@tinycloud/node-sdk 3.2.0-beta.4 → 3.2.0-beta.6

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, CapabilityPresentationEnvelopeV1, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGrantInfo, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, appSecretScope, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, isStorageFullError, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, l as RestorableSession, m as RuntimeDelegationActivator, n as RuntimeDelegationRejectedError, o as RuntimeDelegationRejection, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, s as SessionGrantProof, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, x as VerifiedSessionGrant, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, G as activateValidatedRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, L as grantAuthRequest, Q as serializeDelegation, X as signedCompactUcanExpiry } from './WasmKeyProvider-DjfRu9aL.cjs';
+export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, l as RestorableSession, m as RuntimeDelegationActivator, n as RuntimeDelegationRejectedError, o as RuntimeDelegationRejection, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, s as SessionGrantProof, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, x as VerifiedSessionGrant, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, G as activateValidatedRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, L as grantAuthRequest, Q as serializeDelegation, X as signedCompactUcanExpiry, Y as siweRuntimeDelegation } from './WasmKeyProvider-C3NFgOmv.cjs';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import { KVReplicaStorage } from '@tinycloud/sdk-services';
 import 'events';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, CapabilityPresentationEnvelopeV1, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGrantInfo, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, appSecretScope, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, isStorageFullError, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, l as RestorableSession, m as RuntimeDelegationActivator, n as RuntimeDelegationRejectedError, o as RuntimeDelegationRejection, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, s as SessionGrantProof, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, x as VerifiedSessionGrant, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, G as activateValidatedRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, L as grantAuthRequest, Q as serializeDelegation, X as signedCompactUcanExpiry } from './WasmKeyProvider-DjfRu9aL.js';
+export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, l as RestorableSession, m as RuntimeDelegationActivator, n as RuntimeDelegationRejectedError, o as RuntimeDelegationRejection, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, s as SessionGrantProof, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, x as VerifiedSessionGrant, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, G as activateValidatedRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, L as grantAuthRequest, Q as serializeDelegation, X as signedCompactUcanExpiry, Y as siweRuntimeDelegation } from './WasmKeyProvider-C3NFgOmv.js';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import { KVReplicaStorage } from '@tinycloud/sdk-services';
 import 'events';

package/dist/index.js

@@ -17036,7 +17036,7 @@ var require_utils2 = __commonJS({
 });
 
 // src/replication/config.ts
-import { kvPrefixCovers } from "@tinycloud/sdk-services";
+import { assertFolderPrefix as assertPureFolderPrefix, kvPrefixCovers } from "@tinycloud/sdk-services/kv/replication/prefix";
 function assertValidReplicationConfig(replication) {
   if (replication === void 0 || replication.enabled !== true) return;
   if (replication.storage === void 0 || replication.storage === null) {
@@ -17046,8 +17046,10 @@ function assertValidReplicationConfig(replication) {
     throw new TypeError("replication.prefixes must be a non-empty array");
   }
   for (const prefix of replication.prefixes) {
-    if (typeof prefix !== "string" || prefix === "") {
-      throw new TypeError("replication.prefixes must not contain an empty prefix");
+    try {
+      assertPureFolderPrefix(prefix);
+    } catch (error) {
+      throw new TypeError(error instanceof Error ? error.message : String(error));
     }
   }
   for (const [index, prefix] of replication.prefixes.entries()) {
@@ -17058,7 +17060,7 @@ function assertValidReplicationConfig(replication) {
         );
       }
     }
-    if (prefix.split("/", 1)[0] === "vault" && replication.allowSecrets !== true) {
