@tinycloud/node-sdk 3.2.6-beta.6 → 3.3.0-beta.8

package/dist/{WasmKeyProvider-DEdSyQ0I.d.cts → TinyCloudNode-CcNh20QX.d.cts}

@@ -1,114 +1,9 @@
 import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, ClientSession, TinyCloudSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, CapabilityPresentationEnvelopeV1, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate, KeyProvider, JWK } from '@tinycloud/sdk-core';
+import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
+import { ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction, FetchFunction } from '@tinycloud/sdk-services';
 
-/**
- * In-memory session storage for Node.js.
- *
- * Sessions are stored in memory and lost when the process exits.
- * Suitable for:
- * - Development and testing
- * - Stateless server deployments
- * - Short-lived processes
- *
- * @example
- * ```typescript
- * const storage = new MemorySessionStorage();
- * await storage.save("0x123...", sessionData);
- * const session = await storage.load("0x123...");
- * ```
- */
-declare class MemorySessionStorage implements ISessionStorage {
-    private sessions;
-    /**
-     * Save a session for an address.
-     */
-    save(address: string, session: PersistedSessionData): Promise<void>;
-    /**
-     * Load a session for an address.
-     */
-    load(address: string): Promise<PersistedSessionData | null>;
-    /**
-     * Clear a session for an address.
-     */
-    clear(address: string): Promise<void>;
-    /**
-     * Check if a session exists for an address.
-     */
-    exists(address: string): boolean;
-    /**
-     * Memory storage is always available.
-     */
-    isAvailable(): boolean;
-    /**
-     * Clear all sessions.
-     */
-    clearAll(): void;
-    /**
-     * Get the number of stored sessions.
-     */
-    size(): number;
-}
-
-/**
- * File-based session storage for Node.js.
- *
- * Sessions are persisted to the file system and survive process restarts.
- * Suitable for:
- * - CLI applications
- * - Long-running server processes
- * - Development environments
- *
- * @example
- * ```typescript
- * const storage = new FileSessionStorage("/tmp/tinycloud-sessions");
- * await storage.save("0x123...", sessionData);
- * // Session persists across process restarts
- * ```
- */
-declare class FileSessionStorage implements ISessionStorage {
-    private readonly baseDir;
-    /**
-     * Create a new FileSessionStorage.
-     *
-     * @param baseDir - Directory to store session files (default: ~/.tinycloud/sessions)
-     */
-    constructor(baseDir?: string);
-    /**
-     * Get the default session storage directory.
-     */
-    private getDefaultDir;
-    /**
-     * Ensure the storage directory exists.
-     */
-    private ensureDirectoryExists;
-    /**
-     * Get the file path for an address.
-     */
-    private getFilePath;
-    /**
-     * Save a session for an address.
-     */
-    save(address: string, session: PersistedSessionData): Promise<void>;
-    /**
-     * Load a session for an address.
-     */
-    load(address: string): Promise<PersistedSessionData | null>;
-    /**
-     * Clear a session for an address.
-     */
-    clear(address: string): Promise<void>;
-    /**
-     * Check if a session exists for an address.
-     */
-    exists(address: string): boolean;
-    /**
-     * Check if file system storage is available.
-     */
-    isAvailable(): boolean;
-}
-
 /**
  * Node.js-specific SignStrategy types for TinyCloud authorization.
  *
@@ -164,6 +59,98 @@ type SignStrategy = AutoSignStrategy | AutoRejectStrategy | CallbackStrategy | N
  */
 declare const defaultSignStrategy: SignStrategy;
 
+/**
+ * Structural shape of the OpenKey SDK's `authorizeTinyCloud()` method.
+ * Callers pass any object that conforms to this shape — typically an
+ * `OpenKey` instance from `@openkey/sdk` — without either package
+ * needing to import from the other.
+ */
+interface OpenKeyAuthorizeTinyCloud {
+    authorizeTinyCloud(request: {
+        protocolVersion: 1;
+        siwe: string;
+        keyId?: string;
+        jwk?: Record<string, unknown>;
+        host?: string;
+        /**
+         * Display-only presentation envelope. Forwarded to the OpenKey
+         * widget review UI. The envelope MUST NEVER expand authority — the
+         * ReCap payload remains the sole gate — and the widget/server
+         * validates and size-bounds it before use.
