@tinycloud/node-sdk 3.6.0-beta.3 → 3.6.0-beta.5

package/README.md

@@ -0,0 +1,6 @@
+# @tinycloud/node-sdk
+
+## `@tinycloud/node-sdk/credential-pending-store`
+
+File-backed pending store for the email-proof flow. It keeps one file per request under `<home>/credentials/`, named by a hash of the request id. The directory is created with mode 0700 and each file with mode 0600. Permissions and ownership are re-checked on every read. Only a `home` that is itself a symlink is refused; ancestors of `home` may be symlinks, but `realpath(home)` must be owned by the current user. Unsafe files are left in place and reported as an error.
+

package/dist/{TinyCloudNode-N4mfZI_k.d.cts → TinyCloudNode-B5WCe_ps.d.ts}

@@ -1,8 +1,9 @@
 import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
-import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, RegistryPolicy, RegistrySequenceStore, OnNodeNotFound, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, RetryPolicy, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
+import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, RegistryPolicy, RegistrySequenceStore, OnNodeNotFound, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, Delegation, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, RetryPolicy, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
 import { ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
 import { InvokeFunction, InvokeAnyFunction, FetchFunction, RequestSink, RequestLogReader } from '@tinycloud/sdk-services';
 import { EventEmitter } from 'events';
+import { P as PortableDelegation, S as SessionGrantProof, g as VerifiedSessionGrant } from './delegation-0LKZkmP2.js';
 
 /**
  * Node.js-specific SignStrategy types for TinyCloud authorization.
@@ -795,254 +796,6 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private requestSignatureViaEmitter;
 }
 
