@tinycloud/node-sdk 3.12.0-beta.2 → 3.12.0-beta.3

package/dist/credentials-core.d.cts

@@ -1,5 +1,5 @@
 import { CredentialFlowDescriptor, CredentialRequirement, CredentialHolderBinding, IssuedCredentialEnvelope, CredentialIssuerMetadata, ClientSession, IKVService, StoredCredentialRecord, VerifiedCredential, CredentialProgressEvent, CredentialStorageReceipt, UnifiedPolicyV2, UnifiedPolicyCapability, PolicyCredentialAdmissionV3 } from '@tinycloud/sdk-core';
-import { V as ValidatedRuntimeDelegation } from './delegation-BQbAuKad.cjs';
+import { V as ValidatedRuntimeDelegation } from './delegation-CeOWDnBB.cjs';
 
 interface CredentialClient {
     readonly sessionDid: string;

package/dist/credentials-core.d.ts

@@ -1,5 +1,5 @@
 import { CredentialFlowDescriptor, CredentialRequirement, CredentialHolderBinding, IssuedCredentialEnvelope, CredentialIssuerMetadata, ClientSession, IKVService, StoredCredentialRecord, VerifiedCredential, CredentialProgressEvent, CredentialStorageReceipt, UnifiedPolicyV2, UnifiedPolicyCapability, PolicyCredentialAdmissionV3 } from '@tinycloud/sdk-core';
-import { V as ValidatedRuntimeDelegation } from './delegation-BQbAuKad.js';
+import { V as ValidatedRuntimeDelegation } from './delegation-CeOWDnBB.js';
 
 interface CredentialClient {
     readonly sessionDid: string;

package/dist/credentials.d.cts

@@ -1,7 +1,7 @@
 export { CredentialAcquisitionTheme, CredentialAcquisitionTransport, CredentialBrowserInteractionAdapter, CredentialClient, CredentialInlineInteractionAdapter, CredentialInputRequest, CredentialInteractionAdapter, CredentialInteractionKind, CredentialInteractionSurface, CredentialProofSubject, CredentialRedirectResumeState, CredentialRedirectStore, CredentialRequestState, CredentialSigningAdapter, CredentialsAcquireOptions, CredentialsEnsureOptions, CredentialsEnsureResult, CredentialsOperationOptions, CredentialsPolicyAdmissionOptions, CredentialsPolicyAdmissionResult, HolderSignatureKey, InlineCredentialProofHandler, InlineCredentialProofRequest, OpenCredentialsHttpTransport, PrimitiveStepHandler, PrimitiveStepResult, ReceiverCredentialCustody, interpretCredentialFlow, mailboxSubject } from './credentials-core.cjs';
 export { D as DEFAULT_EMAIL_PROOF_PROFILE, b as EMAIL_PROOF_CREDENTIAL_TYPE, c as EMAIL_PROOF_PENDING_MAX_MS, d as EmailProofAcquireInput, e as EmailProofAcquisition, f as EmailProofError, g as EmailProofErrorCode, h as EmailProofOptions, a as EmailProofPending, E as EmailProofPendingStore, i as EmailProofProfileId, j as EmailProofRequestInput, k as EmailProofResult, l as EmailProofStep, H as HolderAlgorithm, m as HolderSigner, S as StoredEmailProofInput, n as StoredEmailProofRecord, o as acquireEmailProof, p as completeEmailProof, q as createEd25519HolderSigner, r as createMemoryEmailProofPendingStore, s as emailProofRequirement, t as isTicketEmailProofResult, u as requestEmailProofCode, v as verifyStoredEmailProof } from './email-proof-B4DRizIL.cjs';
 import '@tinycloud/sdk-core';
-import './delegation-BQbAuKad.cjs';
+import './delegation-CeOWDnBB.cjs';
 import '@tinycloud/sdk-core/held-credentials';
 
 /** Production pins. Credentials verify only against these values. Tests pin them literally. */

package/dist/credentials.d.ts

@@ -1,7 +1,7 @@
 export { CredentialAcquisitionTheme, CredentialAcquisitionTransport, CredentialBrowserInteractionAdapter, CredentialClient, CredentialInlineInteractionAdapter, CredentialInputRequest, CredentialInteractionAdapter, CredentialInteractionKind, CredentialInteractionSurface, CredentialProofSubject, CredentialRedirectResumeState, CredentialRedirectStore, CredentialRequestState, CredentialSigningAdapter, CredentialsAcquireOptions, CredentialsEnsureOptions, CredentialsEnsureResult, CredentialsOperationOptions, CredentialsPolicyAdmissionOptions, CredentialsPolicyAdmissionResult, HolderSignatureKey, InlineCredentialProofHandler, InlineCredentialProofRequest, OpenCredentialsHttpTransport, PrimitiveStepHandler, PrimitiveStepResult, ReceiverCredentialCustody, interpretCredentialFlow, mailboxSubject } from './credentials-core.js';
 export { D as DEFAULT_EMAIL_PROOF_PROFILE, b as EMAIL_PROOF_CREDENTIAL_TYPE, c as EMAIL_PROOF_PENDING_MAX_MS, d as EmailProofAcquireInput, e as EmailProofAcquisition, f as EmailProofError, g as EmailProofErrorCode, h as EmailProofOptions, a as EmailProofPending, E as EmailProofPendingStore, i as EmailProofProfileId, j as EmailProofRequestInput, k as EmailProofResult, l as EmailProofStep, H as HolderAlgorithm, m as HolderSigner, S as StoredEmailProofInput, n as StoredEmailProofRecord, o as acquireEmailProof, p as completeEmailProof, q as createEd25519HolderSigner, r as createMemoryEmailProofPendingStore, s as emailProofRequirement, t as isTicketEmailProofResult, u as requestEmailProofCode, v as verifyStoredEmailProof } from './email-proof-B4DRizIL.js';
 import '@tinycloud/sdk-core';
-import './delegation-BQbAuKad.js';
+import './delegation-CeOWDnBB.js';
 import '@tinycloud/sdk-core/held-credentials';
 
