@tinycloud/node-sdk 3.6.0-beta.3 → 3.6.0-beta.5

package/dist/delegation-0LKZkmP2.d.ts

@@ -0,0 +1,251 @@
+import { Delegation, DelegatedResource, PermissionEntry } from '@tinycloud/sdk-core';
+
+/**
+ * A portable delegation that can be transported between users.
+ * Extends the base Delegation type with fields required for transport.
+ *
+ * @remarks
+ * PortableDelegation adds transport fields to Delegation:
+ * - `delegationHeader`: Structured authorization header for API calls
+ * - `ownerAddress`: Space owner's address for session creation
+ * - `chainId`: Chain ID for session creation
+ * - `host`: Optional server URL
+ * - `resources`: Multi-resource grant breakdown (present when the
+ *   delegation was issued via the multi-resource WASM path, i.e. one
+ *   UCAN covering multiple `(service, path, actions)` entries). The
+ *   flat `path` + `actions` fields mirror the first entry for
+ *   single-resource callers; consumers that need the full picture
+ *   read `resources`.
+ */
+interface PortableDelegation extends Omit<Delegation, "isRevoked"> {
+    /** The authorization header for this delegation (structured format) */
+    delegationHeader: {
+        Authorization: string;
+    };
+    /** The address of the space owner */
+    ownerAddress: string;
+    /** The chain ID */
+    chainId: number;
+    /** TinyCloud server URL where this delegation was created */
+    host?: string;
+    /** Whether the recipient is prevented from creating sub-delegations */
+    disableSubDelegation?: boolean;
+    /** Companion delegation for the user's public space (auto-created when includePublicSpace is true) */
+    publicDelegation?: PortableDelegation;
+    /**
+     * Full multi-resource grant breakdown. Present when the delegation
+     * was issued via the multi-resource WASM path; each entry describes
+     * one `(service, space, path, actions)` grant carried by the single
+     * underlying UCAN. When absent, only the flat `path` + `actions`
+     * fields are authoritative (legacy single-resource shape).
+     */
+    resources?: DelegatedResource[];
+    /**
+     * The wallet-signed SIWE message and EIP-191 signature behind a
+     * `delegationHeader` that is a CACAO session grant (OpenKey `/delegate`,
+     * {@link TinyCloudNode.grantRuntimePermissions}) rather than a compact UCAN.
+     * Not authority: activation rebuilds the CACAO from them and accepts only
+     * byte-identical authorization bytes.
+     */
+    siweProof?: {
+        siwe: string;
+        signature: string;
+    };
+}
+/**
+ * The transport shape `tc auth request --emit` produces and that an owner
+ * grants to its requester. Only the fields the grant logic needs are declared;
+ * the CLI artifact carries more (posture, captured command, ...) and remains a
+ * structural superset of this interface.
+ */
+interface AuthRequestArtifact {
+    kind: "tinycloud.auth.request";
+    version: 1;
+    requestId: string;
+    /** The requester's session DID — the audience the grant is issued to. */
+    sessionDid: string;
+    /** The capabilities the requester is asking the owner to delegate. */
+    requested: PermissionEntry[];
+    /** Optional lifetime override carried from the request. */
+    requestedExpiry?: string | number;
+}
+/**
+ * The transport shape returned by {@link grantAuthRequest} (and written by
+ * `tc auth grant`). `tc auth import` accepts this artifact directly.
+ */
+interface AuthDelegationArtifact {
+    kind: "tinycloud.auth.delegation";
+    version: 1;
+    requestId: string;
+    delegationCid: string;
+    delegation: PortableDelegation;
+    permissions: PermissionEntry[];
+    expiry: string;
+    /** Whether issuing the delegation triggered a wallet prompt. */
+    prompted: boolean;
+}
+/**
+ * Minimal owner-side capability {@link grantAuthRequest} needs: the signed
+ * `delegateTo` primitive. `TinyCloudNode` satisfies this directly; web/SDK
+ * contexts can supply any object that exposes the same method.
+ */
+interface DelegationAuthority {
+    delegateTo(did: string, permissions: PermissionEntry[], options?: {
+        expiry?: string | number;
+        forceWalletSign?: boolean;
+    }): Promise<{
+        delegation: PortableDelegation;
+        prompted: boolean;
+    }>;
+}
+/**
+ * Authority that the validated runtime-delegation activation helper needs.