+         */
+        presentation?: CapabilityPresentationEnvelopeV1;
+    }): Promise<{
+        protocolVersion: 1;
+        address: string;
+        signature: string;
+        signedMessage: string;
+        selectedActionKeys: string[];
+        permissions: Array<{
+            service: string;
+            space: string;
+            path: string;
+            actions: string[];
+        }>;
+    }>;
+}
+interface OpenKeyBridgeInput {
+    protocolVersion: 1;
+    siwe: string;
+    jwk: Record<string, unknown>;
+    /** SDK-prepared session-key DID, for local handoff consistency only; not an OpenKey request field. */
+    readonly verificationMethod: string;
+    host?: string;
+    /** Optional keyId hint the caller wants OpenKey to bind to. */
+    keyId?: string;
+    /**
+     * Optional presentation envelope built by `NodeUserAuthorization`
+     * from its `_manifest`. Passed through to `authorizeTinyCloud` so the
+     * widget can render honest provenance labels and the OpenKey server
+     * can origin-bind the browser origin against the app's well-known
+     * manifest. Display-only.
+     */
+    presentation?: CapabilityPresentationEnvelopeV1;
+}
+type NodeUserAuthorizationAuthorizeFn = (input: OpenKeyBridgeInput) => Promise<{
+    protocolVersion: 1;
+    address: string;
+    signature: string;
+    signedMessage: string;
+    selectedActionKeys: string[];
+    permissions: Array<{
+        service: string;
+        space: string;
+        path: string;
+        actions: string[];
+    }>;
+}>;
+/**
+ * Wire a concrete OpenKey-shaped SDK object into the `authorizeFn`
+ * `NodeUserAuthorization.signInWithOpenKey` expects. Rejects any
+ * response that does not carry the canonical rich-result shape so
+ * wire drift shows up at the bridge boundary rather than deep inside
+ * `signInWithOpenKeyResult`.
+ *
+ * @example
+ * ```ts
+ * import { OpenKey } from '@openkey/sdk';
+ * import { wireOpenKeyAuthorize } from '@tinycloud/node-sdk';
+ * const openkey = new OpenKey({ appName: 'my-app' });
+ * await openkey.connect();
+ * const authorize = wireOpenKeyAuthorize(openkey);
+ * const clientSession = await nodeAuth.signInWithOpenKey(authorize);
+ * ```
+ */
+declare function wireOpenKeyAuthorize(openkey: OpenKeyAuthorizeTinyCloud): NodeUserAuthorizationAuthorizeFn;
+
+type OpenKeyAuthorizeInput = OpenKeyBridgeInput;
+type OpenKeyAuthorizationResultV1 = Awaited<ReturnType<NodeUserAuthorizationAuthorizeFn>>;
+type PreparedOpenKeySession = {
+    siwe: string;
+    jwk: Record<string, unknown>;
+    spaceId: string;
+    verificationMethod: string;
+};
 /**
  * Configuration for NodeUserAuthorization.
  */
@@ -250,6 +237,11 @@ interface NodeUserAuthorizationConfig {
      * scheduling never reach this layer.
      */
     replication?: Pick<ReplicationOptions, "enabled" | "prefixes" | "allowSecrets">;
+    /**
+     * Mints the replica session stamp on each fresh sign-in (TC-858 §4). Returns
+     * `undefined` when replication is off, so the persisted session carries no stamp.
+     */
+    establishReplicaStamp?: (session: TinyCloudSession) => Promise<PersistedSessionData["replicaStamp"]>;
 }
 interface CreateBootstrapSessionOptions {
     spaceId: string;
@@ -310,6 +302,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private readonly localNodeIdentityStore?;
     private readonly enablePublicSpace;
     private readonly replication?;
+    private readonly establishReplicaStamp?;
     private readonly nonce?;
     private readonly siweConfig?;
     private readonly wasm;
@@ -560,6 +553,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     ensureSpaceExists(): Promise<void>;
     private recordActivationSkippedSpaces;
     createBootstrapSession(options: CreateBootstrapSessionOptions): Promise<TinyCloudSession>;
+    private persistedData;
     /**
      * Sign in and create a new session.
      *
@@ -665,49 +659,17 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      *   into its /authorize-sign-prepare context.
      * @param options Optional overrides for the OpenKey request.