-/**
- * A portable delegation that can be transported between users.
- * Extends the base Delegation type with fields required for transport.
- *
- * @remarks
- * PortableDelegation adds transport fields to Delegation:
- * - `delegationHeader`: Structured authorization header for API calls
- * - `ownerAddress`: Space owner's address for session creation
- * - `chainId`: Chain ID for session creation
- * - `host`: Optional server URL
- * - `resources`: Multi-resource grant breakdown (present when the
- *   delegation was issued via the multi-resource WASM path, i.e. one
- *   UCAN covering multiple `(service, path, actions)` entries). The
- *   flat `path` + `actions` fields mirror the first entry for
- *   single-resource callers; consumers that need the full picture
- *   read `resources`.
- */
-interface PortableDelegation extends Omit<Delegation, "isRevoked"> {
-    /** The authorization header for this delegation (structured format) */
-    delegationHeader: {
-        Authorization: string;
-    };
-    /** The address of the space owner */
-    ownerAddress: string;
-    /** The chain ID */
-    chainId: number;
-    /** TinyCloud server URL where this delegation was created */
-    host?: string;
-    /** Whether the recipient is prevented from creating sub-delegations */
-    disableSubDelegation?: boolean;
-    /** Companion delegation for the user's public space (auto-created when includePublicSpace is true) */
-    publicDelegation?: PortableDelegation;
-    /**
-     * Full multi-resource grant breakdown. Present when the delegation
-     * was issued via the multi-resource WASM path; each entry describes
-     * one `(service, space, path, actions)` grant carried by the single
-     * underlying UCAN. When absent, only the flat `path` + `actions`
-     * fields are authoritative (legacy single-resource shape).
-     */
-    resources?: DelegatedResource[];
-    /**
-     * The wallet-signed SIWE message and EIP-191 signature behind a
-     * `delegationHeader` that is a CACAO session grant (OpenKey `/delegate`,
-     * {@link TinyCloudNode.grantRuntimePermissions}) rather than a compact UCAN.
-     * Not authority: activation rebuilds the CACAO from them and accepts only
-     * byte-identical authorization bytes.
-     */
-    siweProof?: {
-        siwe: string;
-        signature: string;
-    };
-}
-/**
- * The transport shape `tc auth request --emit` produces and that an owner
- * grants to its requester. Only the fields the grant logic needs are declared;
- * the CLI artifact carries more (posture, captured command, ...) and remains a
- * structural superset of this interface.
- */
-interface AuthRequestArtifact {
-    kind: "tinycloud.auth.request";
-    version: 1;
-    requestId: string;
-    /** The requester's session DID — the audience the grant is issued to. */
-    sessionDid: string;
-    /** The capabilities the requester is asking the owner to delegate. */
-    requested: PermissionEntry[];
-    /** Optional lifetime override carried from the request. */
-    requestedExpiry?: string | number;
-}
-/**
- * The transport shape returned by {@link grantAuthRequest} (and written by
- * `tc auth grant`). `tc auth import` accepts this artifact directly.
- */
-interface AuthDelegationArtifact {
-    kind: "tinycloud.auth.delegation";
-    version: 1;
-    requestId: string;
-    delegationCid: string;
-    delegation: PortableDelegation;
-    permissions: PermissionEntry[];
-    expiry: string;
-    /** Whether issuing the delegation triggered a wallet prompt. */
-    prompted: boolean;
-}
-/**
- * Minimal owner-side capability {@link grantAuthRequest} needs: the signed
- * `delegateTo` primitive. `TinyCloudNode` satisfies this directly; web/SDK
- * contexts can supply any object that exposes the same method.
- */
-interface DelegationAuthority {
-    delegateTo(did: string, permissions: PermissionEntry[], options?: {
-        expiry?: string | number;
-        forceWalletSign?: boolean;
-    }): Promise<{
-        delegation: PortableDelegation;
-        prompted: boolean;
-    }>;
-}
-/**
- * Authority that the validated runtime-delegation activation helper needs.
- * `TinyCloudNode` implements this surface directly; keeping it structural
- * makes the helper usable by a compatible Node wrapper without exposing node
- * internals.
- */
-interface RuntimeDelegationActivator {
-    readonly sessionDid: string;
-    readonly did?: string;
-    readonly isSessionOnly?: boolean;
-    computeDelegationCid(authorization: string): string;
-    useRuntimeDelegation(delegation: PortableDelegation): Promise<void>;
-    useDelegation?(delegation: PortableDelegation): Promise<unknown>;
-    getRuntimePermissionDelegations(): PortableDelegation[];
-    /**
-     * Verify a wallet-signed session grant issued to this runtime's live session
-     * key. Required to activate a CACAO grant; compact UCANs do not use it.
-     */
-    verifySessionGrant?(grant: SessionGrantProof): VerifiedSessionGrant;
-}
-/** The installed authority returned by {@link activateValidatedRuntimeDelegation}. */
-interface ValidatedRuntimeDelegation {
-    /** CID recomputed from the signed authorization bytes. */
-    readonly cid: string;
-    /** The authority object installed by the node runtime. */
-    readonly delegation: PortableDelegation;
-    /** Capabilities read from the signed compact UCAN attenuation or SIWE ReCap. */
-    readonly effectivePermissions: readonly PermissionEntry[];
-    /** Expiry read from the signed compact UCAN payload or SIWE. */
-    readonly expiry: Date;
-    /** Audience read from the signed compact UCAN payload or SIWE. */
-    readonly audience: string;