+ * `TinyCloudNode` implements this surface directly; keeping it structural
+ * makes the helper usable by a compatible Node wrapper without exposing node
+ * internals.
+ */
+interface RuntimeDelegationActivator {
+    readonly sessionDid: string;
+    readonly did?: string;
+    readonly isSessionOnly?: boolean;
+    computeDelegationCid(authorization: string): string;
+    useRuntimeDelegation(delegation: PortableDelegation): Promise<void>;
+    useDelegation?(delegation: PortableDelegation): Promise<unknown>;
+    getRuntimePermissionDelegations(): PortableDelegation[];
+    /**
+     * Verify a wallet-signed session grant issued to this runtime's live session
+     * key. Required to activate a CACAO grant; compact UCANs do not use it.
+     */
+    verifySessionGrant?(grant: SessionGrantProof): VerifiedSessionGrant;
+}
+/** The installed authority returned by {@link activateValidatedRuntimeDelegation}. */
+interface ValidatedRuntimeDelegation {
+    /** CID recomputed from the signed authorization bytes. */
+    readonly cid: string;
+    /** The authority object installed by the node runtime. */
+    readonly delegation: PortableDelegation;
+    /** Capabilities read from the signed compact UCAN attenuation or SIWE ReCap. */
+    readonly effectivePermissions: readonly PermissionEntry[];
+    /** Expiry read from the signed compact UCAN payload or SIWE. */
+    readonly expiry: Date;
+    /** Audience read from the signed compact UCAN payload or SIWE. */
+    readonly audience: string;
+    /** Host selected for, and used by, the runtime activation. */
+    readonly host: string;
+}
+interface CompactRuntimeDelegationInput {
+    readonly authorization: string;
+    readonly cid: string;
+    readonly host: string;
+    readonly ownerAddress: string;
+    readonly chainId: number;
+}
+/** A CACAO session grant and the signed SIWE proof it was built from. */
+interface SessionGrantProof {
+    readonly delegationHeader: {
+        Authorization: string;
+    };
+    readonly delegationCid: string;
+    readonly spaceId: string;
+    readonly address: string;
+    readonly chainId: number;
+    readonly siwe: string;
+    readonly signature: string;
+}
+/** Authority read from a verified session grant's signed ReCap. */
+interface VerifiedSessionGrant {
+    readonly recap: readonly {
+        service: string;
+        space: string;
+        path: string;
+        actions: string[];
+        caveats?: Record<string, unknown>[];
+    }[];
+    readonly expiresAt: Date;
+}
+/**
+ * Stable reasons {@link activateValidatedRuntimeDelegation} refuses a
+ * delegation for. The error message is for the caller and may quote
+ * transport fields or a node's response; the reason is safe to publish.
+ */
+declare const RUNTIME_DELEGATION_REJECTIONS: readonly ["host_mismatch", "expired", "cid_mismatch", "authority_invalid", "proof_missing", "proof_invalid", "owner_mismatch", "audience_mismatch", "resources_mismatch", "unsupported", "activation_rejected", "activation_unavailable", "activation_unauthenticated"];
+type RuntimeDelegationRejection = typeof RUNTIME_DELEGATION_REJECTIONS[number];
+declare class RuntimeDelegationRejectedError extends Error {
+    readonly reason: RuntimeDelegationRejection;
+    constructor(reason: RuntimeDelegationRejection, message: string);
+}
+/**
+ * The expiry a compact UCAN authorization signs: its payload's `exp`. Reads
+ * the bytes the issuer's signature covers without verifying that signature,
+ * which the node does. `undefined` when `authorization` is not a compact UCAN
+ * or its payload has no finite numeric `exp`; then no local expiry decision
+ * can be made (activation refuses such a UCAN).
+ */
+declare function signedCompactUcanExpiry(authorization: string): Date | undefined;
+/**
+ * CID-bind and activate one runtime delegation.
+ *
+ * A compact UCAN's audience, expiry and permissions come from its signed
+ * payload, and its transport fields must agree with them. A CACAO session
+ * grant (OpenKey `/delegate`, `grantRuntimePermissions`) is verified from its
+ * `siweProof` against this runtime's live session key; its installed
+ * authority is exactly the verified ReCap, and its transport `resources` are
+ * display data that is never consulted. Either way the helper then invokes
+ * {@link TinyCloudNode.useRuntimeDelegation}; the node activation call remains
+ * the authority and delegation-chain validation boundary.