      */
-    signInWithOpenKey(authorizeFn: (input: {
-        protocolVersion: 1;
-        siwe: string;
-        jwk: Record<string, unknown>;
-        host?: string;
-        /**
-         * Sol MAJOR-3: OpenKey key ID (managed or external key) to sign
-         * with. When omitted, the OpenKey SDK falls back to the last
-         * connected key. Callers who want to bind the flow to a specific
-         * OpenKey key can override via options.openkeyKeyId; otherwise the
-         * bridge relies on the SDK's connected-key state.
-         */
-        keyId?: string;
-        /**
-         * Optional presentation envelope forwarded to the OpenKey widget.
-         * Built from this instance's `_manifest` when set. Display-only —
-         * the widget/server MUST NOT let it expand authority. The envelope
-         * carries `manifests` payloads plus a stable SHA-256 digest so the
-         * OpenKey server can origin-bind the browser origin against the
-         * app's well-known manifest.
-         */
-        presentation?: CapabilityPresentationEnvelopeV1;
-    }) => Promise<{
-        protocolVersion: 1;
-        address: string;
-        signature: string;
-        signedMessage: string;
-        selectedActionKeys: string[];
-        permissions: Array<{
-            service: string;
-            space: string;
-            path: string;
-            actions: string[];
-        }>;
-    }>, options?: {
+    signInWithOpenKey(authorizeFn: NodeUserAuthorizationAuthorizeFn, options?: {
         host?: string;
         openkeyKeyId?: string;
+        /** Caller-supplied display reason, not signed authority. */
+        reason?: string;
         /**
-         * Optional caller-supplied reason string forwarded in the
-         * presentation envelope. Rendered as caller-supplied (never
-         * verified) in the widget.
+         * Supply another candidate without regenerating the SIWE or session key.
+         * Called only after transport or pre-commit verification rejects a result.
+         * Return null to cancel; activation errors are never signing retries.
          */
-        reason?: string;
+        retryResult?: (error: Error, originalRequest: OpenKeyAuthorizeInput, attempt: number) => Promise<OpenKeyAuthorizationResultV1 | null>;
     }): Promise<ClientSession>;
     /**
      * Build a `CapabilityPresentationEnvelopeV1` from `this._manifest`. The
@@ -755,29 +717,9 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * 5. Every `result.selectedActionKeys` entry corresponds to a
      *    (resource, action) pair in the returned SIWE.
      */
-    signInWithOpenKeyResult(result: {
-        protocolVersion: 1;
-        address: string;
-        signature: string;
-        signedMessage: string;
-        selectedActionKeys: string[];
-        permissions: Array<{
-            service: string;
-            space: string;
-            path: string;
-            actions: string[];
-        }>;
-    }, prepared: {
-        /**
-         * The ORIGINAL SIWE the SDK produced via {@link prepareSessionForSigning}.
-         * Used as the source-of-truth reference for immutable-header and
-         * capability-subset comparison against `result.signedMessage`.
-         */
-        siwe: string;
-        jwk: Record<string, unknown>;
-        spaceId: string;
-        verificationMethod: string;
-    }, keyId: string, jwk: Record<string, unknown>): Promise<ClientSession>;
+    signInWithOpenKeyResult(result: OpenKeyAuthorizationResultV1, prepared: PreparedOpenKeySession, keyId: string, jwk: Record<string, unknown>): Promise<ClientSession>;
+    /** Validate a candidate without activating a network session, so paste retries reuse one preparation. */
+    private verifyOpenKeyResult;
     /**
      * Clear persisted session data.
      */
@@ -1298,10 +1240,17 @@ interface TinyCloudNodeConfig {
     autoBootstrapAccount?: boolean;
     /** Default-off service telemetry. */
     telemetry?: TelemetryConfig;
-    /** Optional read-through replica configuration; disabled unless explicitly enabled. */
+    /**
+     * Optional read-through replica configuration; disabled unless explicitly enabled.
+     * Node profile mutations require `profileDir` and a caller-supplied `profileGuard` holding
+     * the same cross-process profile lock as SQLite and pending writes. Browser storage uses
+     * its mandatory origin Web Lock instead. Missing guards gate the replica, not the session.