-    /** Host selected for, and used by, the runtime activation. */
-    readonly host: string;
-}
-interface CompactRuntimeDelegationInput {
-    readonly authorization: string;
-    readonly cid: string;
-    readonly host: string;
-    readonly ownerAddress: string;
-    readonly chainId: number;
-}
-/** A CACAO session grant and the signed SIWE proof it was built from. */
-interface SessionGrantProof {
-    readonly delegationHeader: {
-        Authorization: string;
-    };
-    readonly delegationCid: string;
-    readonly spaceId: string;
-    readonly address: string;
-    readonly chainId: number;
-    readonly siwe: string;
-    readonly signature: string;
-}
-/** Authority read from a verified session grant's signed ReCap. */
-interface VerifiedSessionGrant {
-    readonly recap: readonly {
-        service: string;
-        space: string;
-        path: string;
-        actions: string[];
-        caveats?: Record<string, unknown>[];
-    }[];
-    readonly expiresAt: Date;
-}
-/**
- * Stable reasons {@link activateValidatedRuntimeDelegation} refuses a
- * delegation for. The error message is for the caller and may quote
- * transport fields or a node's response; the reason is safe to publish.
- */
-declare const RUNTIME_DELEGATION_REJECTIONS: readonly ["host_mismatch", "expired", "cid_mismatch", "authority_invalid", "proof_missing", "proof_invalid", "owner_mismatch", "audience_mismatch", "resources_mismatch", "unsupported", "activation_rejected", "activation_unavailable", "activation_unauthenticated"];
-type RuntimeDelegationRejection = typeof RUNTIME_DELEGATION_REJECTIONS[number];
-declare class RuntimeDelegationRejectedError extends Error {
-    readonly reason: RuntimeDelegationRejection;
-    constructor(reason: RuntimeDelegationRejection, message: string);
-}
-/**
- * The expiry a compact UCAN authorization signs: its payload's `exp`. Reads
- * the bytes the issuer's signature covers without verifying that signature,
- * which the node does. `undefined` when `authorization` is not a compact UCAN
- * or its payload has no finite numeric `exp`; then no local expiry decision
- * can be made (activation refuses such a UCAN).
- */
-declare function signedCompactUcanExpiry(authorization: string): Date | undefined;
-/**
- * CID-bind and activate one runtime delegation.
- *
- * A compact UCAN's audience, expiry and permissions come from its signed
- * payload, and its transport fields must agree with them. A CACAO session
- * grant (OpenKey `/delegate`, `grantRuntimePermissions`) is verified from its
- * `siweProof` against this runtime's live session key; its installed
- * authority is exactly the verified ReCap, and its transport `resources` are
- * display data that is never consulted. Either way the helper then invokes
- * {@link TinyCloudNode.useRuntimeDelegation}; the node activation call remains
- * the authority and delegation-chain validation boundary.
- *
- * `options.authorize`, when given, sees the signed capabilities before
- * anything is activated or installed; returning `false` refuses the
- * delegation.
- */
-declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActivator, delegation: PortableDelegation, options: {
-    host: string;
-    authorize?: (effectivePermissions: readonly PermissionEntry[]) => boolean;
-}): Promise<ValidatedRuntimeDelegation>;
-/**
- * Import compact UCAN bytes returned by an authority ceremony through the
- * ordinary runtime-delegation activation path. All transport projections are
- * derived from signed bytes before `/delegate` is called.
- */
-declare function activateCompactRuntimeDelegation(node: RuntimeDelegationActivator, input: CompactRuntimeDelegationInput): Promise<ValidatedRuntimeDelegation>;
-/**
- * Project an OpenKey signed-login delegation from the same verified CACAO
- * authority used when the runtime activates and replays it.
- */
-declare function siweRuntimeDelegation(node: RuntimeDelegationActivator, input: {
-    readonly authorization: string;
-    readonly cid: string;
-    readonly spaceId: string;
-    readonly ownerAddress: string;
-    readonly chainId: number;
-    readonly siwe: string;
-    readonly signature: string;
-    readonly host: string;
-}): PortableDelegation;
-/**
- * Turn a delegation REQUEST into a signed GRANT.
- *
- * Lifts the body of `tc auth grant` into the SDK so the request→grant
- * handshake is callable programmatically (future SDK/web owner tooling and the
- * KV delegation inbox), with the CLI verb reduced to a thin wrapper. The owner
- * `authority` (a `TinyCloudNode`) signs a delegation scoped to exactly the
- * requested caps, audienced to the requester's `sessionDid`, honoring the
- * request's expiry. The returned artifact round-trips through `tc auth import`.
- *
- * Authorization is enforced cryptographically by `delegateTo`: caps that are
- * not derivable from the owner's own session capability chain are rejected
- * (it throws), so this never widens authority the owner doesn't hold.
- */
-declare function grantAuthRequest(authority: DelegationAuthority, request: AuthRequestArtifact, options?: {
-    expiry?: string | number;
-}): Promise<AuthDelegationArtifact>;
-/**
- * Serialize a PortableDelegation for transport (e.g., over network).
- */
-declare function serializeDelegation(delegation: PortableDelegation): string;
-/**
- * Deserialize a PortableDelegation from transport.
- */
-declare function deserializeDelegation(data: string): PortableDelegation;
-
 /**
  * The handles needed to rehydrate this delegation activation in a fresh
  * `TinyCloudNode` via `TinyCloudNode.restoreSession(...)` in another process
@@ -2895,4 +2648,4 @@ declare class TinyCloudNode {
     }): Promise<PortableDelegation>;
 }
 