+    if ((prefix === "/" || prefix.split("/", 1)[0] === "vault") && replication.allowSecrets !== true) {
       throw new TypeError(
         `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`
       );
@@ -17073,15 +17075,14 @@ var init_config = __esm({
 
 // src/replication/authority-sign-in.ts
 import {
-  grantPathsForSelector,
   KV,
   isCapabilitySubset
 } from "@tinycloud/sdk-core";
 import { requiresSecretsOptIn } from "@tinycloud/sdk-services";
+import { assertFolderPrefix } from "@tinycloud/sdk-services/kv/replication/prefix";
 function hasUnrestrictedGetCoverage(entries, spaceId, prefix) {
-  const requiredPaths = grantPathsForSelector(prefix);
   return isCapabilitySubset(
-    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),
+    [{ service: KV_SERVICE, space: spaceId, path: prefix, actions: [KV_GET] }],
     [...entries]
   ).subset;
 }
@@ -17089,21 +17090,33 @@ function augmentSignInEntriesWithReplication(input) {
   const out = [];
   const replication = input.replication;
   if (replication === void 0) return out;
+  const eligiblePaths = [];
   for (const prefix of replication.prefixes) {
+    assertFolderPrefix(prefix);
+    const path = prefix === "/" ? "" : prefix;
     if (requiresSecretsOptIn(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
       continue;
     }
-    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {
+    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {
       continue;
     }
-    for (const path of grantPathsForSelector(prefix)) {
-      out.push({
-        service: KV_SERVICE,
-        space: input.primarySpaceId,
-        path,
-        actions: [KV_GET, KV_SYNC]
-      });
-    }
+    eligiblePaths.push(path);
+  }
+  if (eligiblePaths.length === replication.prefixes.length && eligiblePaths.length > 0 && hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, "")) {
+    return [{
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path: "",
+      actions: [KV_GET, KV_SYNC]
+    }];
+  }
+  for (const path of eligiblePaths) {
+    out.push({
+      service: KV_SERVICE,
+      space: input.primarySpaceId,
+      path,
+      actions: [KV_GET, KV_SYNC]
+    });
   }
   return out;
 }
@@ -17265,6 +17278,7 @@ var init_runtime = __esm({
             scheduler: this.clock,
             emit,
             fetch: context.fetch,
+            nodeFeatures: input.nodeFeatures,
             previous: previousClose
           });
           this.current = controller;
@@ -17326,7 +17340,6 @@ __export(authority_exports, {
   ucanAttUnconstrainedFor: () => ucanAttUnconstrainedFor
 });
 import {
-  grantPathsForSelector as grantPathsForSelector2,
   actionContains,
   KV as KV4,
   canonicalizeRecapCaveats as canonicalizeRecapCaveats3,
@@ -17335,12 +17348,12 @@ import {
 } from "@tinycloud/sdk-core";
 import { parseUcanGrant as replicaParseUcanGrant } from "@tinycloud/replica";
 function replicationEntries(spaceId, prefix) {
-  return grantPathsForSelector2(prefix).map((path) => ({
+  return [{
     service: KV_SERVICE2,
     space: spaceId,
-    path,
+    path: prefix === "/" ? "" : prefix,
     actions: [KV_GET2, KV_SYNC2]
-  }));
+  }];
 }
 function caveatBranchesUnconstrained(value) {
   if (value === void 0 || value === null) return true;
@@ -17355,28 +17368,28 @@ function caveatBranchesUnconstrained(value) {
   }
 }
 function kvPathInResource(resource, space) {
+  for (const root of [`${space}/kv`, `tinycloud://${space}/kv`]) {
+    if (resource === root || resource === `${root}/`) return "/";
+  }
   for (const base2 of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {
     if (resource.startsWith(base2)) return resource.slice(base2.length);
   }
   return void 0;
 }
 function ucanAttCovers(att, space, prefix, ability, options) {
-  const requiredPaths = prefix.endsWith("/") ? [prefix] : [prefix, `${prefix}/`];
-  return requiredPaths.every((requestedPath) => {
-    for (const [resource, abilities] of Object.entries(att)) {
-      const path = kvPathInResource(resource, space);
-      if (path === void 0) continue;
-      for (const [granted, caveats] of Object.entries(abilities)) {
-        if (!actionContains(granted, ability)) continue;
-        if (!isCapabilitySubset3(
-          [{ service: KV_SERVICE2, space, path: requestedPath, actions: [ability] }],
-          [{ service: KV_SERVICE2, space, path, actions: [granted] }]
-        ).subset) continue;
-        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
-      }
+  for (const [resource, abilities] of Object.entries(att)) {
+    const path = kvPathInResource(resource, space);
+    if (path === void 0) continue;