+ *
+ * `options.authorize`, when given, sees the signed capabilities before
+ * anything is activated or installed; returning `false` refuses the
+ * delegation.
+ */
+declare function activateValidatedRuntimeDelegation(node: RuntimeDelegationActivator, delegation: PortableDelegation, options: {
+    host: string;
+    authorize?: (effectivePermissions: readonly PermissionEntry[]) => boolean;
+}): Promise<ValidatedRuntimeDelegation>;
+/**
+ * Import compact UCAN bytes returned by an authority ceremony through the
+ * ordinary runtime-delegation activation path. All transport projections are
+ * derived from signed bytes before `/delegate` is called.
+ */
+declare function activateCompactRuntimeDelegation(node: RuntimeDelegationActivator, input: CompactRuntimeDelegationInput): Promise<ValidatedRuntimeDelegation>;
+/**
+ * Project an OpenKey signed-login delegation from the same verified CACAO
+ * authority used when the runtime activates and replays it.
+ */
+declare function siweRuntimeDelegation(node: RuntimeDelegationActivator, input: {
+    readonly authorization: string;
+    readonly cid: string;
+    readonly spaceId: string;
+    readonly ownerAddress: string;
+    readonly chainId: number;
+    readonly siwe: string;
+    readonly signature: string;
+    readonly host: string;
+}): PortableDelegation;
+/**
+ * Turn a delegation REQUEST into a signed GRANT.
+ *
+ * Lifts the body of `tc auth grant` into the SDK so the request→grant
+ * handshake is callable programmatically (future SDK/web owner tooling and the
+ * KV delegation inbox), with the CLI verb reduced to a thin wrapper. The owner
+ * `authority` (a `TinyCloudNode`) signs a delegation scoped to exactly the
+ * requested caps, audienced to the requester's `sessionDid`, honoring the
+ * request's expiry. The returned artifact round-trips through `tc auth import`.
+ *
+ * Authorization is enforced cryptographically by `delegateTo`: caps that are
+ * not derivable from the owner's own session capability chain are rejected
+ * (it throws), so this never widens authority the owner doesn't hold.
+ */
+declare function grantAuthRequest(authority: DelegationAuthority, request: AuthRequestArtifact, options?: {
+    expiry?: string | number;
+}): Promise<AuthDelegationArtifact>;
+/**
+ * Serialize a PortableDelegation for transport (e.g., over network).
+ */
+declare function serializeDelegation(delegation: PortableDelegation): string;
+/**
+ * Deserialize a PortableDelegation from transport.
+ */
+declare function deserializeDelegation(data: string): PortableDelegation;
+
+export { type AuthDelegationArtifact as A, type CompactRuntimeDelegationInput as C, type DelegationAuthority as D, type PortableDelegation as P, RUNTIME_DELEGATION_REJECTIONS as R, type SessionGrantProof as S, type ValidatedRuntimeDelegation as V, activateCompactRuntimeDelegation as a, type AuthRequestArtifact as b, type RuntimeDelegationActivator as c, deserializeDelegation as d, RuntimeDelegationRejectedError as e, type RuntimeDelegationRejection as f, type VerifiedSessionGrant as g, activateValidatedRuntimeDelegation as h, grantAuthRequest as i, signedCompactUcanExpiry as j, siweRuntimeDelegation as k, serializeDelegation as s };

package/dist/email-proof-Blhdm4ox.d.cts

@@ -0,0 +1,155 @@
+import { IssuedCredentialEnvelope, VerifiedCredential, CredentialRequirement } from '@tinycloud/sdk-core';
+
+declare const EMAIL_PROOF_CREDENTIAL_TYPE: {
+    readonly id: "opencredentials.email/v1";
+    readonly version: 1;
+};
+/** A pending request is never trusted beyond this window, measured from creation. */
+declare const EMAIL_PROOF_PENDING_MAX_MS: number;
+type EmailProofProfileId = "tinycloud.email-proof/v1";
+declare const DEFAULT_EMAIL_PROOF_PROFILE: EmailProofProfileId;
+/** Which part of the two-step flow failed. */
+type EmailProofStep = "request" | "code" | "credential" | "session";
+/**
+ * Stable error codes. `recoverable` = the same pending request may be retried
+ * (with another code, or after the network returns) before it expires.
