@tinycloud/node-sdk 3.2.1-beta.0 → 3.2.1

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, CapabilityPresentationEnvelopeV1, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IStorageService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGrantInfo, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, StoredDelegationChain, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, appSecretScope, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, isStorageFullError, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, l as RestorableSession, m as RuntimeDelegationActivator, n as RuntimeDelegationRejectedError, o as RuntimeDelegationRejection, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, s as SessionGrantProof, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, x as VerifiedSessionGrant, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, G as activateValidatedRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, L as grantAuthRequest, Q as serializeDelegation, X as signedCompactUcanExpiry, Y as siweRuntimeDelegation } from './WasmKeyProvider-6_YwgSkd.cjs';
+export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, l as RestorableSession, m as RuntimeDelegationActivator, n as RuntimeDelegationRejectedError, o as RuntimeDelegationRejection, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, s as SessionGrantProof, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, x as VerifiedSessionGrant, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, G as activateValidatedRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, L as grantAuthRequest, Q as serializeDelegation, X as signedCompactUcanExpiry, Y as siweRuntimeDelegation } from './WasmKeyProvider-DRlOpvpG.cjs';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import { KVReplicaStorage } from '@tinycloud/sdk-services';
 import 'events';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ISigner, Bytes, CapabilityPresentationEnvelopeV1, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IStorageService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGrantInfo, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, StoredDelegationChain, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, appSecretScope, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, isStorageFullError, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, l as RestorableSession, m as RuntimeDelegationActivator, n as RuntimeDelegationRejectedError, o as RuntimeDelegationRejection, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, s as SessionGrantProof, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, x as VerifiedSessionGrant, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, G as activateValidatedRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, L as grantAuthRequest, Q as serializeDelegation, X as signedCompactUcanExpiry, Y as siweRuntimeDelegation } from './WasmKeyProvider-6_YwgSkd.js';
+export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, F as FileSessionStorage, I as InvalidRestoredSessionError, M as MemorySessionStorage, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, l as RestorableSession, m as RuntimeDelegationActivator, n as RuntimeDelegationRejectedError, o as RuntimeDelegationRejection, p as RuntimePermissionGrantOptions, S as SecretPermissionHint, q as SecretReadInput, r as SecretReadResult, s as SessionGrantProof, t as SignStrategy, T as TinyCloudNode, u as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, v as UnifiedOwnerRootReceipt, w as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, x as VerifiedSessionGrant, W as WasmKeyProvider, y as WasmKeyProviderConfig, z as activateCompactRuntimeDelegation, G as activateValidatedRuntimeDelegation, H as createWasmKeyProvider, J as defaultSignStrategy, K as deserializeDelegation, L as grantAuthRequest, Q as serializeDelegation, X as signedCompactUcanExpiry, Y as siweRuntimeDelegation } from './WasmKeyProvider-DRlOpvpG.js';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
 import { KVReplicaStorage } from '@tinycloud/sdk-services';
 import 'events';

package/dist/index.js

@@ -18476,6 +18476,11 @@ var NodeUserAuthorization = class {
     this._nodeFeatures = [];
     this._nodeFeaturesKnown = false;
     this._lastActivationSkippedSpaceIds = [];
+    /**
+     * Spaces the sign-in activation reported hosted. Only the first POST of a
+     * delegation lists them: the node answers a repeat with empty lists.
+     */
+    this._lastActivationActivatedSpaceIds = [];
     this.wasm = config.wasmBindings;
     this.signer = config.signer;
     this.signStrategy = config.signStrategy ?? defaultSignStrategy;
@@ -18605,6 +18610,7 @@ var NodeUserAuthorization = class {
     this._nodeInfoIdentity = void 0;
     this.tinycloudHosts = hosts && hosts.length > 0 ? [...hosts] : void 0;
     this._lastActivationSkippedSpaceIds = [];
+    this._lastActivationActivatedSpaceIds = [];
     if (!session) {
       this._session = void 0;
       this._tinyCloudSession = void 0;
@@ -18699,6 +18705,9 @@ var NodeUserAuthorization = class {
   get lastActivationSkippedSpaceIds() {
     return [...this._lastActivationSkippedSpaceIds];
   }
+  get lastActivationActivatedSpaceIds() {
+    return [...this._lastActivationActivatedSpaceIds];
+  }
   /**
    * Compute the `abilities` map the WASM `prepareSession` call should
    * see at sign-in time.