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, type UnifiedOwnerRootReceipt as F, UnsupportedSessionRestoreError as G, type VerifiedSessionGrant as H, InvalidRestoredSessionError as I, activateCompactRuntimeDelegation as J, activateValidatedRuntimeDelegation as K, defaultSignStrategy as L, deserializeDelegation as M, type NodeEventEmitterStrategy as N, type OpenKeyAuthorizationResultV1 as O, type PortableDelegation as P, grantAuthRequest as Q, RUNTIME_DELEGATION_REJECTIONS as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, serializeDelegation as W, signedCompactUcanExpiry as X, siweRuntimeDelegation as Y, wireOpenKeyAuthorize as Z, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationAuthorizeFn as k, type NodeUserAuthorizationConfig as l, type OpenKeyAuthorizeInput as m, type OpenKeyAuthorizeTinyCloud as n, type OpenKeyBridgeInput as o, type OwnerDelegationReceipt as p, type RestorableSession as q, type RuntimeDelegationActivator as r, RuntimeDelegationRejectedError as s, type RuntimeDelegationRejection as t, type RuntimePermissionGrantOptions as u, type SecretReadInput as v, type SecretReadResult as w, type SessionGrantProof as x, type SignStrategy as y, type TinyCloudNodeConfig as z };
+export { ACCEPTED_MARKER_VERSIONS as A, type BootstrapWarning as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, InvalidRestoredSessionError as I, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type RuntimePermissionGrantOptions as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type DelegateToResult as a, DelegatedAccess as b, NodeUserAuthorization as c, type NodeUserAuthorizationConfig as d, type SecretReadInput as e, type SecretReadResult as f, type SignStrategy as g, type TinyCloudNodeConfig as h, type UnifiedOwnerRootReceipt as i, UnsupportedSessionRestoreError as j, defaultSignStrategy as k, BOOTSTRAP_COMPLETION_MARKER_KEY as l, BOOTSTRAP_COMPLETION_MARKER_VERSION as m, type BootstrapCompletionMarker as n, type NodeUserAuthorizationAuthorizeFn as o, type OpenKeyAuthorizationResultV1 as p, type OpenKeyAuthorizeInput as q, type OpenKeyAuthorizeTinyCloud as r, type OpenKeyBridgeInput as s, type RestorableSession as t, wireOpenKeyAuthorize as w };