+     */
     replication?: ReplicationOptions & {
         storage: KVReplicaStorage;
         mode?: "background" | "foreground";
+        profileDir?: string;
+        profileGuard?: <T>(section: () => Promise<T>) => Promise<T>;
     };
 }
 /**
@@ -1334,6 +1283,13 @@ interface DelegateToOptions {
      * aborts activation and propagates from `delegateTo`.
      */
     onPrepared?: (prepared: PortableDelegation) => Promise<void>;
+    /**
+     * Mark the delegation terminal: the node refuses any delegation that cites
+     * it as a parent (`terminal-parent-cannot-redelegate`). The delegate can
+     * still use it directly. Only session-key UCAN delegations can carry the
+     * marker, so this throws with `forceWalletSign`. Default false.
+     */
+    disableSubDelegation?: boolean;
 }
 /**
  * Result of {@link TinyCloudNode.delegateTo}.
@@ -1474,6 +1430,11 @@ declare class TinyCloudNode {
     private replicationRuntimeInstance?;
     private replicationDelegateSession?;
     private replicationScopeError?;
+    private replicaRestoreGate?;
+    private replicaSessionPrincipal?;
+    private replicaSessionStamp?;
+    /** Mints the replica session stamp on each fresh sign-in (TC-858 §4.1). Undefined when replication is off. */
+    private readonly establishReplicaStamp;
     private readonly replicationControl?;
     private _sql?;
     private _duckdb?;
@@ -1725,8 +1686,7 @@ declare class TinyCloudNode {
      */
     get isSessionOnly(): boolean;
     /**
-     * Get the space ID for this user.
-     * Available after signIn().
+     * Primary space of the signed-in or restored network session, including compact sessions.
      */
     get spaceId(): string | undefined;
     /**
@@ -1748,6 +1708,8 @@ declare class TinyCloudNode {
      * pass back to {@link restoreSession}.
      */
     get restorableSession(): TinyCloudSession | undefined;
+    /** The active, verified replica stamp. Undefined when the replica is refused or the session has ended. */
+    get replicaStamp(): ReplicaSessionStamp | undefined;
     /**
      * Sign out and end the session on this instance.
      *
@@ -1762,6 +1724,11 @@ declare class TinyCloudNode {
      */
     signOut(): Promise<void>;
     private endSession;
+    /**
+     * Step 1 of replica sign-out. Never rejects: failures come back as `unguarded` so the session
+     * is still cleared. Returns `undefined` when replication is off.
+     */
+    private denyReplicaGate;
     /**
      * Synchronously drop every piece of in-memory session authority and
      * invalidate sign-ins and restores still in flight (see `sessionEpoch`).
@@ -1777,6 +1744,13 @@ declare class TinyCloudNode {
      * @param options - Optional per-call SIWE overrides for this sign-in only
      */
     signIn(options?: SignInOptions): Promise<void>;
+    /**
+     * Fresh OpenKey sign-in. The callback receives the SDK's original SIWE and
+     * session JWK before approval; the signed result is verified against those
+     * bytes before the network session or replica stamp is committed.
+     */
+    signInWithOpenKey(authorizeFn: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[0], options?: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[1]): Promise<void>;
+    private signInWith;
     private establishSignIn;
     /**
      * Wait for the account-registry sync that {@link signIn} starts in the
@@ -1854,6 +1828,14 @@ declare class TinyCloudNode {
      * recap parser.
      */
     private currentSessionCanListSpaces;
+    /**
+     * Whether the current primary session's recap covers the account index read
+     * (`tinycloud.sql/read` on the owned account space's `account` database),
+     * the first call of every registry sync. As in
+     * {@link currentSessionCanListSpaces}, a session with no parseable recap
+     * keeps today's behavior.
+     */
+    private currentSessionCoversAccountRegistry;
     private withAccountRegistryRetry;
     private requestedEncryptionNetworkIds;
     private ensureRequestedEncryptionNetworks;
@@ -2012,6 +1994,16 @@ declare class TinyCloudNode {
          * lazily via the registry/fallback on the first host-needing call.
          */
         tinycloudHosts?: string[];
+        /**
+         * Replica gate stamp persisted at sign-in (sdk-core `replicaStamp`).
+         * Validated against the node account gate only when replication is
+         * enabled; ignored otherwise. Absent or null is refused when replication
+         * is enabled (`not_established`).