@@ -19194,8 +19203,10 @@ var NodeUserAuthorization = class {
   recordActivationSkippedSpaces(result, primarySpaceId) {
     if (result.success) {
       this._lastActivationSkippedSpaceIds = result.skipped ?? [];
+      this._lastActivationActivatedSpaceIds = result.activated ?? [];
       return;
     }
+    this._lastActivationActivatedSpaceIds = [];
     this._lastActivationSkippedSpaceIds = result.status === 404 ? [primarySpaceId] : [];
   }
   async createBootstrapSession(options) {
@@ -20941,10 +20952,26 @@ var _TinyCloudNode = class _TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
+    /**
+     * Owned space ids known to be hosted for the current session: the sign-in
+     * activation listed them as `activated`, or this session hosted them. Unlike
+     * {@link confirmedHostedSpaceIds}, nothing here is inferred from a space being
+     * merely absent from `skipped`. Read by {@link ensureOwnedSpaceHosted}.
+     */
+    this.hostedOwnedSpaceIds = /* @__PURE__ */ new Set();
+    /**
+     * In-flight host delegations, so concurrent callers share one approval per
+     * space. `waiters` counts callers still waiting; the request is cancelled
+     * once every caller with a signal has aborted and none waits without one.
+     */
+    this.ownedSpaceHosts = /* @__PURE__ */ new Map();
     /** Serializes account-registry writes for the active node instance. */
     this.accountRegistryTail = Promise.resolve();
-    /** Bounds best-effort registry work on the sign-in critical path. */
-    this.accountRegistryDeadlineMs = 4e3;
+    /**
+     * Hang guard for the background registry sync. It is off the sign-in path,
+     * so it must outlast a slow but healthy sync (9–18 s on prod 1.20.2, TC-998).
+     */
+    this.accountRegistryDeadlineMs = 3e4;
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -21539,6 +21566,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         "Cannot signIn() in session-only mode. Provide a privateKey in config to create your own space."
       );
     }
+    this.pendingAccountRegistrySync?.controller.abort();
     await this.accountRegistryTail;
     await this.wasmBindings.ensureInitialized?.();
     const address = canonicalizeAddress2(await this.signer.getAddress());
@@ -21559,8 +21587,13 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
     this.confirmedHostedSpaceIds.clear();
+    this.hostedOwnedSpaceIds.clear();
     await this.tc.signIn(options);
+    this.cancelOwnedSpaceHosts();
     this.syncResolvedHostFromAuth();
+    for (const spaceId of this.auth.lastActivationActivatedSpaceIds ?? []) {
+      this.hostedOwnedSpaceIds.add(spaceId);
+    }
     this.replicationDelegateSession = void 0;
     this.replicationScopeError = void 0;
     if (this.replicationRuntime) await (await this.replicationRuntime).unbind();
@@ -21585,10 +21618,20 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     if (!bootstrapped) {
       this.scheduleAccountRegistrySync();
-      await this.accountRegistryTail;
     }
     this.notificationHandler.success("Successfully signed in");
   }
+  /**
+   * Wait for the account-registry sync that {@link signIn} starts in the
+   * background (account index, this app's manifest record, space list).
+   * Resolves once it has finished, failed or hit its hang guard; it never
+   * rejects, and failures are logged as warnings. `signIn()` does not wait for
+   * it, so call this only when you need the registry written, or before a first
+   * write against a SQLite-backed node older than 1.20.2 (TC-899).