+    for (const [granted, caveats] of Object.entries(abilities)) {
+      if (!actionContains(granted, ability)) continue;
+      if (!isCapabilitySubset3(
+        [{ service: KV_SERVICE2, space, path: prefix, actions: [ability] }],
+        [{ service: KV_SERVICE2, space, path, actions: [granted] }]
+      ).subset) continue;
+      if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
     }
-    return false;
-  });
+  }
+  return false;
 }
 function ucanAttUnconstrainedFor(att, space, prefix) {
   return ucanAttCovers(att, space, prefix, KV_GET2) && ucanAttCovers(att, space, prefix, KV_SYNC2);
@@ -17391,7 +17404,7 @@ function replicationScopeFromSignedSession(input) {
   const bareDid = (value) => value.split("#", 1)[0];
   if (grant.cid !== input.delegationCid || bareDid(grant.audience) !== bareDid(input.verificationMethod)) return void 0;
   for (const resource of Object.keys(grant.att)) {
-    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv\//)?.[1];
+    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv(?:\/|$)/)?.[1];
     if (space !== input.persistedSpace) continue;
     const owner = parseSpaceUri2(space);
     if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };
@@ -18099,18 +18112,45 @@ async function activateCompactRuntimeDelegation(node, input) {
     throw new Error("Compact runtime delegation CID does not match authorization bytes.");
   }
   const signed2 = signedAuthorityFromCompactUcan(authorization);
+  return activateValidatedRuntimeDelegation(
+    node,
+    portableFromSignedAuthority(cid, authorization, signed2, input),
+    { host: input.host }
+  );
+}
+function siweRuntimeDelegation(node, input) {
+  const cid = node.computeDelegationCid(input.authorization);
+  if (cid !== input.cid) {
+    throw new Error("SIWE runtime delegation CID does not match authorization bytes.");
+  }
+  const proof = { siwe: input.siwe, signature: input.signature };
+  const signed2 = signedAuthorityFromSessionGrant(
+    node,
+    { siweProof: proof, spaceId: input.spaceId, ownerAddress: input.ownerAddress, chainId: input.chainId },
+    input.authorization,
+    cid
+  );
+  if (signed2.expiry.getTime() <= Date.now()) {
+    reject("expired", "Runtime delegation is expired.");
+  }
+  return {
+    ...portableFromSignedAuthority(cid, input.authorization, signed2, input),
+    siweProof: proof
+  };
+}
+function portableFromSignedAuthority(cid, authorization, signed2, transport) {
   const primary = signed2.resources[0];
   const signedSpace = signed2.permissions.find(
     (permission) => permission.service !== "tinycloud.encryption"
   )?.space;
-  const delegation = {
+  return {
     cid,
     delegationHeader: { Authorization: authorization },
-    ownerAddress: input.ownerAddress,
-    chainId: input.chainId,
+    ownerAddress: transport.ownerAddress,
+    chainId: transport.chainId,
     delegatorDID: signed2.issuer,
     authHeader: authorization,
-    spaceId: signedSpace ?? primary.space,
+    spaceId: signedSpace ?? transport.spaceId ?? primary.space,
     path: primary.path,
     actions: [...primary.actions],
     ...primary.caveats === void 0 ? {} : { caveats: primary.caveats },
@@ -18120,11 +18160,8 @@ async function activateCompactRuntimeDelegation(node, input) {
     })),
     expiry: new Date(signed2.expiry),
     delegateDID: signed2.audience,
-    host: normalizedHost(input.host)
+    host: normalizedHost(transport.host)
   };
-  return activateValidatedRuntimeDelegation(node, delegation, {
-    host: input.host
-  });
 }
 async function grantAuthRequest(authority, request, options) {
   if (request.kind !== "tinycloud.auth.request") {
@@ -18185,6 +18222,8 @@ function getNodeReplicationLoaders() {
 // src/TinyCloudNode.ts
 import {
   TinyCloud,
+  checkNodeInfo as checkNodeInfo2,
+  VersionCheckError,
   activateSessionWithHost as activateSessionWithHost2,
   authorizationVerdictOf,
   httpResponseError,
@@ -18426,6 +18465,7 @@ var NodeUserAuthorization = class {
     this.activeSessionKeyId = "default";
     this.extensions = [];
     this._nodeFeatures = [];
+    this._nodeFeaturesKnown = false;
     this._lastActivationSkippedSpaceIds = [];
     this.wasm = config.wasmBindings;
     this.signer = config.signer;
@@ -18549,8 +18589,11 @@ var NodeUserAuthorization = class {
     }
   }
   /** @internal Atomically adopt the state staged by TinyCloudNode.restoreSession. */
-  installRestoredSession(sessionManager, session, hosts) {
+  installRestoredSession(sessionManager, session, hosts, nodeFeatures) {
     this.sessionManager = sessionManager;
+    this._nodeFeatures = nodeFeatures === void 0 ? [] : [...nodeFeatures];