+         */
+        replicaStamp?: {
+            incarnation: string;
+            lifecycleEpoch: number;
+        } | null;
     }): Promise<void>;
     private stagePrimarySessionState;
     private stageRestoredServiceGraph;
@@ -2153,7 +2145,8 @@ declare class TinyCloudNode {
      * Both SharingService (single-entry) and
      * {@link TinyCloudNode.delegateTo} (multi-entry) drive this through
      * the same code path so there's exactly one place that touches the
-     * WASM boundary.
+     * WASM boundary. `terminal` adds the node's terminal marker, which the
+     * WASM builder cannot emit.
      *
      * @internal
      */
@@ -2496,7 +2489,8 @@ declare class TinyCloudNode {
      */
     delegate(params: CreateDelegationParams): Promise<DelegationResult<Delegation>>;
     /**
-     * Revoke a delegation using the v2 DelegationManager.
+     * Revoke a delegation with the owner wallet when available. Session-only
+     * clients continue to use their delegated revocation authority.
      *
      * @param cid - The CID of the delegation to revoke
      * @returns Result indicating success or failure
@@ -2604,7 +2598,8 @@ declare class TinyCloudNode {
      */
     replicationSignInEntries(): PermissionEntry[];
     private replicationAuthority;
-    private bindReplicationRuntime;
+    private quiesceReplicaRuntime;
+    private bindReplicaOrGate;
     /** Stable control facade for this node's optional replication runtime. */
     get replication(): ReplicationControl | undefined;
     /**
@@ -2747,7 +2742,12 @@ declare class TinyCloudNode {
         actions: string[];
         /** DID of the recipient (from their TinyCloudNode.did) */
         delegateDID: string;
-        /** Whether to prevent the recipient from creating sub-delegations (default: false) */
+        /**
+         * Prevent the recipient from creating sub-delegations (default: false).
+         * The delegation carries the node's terminal marker, so the node refuses
+         * its children. Needs capabilities the current session holds; throws
+         * rather than fall back to a wallet-signed delegation.
+         */
         disableSubDelegation?: boolean;
         /** Expiration time in milliseconds from now (default: 1 hour) */
         expiryMs?: number;
@@ -2795,7 +2795,10 @@ declare class TinyCloudNode {
         actions: string[];
         /** DID of the recipient */
         delegateDID: string;
-        /** Whether to prevent the recipient from creating further sub-delegations */
+        /**
+         * Not supported: this method issues a wallet-signed delegation, which
+         * cannot carry the node's terminal marker, so `true` throws.
+         */
         disableSubDelegation?: boolean;
         /** Expiration in milliseconds from now; defaults to the parent's own expiry, the longest allowed. */
         expiryMs?: number;
@@ -2809,112 +2812,4 @@ declare class TinyCloudNode {
     }): Promise<PortableDelegation>;
 }
 
-/**
- * WasmKeyProvider - KeyProvider implementation using WASM session manager.
- *
- * This provider wraps the SessionManager from node-sdk-wasm to provide
- * cryptographic key operations required by the SharingService.
- *
- * @packageDocumentation
- */
-
-/**
- * Extended session manager with optional key listing support.
- * The base ISessionManager doesn't include listSessionKeys(),
- * but concrete implementations (e.g., TCWSessionManager) may provide it.
- */
-interface SessionManagerWithListing extends ISessionManager {
-    listSessionKeys?(): string[];
-}
-/**
- * Configuration for WasmKeyProvider.
- */
-interface WasmKeyProviderConfig {
-    /**
-     * The WASM session manager instance.
-     * Must be created before constructing the KeyProvider.
-     */
-    sessionManager: SessionManagerWithListing;
-}
-/**
- * KeyProvider implementation that wraps the WASM session manager.
- *
- * This allows the SharingService to create new session keys for sharing links
- * using the same cryptographic operations as the main session management.
- *
- * @example
- * ```typescript
- * // sessionManager from wasmBindings.createSessionManager()
- * import { WasmKeyProvider } from "@tinycloud/node-sdk";
- *
- * const sessionManager = new SessionManager();
- * const keyProvider = new WasmKeyProvider({ sessionManager });
- *
- * // Create a session key for a sharing link
- * const keyId = await keyProvider.createSessionKey("share:abc123");
- * const jwk = keyProvider.getJWK(keyId);
- * const did = await keyProvider.getDID(keyId);
- * ```
- */
-declare class WasmKeyProvider implements KeyProvider {
-    private sessionManager;
-    /**
-     * Create a new WasmKeyProvider.