package/dist/{TinyCloudNode-N4mfZI_k.d.ts → TinyCloudNode-CIGurdHw.d.cts}

@@ -1,8 +1,9 @@
 import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
-import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, RegistryPolicy, RegistrySequenceStore, OnNodeNotFound, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, RetryPolicy, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
+import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, RegistryPolicy, RegistrySequenceStore, OnNodeNotFound, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, Delegation, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, RetryPolicy, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
 import { ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
 import { InvokeFunction, InvokeAnyFunction, FetchFunction, RequestSink, RequestLogReader } from '@tinycloud/sdk-services';
 import { EventEmitter } from 'events';
+import { P as PortableDelegation, S as SessionGrantProof, g as VerifiedSessionGrant } from './delegation-0LKZkmP2.cjs';
 
 /**
  * Node.js-specific SignStrategy types for TinyCloud authorization.
@@ -795,254 +796,6 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private requestSignatureViaEmitter;
 }
 
-/**
- * A portable delegation that can be transported between users.
- * Extends the base Delegation type with fields required for transport.
- *
- * @remarks
- * PortableDelegation adds transport fields to Delegation:
- * - `delegationHeader`: Structured authorization header for API calls
- * - `ownerAddress`: Space owner's address for session creation
- * - `chainId`: Chain ID for session creation
- * - `host`: Optional server URL
- * - `resources`: Multi-resource grant breakdown (present when the
- *   delegation was issued via the multi-resource WASM path, i.e. one
- *   UCAN covering multiple `(service, path, actions)` entries). The
- *   flat `path` + `actions` fields mirror the first entry for
- *   single-resource callers; consumers that need the full picture
- *   read `resources`.
- */
-interface PortableDelegation extends Omit<Delegation, "isRevoked"> {
-    /** The authorization header for this delegation (structured format) */
-    delegationHeader: {
-        Authorization: string;
-    };
-    /** The address of the space owner */
-    ownerAddress: string;
-    /** The chain ID */
-    chainId: number;
-    /** TinyCloud server URL where this delegation was created */
-    host?: string;
-    /** Whether the recipient is prevented from creating sub-delegations */
-    disableSubDelegation?: boolean;
-    /** Companion delegation for the user's public space (auto-created when includePublicSpace is true) */
-    publicDelegation?: PortableDelegation;
-    /**
-     * Full multi-resource grant breakdown. Present when the delegation
-     * was issued via the multi-resource WASM path; each entry describes
-     * one `(service, space, path, actions)` grant carried by the single
-     * underlying UCAN. When absent, only the flat `path` + `actions`
-     * fields are authoritative (legacy single-resource shape).
-     */
-    resources?: DelegatedResource[];
-    /**
-     * The wallet-signed SIWE message and EIP-191 signature behind a
-     * `delegationHeader` that is a CACAO session grant (OpenKey `/delegate`,
-     * {@link TinyCloudNode.grantRuntimePermissions}) rather than a compact UCAN.
-     * Not authority: activation rebuilds the CACAO from them and accepts only
-     * byte-identical authorization bytes.
-     */
-    siweProof?: {
-        siwe: string;
-        signature: string;
-    };
-}
-/**
- * The transport shape `tc auth request --emit` produces and that an owner
- * grants to its requester. Only the fields the grant logic needs are declared;
- * the CLI artifact carries more (posture, captured command, ...) and remains a
- * structural superset of this interface.
- */
-interface AuthRequestArtifact {
-    kind: "tinycloud.auth.request";
-    version: 1;
-    requestId: string;
-    /** The requester's session DID — the audience the grant is issued to. */
-    sessionDid: string;
-    /** The capabilities the requester is asking the owner to delegate. */
-    requested: PermissionEntry[];
-    /** Optional lifetime override carried from the request. */
-    requestedExpiry?: string | number;
-}
-/**
- * The transport shape returned by {@link grantAuthRequest} (and written by
- * `tc auth grant`). `tc auth import` accepts this artifact directly.
- */
-interface AuthDelegationArtifact {
-    kind: "tinycloud.auth.delegation";
-    version: 1;
-    requestId: string;
-    delegationCid: string;
-    delegation: PortableDelegation;
-    permissions: PermissionEntry[];
-    expiry: string;
-    /** Whether issuing the delegation triggered a wallet prompt. */
-    prompted: boolean;
-}
-/**
- * Minimal owner-side capability {@link grantAuthRequest} needs: the signed
- * `delegateTo` primitive. `TinyCloudNode` satisfies this directly; web/SDK
- * contexts can supply any object that exposes the same method.
- */
-interface DelegationAuthority {
-    delegateTo(did: string, permissions: PermissionEntry[], options?: {
-        expiry?: string | number;
-        forceWalletSign?: boolean;
-    }): Promise<{
-        delegation: PortableDelegation;
-        prompted: boolean;
-    }>;
-}
-/**
- * Authority that the validated runtime-delegation activation helper needs.
- * `TinyCloudNode` implements this surface directly; keeping it structural
- * makes the helper usable by a compatible Node wrapper without exposing node
- * internals.
- */
-interface RuntimeDelegationActivator {
-    readonly sessionDid: string;
-    readonly did?: string;
-    readonly isSessionOnly?: boolean;
-    computeDelegationCid(authorization: string): string;
-    useRuntimeDelegation(delegation: PortableDelegation): Promise<void>;
-    useDelegation?(delegation: PortableDelegation): Promise<unknown>;
-    getRuntimePermissionDelegations(): PortableDelegation[];
-    /**
-     * Verify a wallet-signed session grant issued to this runtime's live session
-     * key. Required to activate a CACAO grant; compact UCANs do not use it.
-     */
-    verifySessionGrant?(grant: SessionGrantProof): VerifiedSessionGrant;
-}
-/** The installed authority returned by {@link activateValidatedRuntimeDelegation}. */