+   */
+  async waitForAccountRegistrySync() {
+    await this.accountRegistryTail;
+  }
   ownedSpaceId(name) {
     if (!this._address) {
       throw new Error("Cannot resolve owned space before sign-in");
@@ -22194,17 +22237,17 @@ var _TinyCloudNode = class _TinyCloudNode {
         clearTimeout(deadline);
       }
     });
-    this.pendingAccountRegistrySync = { session, promise };
-    const clearPendingSync = () => {
+    this.pendingAccountRegistrySync = { session, promise, controller };
+    const settle = () => {
+      clearTimeout(deadline);
       if (this.pendingAccountRegistrySync?.promise === promise) {
         this.pendingAccountRegistrySync = void 0;
       }
     };
-    void promise.then(clearPendingSync, clearPendingSync);
-    void promise.then(
-      () => clearTimeout(deadline),
-      () => clearTimeout(deadline)
-    );
+    void promise.then(settle, (error) => {
+      settle();
+      console.warn("TinyCloud account registry sync failed", error);
+    });
   }
   enqueueAccountRegistryOperation(session, task) {
     const operation = this.accountRegistryTail.then(async () => {
@@ -22242,10 +22285,15 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   async withAccountRegistryRetry(task, signal) {
     const delays = [250, 1e3, 3e3];
+    const stopped = (detail) => {
+      if (signal.reason instanceof DOMException && signal.reason.name === "TimeoutError") {
+        console.warn("TinyCloud account registry sync stopped: deadline exceeded", detail);
+      }
+    };
     let lastError;
     for (let attempt = 0; attempt < delays.length; attempt += 1) {
       if (signal.aborted) {
-        console.warn("TinyCloud account registry sync stopped: deadline exceeded", signal.reason);
+        stopped(signal.reason);
         return;
       }
       try {
@@ -22253,7 +22301,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return;
       } catch (error) {
         if (signal.aborted) {
-          console.warn("TinyCloud account registry sync stopped: deadline exceeded", error);
+          stopped(error);
           return;
         }
         const verdict = authorizationVerdictOf(error);
@@ -22346,7 +22394,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       throw new Error("Owned space hosting requires an active session");
     }
-    if (this.confirmedHostedSpaceIds.has(spaceId)) {
+    if (this.confirmedHostedSpaceIds.has(spaceId) || this.hostedOwnedSpaceIds.has(spaceId)) {
       return;
     }
     const host = this.hosts[0] ?? this.config.host;
@@ -22364,8 +22412,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activation }
       );
     }
-    const authorization = this.auth;
-    const created = signal ? await authorization.hostOwnedSpaceResult(spaceId, void 0, signal) : await authorization.hostOwnedSpaceResult(spaceId);
+    const created = await this.hostOwnedSpaceOnce(spaceId, signal);
     if (!created.success) {
       throw Object.assign(
         new Error(`Failed to create owned space ${spaceId}: ${describeHostFailure2(created)}`),
@@ -22382,7 +22429,10 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: retry }
       );
     }
-    this.confirmedHostedSpaceIds.add(spaceId);
+    if (this.auth.tinyCloudSession === session) {
+      this.confirmedHostedSpaceIds.add(spaceId);
+      this.hostedOwnedSpaceIds.add(spaceId);
+    }
   }
   /**
    * Host one of this user's owned spaces by name (e.g. `"applications"`).
@@ -22414,7 +22464,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!host) {
       throw new Error("Owned space hosting requires a TinyCloud host");
     }
-    const hosted = await this.auth.hostOwnedSpaceResult(spaceId);
+    const hosted = await this.hostOwnedSpaceOnce(spaceId);
     if (!hosted.success) {
       throw Object.assign(
         new Error(`Failed to host owned space ${spaceId}: ${describeHostFailure2(hosted)}`),
@@ -22433,6 +22483,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activation }
       );
     }
+    if (this.auth?.tinyCloudSession === session) this.hostedOwnedSpaceIds.add(spaceId);
     try {
       await this.enqueueAccountRegistryOperation(session, async () => {
         await this.account.spaces.register({
@@ -22460,18 +22511,19 @@ var _TinyCloudNode = class _TinyCloudNode {
    * registered on the node.
    *
    * Calling this resolves `name` to the owner's owned-space URI
-   * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`). It first consults the
-   * account-space spaces registry (`account/spaces/{space_id}`, the canonical
-   * KV source of truth, fronted by a best-effort SQLite index): if the space is
-   * already registered/hosted it returns the URI WITHOUT submitting a host
-   * delegation, avoiding a redundant host-SIWE signature prompt for owners who
-   * already use the space. Only when the space is absent — or the registry
-   * check fails for any reason (e.g. a cold SQLite index reporting
-   * `no such table: spaces`) — does it fall through to {@link hostOwnedSpace}.