-     *
-     * @param config - Configuration with the WASM session manager
-     */
-    constructor(config: WasmKeyProviderConfig);
-    /**
-     * Generate a new session key with the given name.
-     *
-     * This creates a new Ed25519 key pair in the WASM session manager.
-     * The key can then be used for signing delegations in sharing links.
-     *
-     * @param name - A unique name/ID for the key (e.g., "share:timestamp:random")
-     * @returns The key ID (same as the name provided)
-     */
-    createSessionKey(name: string): Promise<string>;
-    /**
-     * Get the JWK (JSON Web Key) for a key.
-     *
-     * Returns the full JWK including the private key (d parameter),
-     * which is required for signing and for embedding in sharing links.
-     *
-     * @param keyId - The key ID to retrieve
-     * @returns The JWK object with public and private key components
-     * @throws Error if the key is not found
-     */
-    getJWK(keyId: string): JWK;
-    /**
-     * Get the DID (Decentralized Identifier) for a key.
-     *
-     * Returns the did:key format DID derived from the key's public key.
-     * This DID can be used as the delegatee in delegations.
-     *
-     * @param keyId - The key ID to retrieve
-     * @returns The DID in did:key format (e.g., "did:key:z6Mk...")
-     */
-    getDID(keyId: string): Promise<string>;
-    /**
-     * List all session keys currently held by the provider.
-     *
-     * @returns Array of key IDs
-     */
-    listKeys(): string[];
-    /**
-     * Check if a key exists in the provider.
-     *
-     * @param keyId - The key ID to check
-     * @returns True if the key exists
-     */
-    hasKey(keyId: string): boolean;
-}
-/**
- * Create a new WasmKeyProvider instance.
- *
- * @param sessionManager - The WASM session manager
- * @returns A new WasmKeyProvider instance
- */
-declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
-
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, activateValidatedRuntimeDelegation as G, createWasmKeyProvider as H, InvalidRestoredSessionError as I, defaultSignStrategy as J, deserializeDelegation as K, grantAuthRequest as L, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, serializeDelegation as Q, RUNTIME_DELEGATION_REJECTIONS as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, signedCompactUcanExpiry as X, siweRuntimeDelegation as Y, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationConfig as k, type RestorableSession as l, type RuntimeDelegationActivator as m, RuntimeDelegationRejectedError as n, type RuntimeDelegationRejection as o, type RuntimePermissionGrantOptions as p, type SecretReadInput as q, type SecretReadResult as r, type SessionGrantProof as s, type SignStrategy as t, type TinyCloudNodeConfig as u, type UnifiedOwnerRootReceipt as v, UnsupportedSessionRestoreError as w, type VerifiedSessionGrant as x, type WasmKeyProviderConfig as y, activateCompactRuntimeDelegation as z };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, type UnifiedOwnerRootReceipt as F, UnsupportedSessionRestoreError as G, type VerifiedSessionGrant as H, InvalidRestoredSessionError as I, activateCompactRuntimeDelegation as J, activateValidatedRuntimeDelegation as K, defaultSignStrategy as L, deserializeDelegation as M, type NodeEventEmitterStrategy as N, type OpenKeyAuthorizationResultV1 as O, type PortableDelegation as P, grantAuthRequest as Q, RUNTIME_DELEGATION_REJECTIONS as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, serializeDelegation as W, signedCompactUcanExpiry as X, siweRuntimeDelegation as Y, wireOpenKeyAuthorize as Z, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationAuthorizeFn as k, type NodeUserAuthorizationConfig as l, type OpenKeyAuthorizeInput as m, type OpenKeyAuthorizeTinyCloud as n, type OpenKeyBridgeInput as o, type OwnerDelegationReceipt as p, type RestorableSession as q, type RuntimeDelegationActivator as r, RuntimeDelegationRejectedError as s, type RuntimeDelegationRejection as t, type RuntimePermissionGrantOptions as u, type SecretReadInput as v, type SecretReadResult as w, type SessionGrantProof as x, type SignStrategy as y, type TinyCloudNodeConfig as z };