-interface ValidatedRuntimeDelegation {
-    /** CID recomputed from the signed authorization bytes. */
-    readonly cid: string;
-    /** The authority object installed by the node runtime. */
-    readonly delegation: PortableDelegation;
-    /** Capabilities read from the signed compact UCAN attenuation or SIWE ReCap. */
-    readonly effectivePermissions: readonly PermissionEntry[];
-    /** Expiry read from the signed compact UCAN payload or SIWE. */
-    readonly expiry: Date;
-    /** Audience read from the signed compact UCAN payload or SIWE. */
-    readonly audience: string;
-    /** Host selected for, and used by, the runtime activation. */
-    readonly host: string;
-}
-interface CompactRuntimeDelegationInput {
-    readonly authorization: string;
-    readonly cid: string;
-    readonly host: string;
-    readonly ownerAddress: string;
-    readonly chainId: number;
-}
-/** A CACAO session grant and the signed SIWE proof it was built from. */
-interface SessionGrantProof {
-    readonly delegationHeader: {
-        Authorization: string;
-    };
-    readonly delegationCid: string;
-    readonly spaceId: string;
-    readonly address: string;
-    readonly chainId: number;
-    readonly siwe: string;
-    readonly signature: string;
-}
-/** Authority read from a verified session grant's signed ReCap. */
-interface VerifiedSessionGrant {
-    readonly recap: readonly {
-        service: string;
-        space: string;
-        path: string;
-        actions: string[];
-        caveats?: Record<string, unknown>[];
-    }[];
-    readonly expiresAt: Date;
-}
-/**
- * Stable reasons {@link activateValidatedRuntimeDelegation} refuses a
- * delegation for. The error message is for the caller and may quote
- * transport fields or a node's response; the reason is safe to publish.
- */
-declare const RUNTIME_DELEGATION_REJECTIONS: readonly ["host_mismatch", "expired", "cid_mismatch", "authority_invalid", "proof_missing", "proof_invalid", "owner_mismatch", "audience_mismatch", "resources_mismatch", "unsupported", "activation_rejected", "activation_unavailable", "activation_unauthenticated"];
-type RuntimeDelegationRejection = typeof RUNTIME_DELEGATION_REJECTIONS[number];
-declare class RuntimeDelegationRejectedError extends Error {
-    readonly reason: RuntimeDelegationRejection;
-    constructor(reason: RuntimeDelegationRejection, message: string);
-}
-/**
- * The expiry a compact UCAN authorization signs: its payload's `exp`. Reads
- * the bytes the issuer's signature covers without verifying that signature,
- * which the node does. `undefined` when `authorization` is not a compact UCAN
- * or its payload has no finite numeric `exp`; then no local expiry decision
- * can be made (activation refuses such a UCAN).
- */
-declare function signedCompactUcanExpiry(authorization: string): Date | undefined;
-/**
- * CID-bind and activate one runtime delegation.
- *
- * A compact UCAN's audience, expiry and permissions come from its signed
- * payload, and its transport fields must agree with them. A CACAO session
- * grant (OpenKey `/delegate`, `grantRuntimePermissions`) is verified from its
- * `siweProof` against this runtime's live session key; its installed
- * authority is exactly the verified ReCap, and its transport `resources` are
- * display data that is never consulted. Either way the helper then invokes
- * {@link TinyCloudNode.useRuntimeDelegation}; the node activation call remains
- * the authority and delegation-chain validation boundary.
- *
- * `options.authorize`, when given, sees the signed capabilities before
- * anything is activated or installed; returning `false` refuses the
- * delegation.
- */
-declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActivator, delegation: PortableDelegation, options: {
-    host: string;
-    authorize?: (effectivePermissions: readonly PermissionEntry[]) => boolean;
-}): Promise<ValidatedRuntimeDelegation>;
-/**
- * Import compact UCAN bytes returned by an authority ceremony through the
- * ordinary runtime-delegation activation path. All transport projections are
- * derived from signed bytes before `/delegate` is called.
- */
-declare function activateCompactRuntimeDelegation(node: RuntimeDelegationActivator, input: CompactRuntimeDelegationInput): Promise<ValidatedRuntimeDelegation>;
-/**
- * Project an OpenKey signed-login delegation from the same verified CACAO
- * authority used when the runtime activates and replays it.
- */
-declare function siweRuntimeDelegation(node: RuntimeDelegationActivator, input: {
-    readonly authorization: string;
-    readonly cid: string;
-    readonly spaceId: string;
-    readonly ownerAddress: string;
-    readonly chainId: number;
-    readonly siwe: string;
-    readonly signature: string;
-    readonly host: string;
-}): PortableDelegation;
-/**
- * Turn a delegation REQUEST into a signed GRANT.
- *
- * Lifts the body of `tc auth grant` into the SDK so the request→grant
- * handshake is callable programmatically (future SDK/web owner tooling and the
- * KV delegation inbox), with the CLI verb reduced to a thin wrapper. The owner
- * `authority` (a `TinyCloudNode`) signs a delegation scoped to exactly the
- * requested caps, audienced to the requester's `sessionDid`, honoring the
- * request's expiry. The returned artifact round-trips through `tc auth import`.
- *
- * Authorization is enforced cryptographically by `delegateTo`: caps that are
- * not derivable from the owner's own session capability chain are rejected
- * (it throws), so this never widens authority the owner doesn't hold.
- */
-declare function grantAuthRequest(authority: DelegationAuthority, request: AuthRequestArtifact, options?: {
-    expiry?: string | number;
-}): Promise<AuthDelegationArtifact>;
-/**
- * Serialize a PortableDelegation for transport (e.g., over network).
- */
-declare function serializeDelegation(delegation: PortableDelegation): string;
-/**
- * Deserialize a PortableDelegation from transport.
- */
-declare function deserializeDelegation(data: string): PortableDelegation;
-
 /**
  * The handles needed to rehydrate this delegation activation in a fresh
  * `TinyCloudNode` via `TinyCloudNode.restoreSession(...)` in another process
@@ -2895,4 +2648,4 @@ declare class TinyCloudNode {
     }): Promise<PortableDelegation>;
 }
 