 /** Production pins. Credentials verify only against these values. Tests pin them literally. */

package/dist/{delegation-BQbAuKad.d.cts → delegation-CeOWDnBB.d.cts}

@@ -112,11 +112,15 @@ interface RuntimeDelegationActivator {
     useRuntimeDelegation(delegation: PortableDelegation): Promise<void>;
     useDelegation?(delegation: PortableDelegation): Promise<unknown>;
     getRuntimePermissionDelegations(): PortableDelegation[];
+    /** Called only with the verified effective authority of an installed delegation. */
+    refreshRegistryForCapabilities?(permissions: readonly PermissionEntry[]): void;
     /**
      * Verify a wallet-signed session grant issued to this runtime's live session
      * key. Required to activate a CACAO grant; compact UCANs do not use it.
      */
     verifySessionGrant?(grant: SessionGrantProof): VerifiedSessionGrant;
+    /** A verified full-resource registry host; undefined retains no-entry host binding. */
+    resolveRegisteredDelegationHost?(permissions: readonly PermissionEntry[], noEntryHost: string): Promise<string | undefined>;
 }
 /** The installed authority returned by {@link activateValidatedRuntimeDelegation}. */
 interface ValidatedRuntimeDelegation {
@@ -197,6 +201,9 @@ declare function signedCompactUcanExpiry(authorization: string): Date | undefine
  * `options.authorize`, when given, sees the signed capabilities before
  * anything is activated or installed; returning `false` refuses the
  * delegation.
+ *
+ * Typed routing failures propagate unchanged; they do not invalidate the
+ * signed authority or require another approval.
  */
 declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActivator, delegation: PortableDelegation, options: {
     host: string;

package/dist/{delegation-BQbAuKad.d.ts → delegation-CeOWDnBB.d.ts}

@@ -112,11 +112,15 @@ interface RuntimeDelegationActivator {
     useRuntimeDelegation(delegation: PortableDelegation): Promise<void>;
     useDelegation?(delegation: PortableDelegation): Promise<unknown>;
     getRuntimePermissionDelegations(): PortableDelegation[];
+    /** Called only with the verified effective authority of an installed delegation. */
+    refreshRegistryForCapabilities?(permissions: readonly PermissionEntry[]): void;
     /**
      * Verify a wallet-signed session grant issued to this runtime's live session
      * key. Required to activate a CACAO grant; compact UCANs do not use it.
      */
     verifySessionGrant?(grant: SessionGrantProof): VerifiedSessionGrant;
+    /** A verified full-resource registry host; undefined retains no-entry host binding. */
+    resolveRegisteredDelegationHost?(permissions: readonly PermissionEntry[], noEntryHost: string): Promise<string | undefined>;
 }
 /** The installed authority returned by {@link activateValidatedRuntimeDelegation}. */
 interface ValidatedRuntimeDelegation {
@@ -197,6 +201,9 @@ declare function signedCompactUcanExpiry(authorization: string): Date | undefine
  * `options.authorize`, when given, sees the signed capabilities before
  * anything is activated or installed; returning `false` refuses the
  * delegation.
+ *
+ * Typed routing failures propagate unchanged; they do not invalidate the
+ * signed authority or require another approval.
  */
 declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActivator, delegation: PortableDelegation, options: {
     host: string;

package/dist/encryption-keys.d.cts

@@ -1,12 +1,12 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-6_IumWu0.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-Brcu8QoX.cjs';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';
-import './NodeUserAuthorization-B05Wjjpb.cjs';
+import './NodeUserAuthorization-B_TFUlua.cjs';
 import 'events';
-import './delegation-BQbAuKad.cjs';
+import './delegation-CeOWDnBB.cjs';
 
 /**
  * Named encryption keys for a signed-in {@link TinyCloudNode}.

package/dist/encryption-keys.d.ts

@@ -1,12 +1,12 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-CEFGtSWn.js';
+import { T as TinyCloudNode } from './TinyCloudNode-DBJUnsMN.js';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';
-import './NodeUserAuthorization-B05Wjjpb.js';
+import './NodeUserAuthorization-B_TFUlua.js';
 import 'events';
-import './delegation-BQbAuKad.js';
+import './delegation-CeOWDnBB.js';
 
 /**
  * Named encryption keys for a signed-in {@link TinyCloudNode}.