service === "encryption" && (space === void 0 || space === "encryption") && path.startsWith("urn:tinycloud:encryption:");
   }
   operationFromInvokeAnyEntry(entry) {
     const service = this.invocationServiceName(entry.service);
@@ -6907,7 +6955,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...entry.caveats === void 0 ? {} : { caveats: cloneRecapCaveats(entry.caveats) }
       };
     }
-    if (this.isEncryptionNetworkOperation(service, entry.path)) {
+    if (entry.spaceId === void 0 && this.isEncryptionNetworkOperation(service, entry.path)) {
       return {
         resource: entry.path,
         service,
@@ -7192,8 +7240,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const jwk = mySession.jwk;
     const { abilities, rawAbilities } = this.buildActivationAbilities(delegation);
     const now = /* @__PURE__ */ new Date();
-    const maxExpiry = new Date(now.getTime() + 60 * 60 * 1e3);
-    const expirationTime = delegation.expiry < maxExpiry ? delegation.expiry : maxExpiry;
+    const expirationTime = delegation.expiry;
     const prepared = this.wasmBindings.prepareSession({
       abilities,
       address: this.wasmBindings.ensureEip55(mySession.address),
@@ -7297,8 +7344,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     const now = /* @__PURE__ */ new Date();
-    const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
-    const requestedExpiry = new Date(now.getTime() + expiryMs);
+    const requestedExpiry = params.expiryMs === void 0 ? parentDelegation.expiry : new Date(now.getTime() + params.expiryMs);
     const actualExpiry = requestedExpiry > parentDelegation.expiry ? parentDelegation.expiry : requestedExpiry;
     const abilities = {};
     const rawAbilities = {};
@@ -7818,6 +7864,7 @@ export {
   DuckDbService3 as DuckDbService,
   FileSessionStorage,
   IdentityParseError,
+  InvalidRestoredSessionError,
   KVService3 as KVService,
   ManifestValidationError,
   MemorySessionStorage,