-export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CompactRuntimeDelegationInput as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, type UnifiedOwnerRootReceipt as F, UnsupportedSessionRestoreError as G, type VerifiedSessionGrant as H, InvalidRestoredSessionError as I, activateCompactRuntimeDelegation as J, activateValidatedRuntimeDelegation as K, defaultSignStrategy as L, deserializeDelegation as M, type NodeEventEmitterStrategy as N, type OpenKeyAuthorizationResultV1 as O, type PortableDelegation as P, grantAuthRequest as Q, RUNTIME_DELEGATION_REJECTIONS as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type ValidatedRuntimeDelegation as V, serializeDelegation as W, signedCompactUcanExpiry as X, siweRuntimeDelegation as Y, wireOpenKeyAuthorize as Z, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type CreateOwnerDelegationParams as f, type DelegateToResult as g, DelegatedAccess as h, type DelegationAuthority as i, NodeUserAuthorization as j, type NodeUserAuthorizationAuthorizeFn as k, type NodeUserAuthorizationConfig as l, type OpenKeyAuthorizeInput as m, type OpenKeyAuthorizeTinyCloud as n, type OpenKeyBridgeInput as o, type OwnerDelegationReceipt as p, type RestorableSession as q, type RuntimeDelegationActivator as r, RuntimeDelegationRejectedError as s, type RuntimeDelegationRejection as t, type RuntimePermissionGrantOptions as u, type SecretReadInput as v, type SecretReadResult as w, type SessionGrantProof as x, type SignStrategy as y, type TinyCloudNodeConfig as z };
+export { ACCEPTED_MARKER_VERSIONS as A, type BootstrapWarning as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, InvalidRestoredSessionError as I, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type RuntimePermissionGrantOptions as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type DelegateToResult as a, DelegatedAccess as b, NodeUserAuthorization as c, type NodeUserAuthorizationConfig as d, type SecretReadInput as e, type SecretReadResult as f, type SignStrategy as g, type TinyCloudNodeConfig as h, type UnifiedOwnerRootReceipt as i, UnsupportedSessionRestoreError as j, defaultSignStrategy as k, BOOTSTRAP_COMPLETION_MARKER_KEY as l, BOOTSTRAP_COMPLETION_MARKER_VERSION as m, type BootstrapCompletionMarker as n, type NodeUserAuthorizationAuthorizeFn as o, type OpenKeyAuthorizationResultV1 as p, type OpenKeyAuthorizeInput as q, type OpenKeyAuthorizeTinyCloud as r, type OpenKeyBridgeInput as s, type RestorableSession as t, wireOpenKeyAuthorize as w };