+    this._nodeFeaturesKnown = nodeFeatures !== void 0;
+    this._nodeInfoIdentity = void 0;
     this.tinycloudHosts = hosts && hosts.length > 0 ? [...hosts] : void 0;
     this._lastActivationSkippedSpaceIds = [];
     if (!session) {
@@ -18625,6 +18668,16 @@ var NodeUserAuthorization = class {
   get nodeFeatures() {
     return this._nodeFeatures;
   }
+  get nodeFeaturesKnown() {
+    return this._nodeFeaturesKnown;
+  }
+  async refreshNodeInfo() {
+    const infoHost = this.primaryTinyCloudHost;
+    const nodeInfo = await checkNodeInfo(infoHost, this.wasm.protocolVersion());
+    this._nodeFeatures = nodeInfo.features;
+    this._nodeFeaturesKnown = true;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+  }
   /**
    * The node DID reported by `GET /info` for `host`, if the sign-in (or
    * restore) that populated it targeted that same host. Returns `undefined`
@@ -19288,13 +19341,7 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await checkNodeInfo(
-      infoHost,
-      this.wasm.protocolVersion()
-    );
-    this._nodeFeatures = nodeInfo.features;
-    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+    await this.refreshNodeInfo();
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -19460,13 +19507,7 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await checkNodeInfo(
-      infoHost,
-      this.wasm.protocolVersion()
-    );
-    this._nodeFeatures = nodeInfo.features;
-    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
+    await this.refreshNodeInfo();
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -21049,7 +21090,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this._bootstrapStatus;
   }
   get nodeFeatures() {
-    return this.auth?.nodeFeatures ?? [];
+    return this.auth?.nodeFeatures ?? this._restoredNodeFeatures ?? [];
+  }
+  get replicationNodeFeatures() {
+    if (this.auth) return this.auth.nodeFeaturesKnown ? this.auth.nodeFeatures : void 0;
+    return this._restoredNodeFeatures;
   }
   /** SIWE domain — uses config override or defaults to app.tinycloud.xyz */
   get siweDomain() {
@@ -22402,6 +22447,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionData.chainId
     );
     const stagedHost = resolvedHost ?? this.config.host;
+    let restoredNodeFeatures;
+    if (this.config.replication?.enabled) {
+      try {
+        restoredNodeFeatures = (await checkNodeInfo2(stagedHost, this.wasmBindings.protocolVersion())).features;
+      } catch (error) {
+        if (!(error instanceof VersionCheckError)) throw error;
+      }
+    }
     const stagedAddress = restoredAddress;
     const stagedChainId = sessionData.chainId ?? 1;
     let replicationPrincipal;
@@ -22504,8 +22557,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
     this.confirmedHostedSpaceIds.clear();
+    this._restoredNodeFeatures = restoredNodeFeatures;
     if (this.auth) {
-      this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost]);
+      this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost], restoredNodeFeatures);
       this._restoredTcSession = void 0;
     } else {
       this._restoredTcSession = stagedTcSession;
@@ -25079,6 +25133,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       session,
       principal: identityPrincipal,
       authority,
+      nodeFeatures: this.replicationNodeFeatures,
       primaryKV: [{ space: session.spaceId, kv }]
     });
   }
@@ -26526,9 +26581,9 @@ import {
 } from "@tinycloud/sdk-core";
 import {
   ProtocolMismatchError,
-  VersionCheckError,
+  VersionCheckError as VersionCheckError2,
   UnsupportedFeatureError as UnsupportedFeatureError2,
-  checkNodeInfo as checkNodeInfo2
+  checkNodeInfo as checkNodeInfo3
 } from "@tinycloud/sdk-core";
 import { ServiceContext as ServiceContext4 } from "@tinycloud/sdk-core";
 
@@ -27447,7 +27502,7 @@ export {
   VAULT_PERMISSION_SERVICE,
   VaultHeaders,
   VaultPublicSpaceKVActions,
-  VersionCheckError,
+  VersionCheckError2 as VersionCheckError,
   WasmKeyProvider,
   activateCompactRuntimeDelegation,
   activateValidatedRuntimeDelegation,
@@ -27468,7 +27523,7 @@ export {
   canonicalizeNetworkId,
   canonicalizeSecretScope,
   checkDecryptInvocationInput,
-  checkNodeInfo2 as checkNodeInfo,
+  checkNodeInfo3 as checkNodeInfo,
   clearTinyCloudDebugLogs,
   composeManifestRequest2 as composeManifestRequest,
   createCapabilityKeyRegistry,
@@ -27528,6 +27583,7 @@ export {
   resourceCapabilitiesToSpaceAbilitiesMap2 as resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation,
   signedCompactUcanExpiry,
+  siweRuntimeDelegation,
   sqliteReplicaStorage,
   tinyCloudDebugLogger,
   validateEnvelope,