+   * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`). It returns WITHOUT
+   * submitting a host delegation when the space is known to be hosted: the
+   * sign-in activation listed it as `activated` (any space the session's recap
+   * covers), this session already hosted it, or the account-space spaces
+   * registry (`account/spaces/{space_id}`, the canonical KV source of truth,
+   * fronted by a best-effort SQLite index) has its record. Otherwise it falls
+   * through to {@link hostOwnedSpace}, which asks for a signature; a host
+   * already in flight for the same space (e.g. from the background registry
+   * sync) is shared rather than asked for twice.
    *
-   * The registry check is purely an optimization: any failure falls back to
-   * hosting, and the host SIWE is idempotent server-side, so re-hosting an
-   * existing space remains a safe no-op. Must be called after {@link signIn}.
+   * Hosting is still needed when the space really isn't hosted, or when the
+   * session's recap doesn't cover it and the registry has no record; the host
+   * SIWE is idempotent server-side. Must be called after {@link signIn}.
    *
    * @param name - The owned space name (e.g. `"secrets"`).
    * @returns The hosted owned-space URI.
@@ -22480,13 +22532,57 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.auth.tinyCloudSession) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    await this.accountRegistryTail;
     const spaceId = this.ownedSpaceId(name);
-    if (await this.isOwnedSpaceRegistered(spaceId)) {
+    if (this.hostedOwnedSpaceIds.has(spaceId) || await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
     return this.hostOwnedSpace(name);
   }
+  /**
+   * Submit the host delegation for an owned space, sharing one in-flight
+   * request (and so one approval) between concurrent callers in this session,
+   * such as the background registry sync and {@link ensureOwnedSpaceHosted}.
+   * Each caller's `signal` releases only its own wait; the request itself is
+   * cancelled once no caller is left waiting, or when the session is replaced
+   * ({@link cancelOwnedSpaceHosts}), so a late approval is discarded.
+   */
+  hostOwnedSpaceOnce(spaceId, signal) {
+    if (signal?.aborted) return Promise.reject(signal.reason);
+    let entry = this.ownedSpaceHosts.get(spaceId);
+    if (!entry) {
+      const controller = new AbortController();
+      const promise = this.auth.hostOwnedSpaceResult(spaceId, void 0, controller.signal);
+      const created = { promise, controller, waiters: 0 };
+      this.ownedSpaceHosts.set(spaceId, created);
+      const forget = () => {
+        if (this.ownedSpaceHosts.get(spaceId) === created) this.ownedSpaceHosts.delete(spaceId);
+      };
+      promise.then(forget, forget);
+      entry = created;
+    }
+    if (!signal) {
+      entry.waiters = Number.POSITIVE_INFINITY;
+      return entry.promise;
+    }
+    entry.waiters += 1;
+    const shared = entry;
+    return new Promise((resolve, reject2) => {
+      const onAbort = () => {
+        reject2(signal.reason);
+        shared.waiters -= 1;
+        if (shared.waiters !== 0) return;
+        shared.controller.abort(signal.reason);
+        if (this.ownedSpaceHosts.get(spaceId) === shared) this.ownedSpaceHosts.delete(spaceId);
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      shared.promise.then(resolve, reject2).finally(() => signal.removeEventListener("abort", onAbort));
+    });
+  }
+  /** Session replacement: cancel the replaced session's in-flight hosts and forget them. */
+  cancelOwnedSpaceHosts() {
+    for (const { controller } of this.ownedSpaceHosts.values()) controller.abort();
+    this.ownedSpaceHosts.clear();
+  }
   /** Resolve and authenticate the owner encoded by an owned-space URI. */
   credentialSpaceOwnerDid(spaceId) {
     const ownerDid = this.ownerDidFromSpaceId(spaceId);
@@ -22729,6 +22825,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionExpiry: stagedSessionExpiry,
       recap: stagedRecap
     });
+    this.pendingAccountRegistrySync?.controller.abort();
+    await this.accountRegistryTail;
     const oldGraph = this._serviceGraph;
     const oldCore = this.tc;
     this.sessionManager = stagedManager;
@@ -22762,6 +22860,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
     this.confirmedHostedSpaceIds.clear();
+    this.hostedOwnedSpaceIds.clear();
+    this.cancelOwnedSpaceHosts();
     this._restoredNodeFeatures = restoredNodeFeatures;
     if (this.auth) {
       this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost], restoredNodeFeatures);