package/dist/{authority-BgZpUFss.d.cts → authority-Beg1WM2U.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-N4mfZI_k.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-CIGurdHw.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/{authority-C670-9su.d.ts → authority-Vh7ike0I.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-N4mfZI_k.js';
+import { T as TinyCloudNode } from './TinyCloudNode-B5WCe_ps.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/core.d.cts

@@ -1,11 +1,12 @@
 import { ReplicationOptions } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
 import { _ as __gated_network } from './gated-network-BEF2XSTC.cjs';
-import { _ as __authority } from './authority-BgZpUFss.cjs';
+import { _ as __authority } from './authority-Beg1WM2U.cjs';
 import { _ as __runtime } from './runtime-D1o9Eybt.cjs';
 import { ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
 export { F as FileSessionStorage, M as MemorySessionStorage, W as WasmKeyProvider, a as WasmKeyProviderConfig, c as createWasmKeyProvider } from './WasmKeyProvider-5Ee7fcAw.cjs';
-export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, l as NodeUserAuthorizationConfig, p as OwnerDelegationReceipt, P as PortableDelegation, u as RuntimePermissionGrantOptions, S as SecretPermissionHint, v as SecretReadInput, w as SecretReadResult, y as SignStrategy, T as TinyCloudNode, z as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, F as UnifiedOwnerRootReceipt, G as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, J as activateCompactRuntimeDelegation, L as defaultSignStrategy, M as deserializeDelegation, W as serializeDelegation } from './TinyCloudNode-N4mfZI_k.cjs';
+export { B as BootstrapWarning, C as CreateOwnerDelegationParams, D as DelegateToOptions, a as DelegateToResult, b as DelegatedAccess, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, c as NodeUserAuthorization, d as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, R as RuntimePermissionGrantOptions, S as SecretPermissionHint, e as SecretReadInput, f as SecretReadResult, g as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, i as UnifiedOwnerRootReceipt, j as UnsupportedSessionRestoreError, k as defaultSignStrategy } from './TinyCloudNode-CIGurdHw.cjs';
+export { C as CompactRuntimeDelegationInput, P as PortableDelegation, V as ValidatedRuntimeDelegation, a as activateCompactRuntimeDelegation, d as deserializeDelegation, s as serializeDelegation } from './delegation-0LKZkmP2.cjs';
 import '@tinycloud/sdk-services';
 import 'events';
 

package/dist/core.d.ts

@@ -1,11 +1,12 @@
 import { ReplicationOptions } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
 import { _ as __gated_network } from './gated-network-BEF2XSTC.js';
-import { _ as __authority } from './authority-C670-9su.js';
+import { _ as __authority } from './authority-Vh7ike0I.js';
 import { _ as __runtime } from './runtime-v62FzQHz.js';
 import { ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
 export { F as FileSessionStorage, M as MemorySessionStorage, W as WasmKeyProvider, a as WasmKeyProviderConfig, c as createWasmKeyProvider } from './WasmKeyProvider-5Ee7fcAw.js';
-export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, l as NodeUserAuthorizationConfig, p as OwnerDelegationReceipt, P as PortableDelegation, u as RuntimePermissionGrantOptions, S as SecretPermissionHint, v as SecretReadInput, w as SecretReadResult, y as SignStrategy, T as TinyCloudNode, z as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, F as UnifiedOwnerRootReceipt, G as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, J as activateCompactRuntimeDelegation, L as defaultSignStrategy, M as deserializeDelegation, W as serializeDelegation } from './TinyCloudNode-N4mfZI_k.js';
+export { B as BootstrapWarning, C as CreateOwnerDelegationParams, D as DelegateToOptions, a as DelegateToResult, b as DelegatedAccess, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, c as NodeUserAuthorization, d as NodeUserAuthorizationConfig, O as OwnerDelegationReceipt, R as RuntimePermissionGrantOptions, S as SecretPermissionHint, e as SecretReadInput, f as SecretReadResult, g as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, i as UnifiedOwnerRootReceipt, j as UnsupportedSessionRestoreError, k as defaultSignStrategy } from './TinyCloudNode-B5WCe_ps.js';
+export { C as CompactRuntimeDelegationInput, P as PortableDelegation, V as ValidatedRuntimeDelegation, a as activateCompactRuntimeDelegation, d as deserializeDelegation, s as serializeDelegation } from './delegation-0LKZkmP2.js';
 import '@tinycloud/sdk-services';
 import 'events';