+ *
+ * | code                    | recoverable | reason |
+ * |-------------------------|-------------|--------|
+ * | ADDRESS_INVALID         | false       | input is malformed; the same address cannot succeed |
+ * | HOLDER_INVALID          | false       | holder key is not an Ed25519 did:key with a matching kid |
+ * | CODE_INVALID            | true        | local format check (8 digits); no network; pending kept |
+ * | RATE_LIMITED            | witness     | witness `recoverable` flag decides (defaults to true); retryAfterMs set |
+ * | ISSUER_UNAVAILABLE      | true        | transient issuer outage (503); witness flag is honoured |
+ * | NETWORK                 | true        | transport failure or step timeout; pending kept |
+ * | PROFILE_UNAVAILABLE     | false       | catalog or descriptor does not match the pinned profile |
+ * | CODE_REJECTED           | true        | wrong code; witness flag decides whether another attempt is allowed |
+ * | CODE_ATTEMPTS_EXHAUSTED | false       | witness proof-attempt budget spent; pending is dead |
+ * | SIGNATURE_REJECTED      | true        | holder binding rejected; same pending may be retried |
+ * | CREDENTIAL_INVALID      | false       | issued credential failed local verification |
+ * | SESSION_EXPIRED         | false       | pending window or server expiry has passed |
+ * | SESSION_INVALID         | false       | pending does not match holder, descriptor, or requirement |
+ * | CANCELED                | false       | caller aborted; pending is deleted |
+ * | FAILED                  | false       | unclassified failure; pending is deleted |
+ */
+type EmailProofErrorCode = "ADDRESS_INVALID" | "HOLDER_INVALID" | "CODE_INVALID" | "RATE_LIMITED" | "ISSUER_UNAVAILABLE" | "NETWORK" | "PROFILE_UNAVAILABLE" | "CODE_REJECTED" | "CODE_ATTEMPTS_EXHAUSTED" | "SIGNATURE_REJECTED" | "CREDENTIAL_INVALID" | "SESSION_EXPIRED" | "SESSION_INVALID" | "CANCELED" | "FAILED";
+/** Stable, redaction-safe error. The message never includes the code, verifier, or key material. */
+declare class EmailProofError extends Error {
+    readonly name = "EmailProofError";
+    readonly step: EmailProofStep;
+    readonly code: EmailProofErrorCode;
+    readonly retryAfterMs: number | undefined;
+    readonly recoverable: boolean;
+    constructor(step: EmailProofStep, code: EmailProofErrorCode, retryAfterMs?: number, recoverable?: boolean);
+}
+type HolderAlgorithm = "EdDSA" | "EIP191";
+/**
+ * Holder key adapter. `sign` MUST return a raw signature over exactly the bytes it
+ * is given: the signer does no hashing, prefixing, or domain separation. `kid` names
+ * the key the witness verifies against. `completeEmailProof` rejects with
+ * SESSION_INVALID unless `did === pending.holderDid`.
+ */
+interface HolderSigner {
+    readonly did: string;
+    readonly alg: HolderAlgorithm;
+    readonly kid: string;
+    readonly sign: (bytes: Uint8Array) => Promise<Uint8Array>;
+}
+/**
+ * Ed25519 did:key holder. Accepts `did:key:z6Mk…` or `did:key:z6Mk…#<same multibase>`
+ * (the session-manager form) and normalises to the bare DID. `kid` is derived from the bare DID.
+ */
+declare function createEd25519HolderSigner(did: string, sign: (bytes: Uint8Array) => Promise<Uint8Array>): HolderSigner;
+/** Options shared by the public steps. Issuer keys are never caller-supplied. */
+interface EmailProofOptions {
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+    readonly now?: () => Date;
+}
+interface EmailProofRequestInput extends EmailProofOptions {
+    readonly address: string;
+    readonly holder: HolderSigner;
+    readonly profile?: EmailProofProfileId;
+}
+/**
+ * Durable state between `requestEmailProofCode` and `completeEmailProof`.
+ * `verifier` is a bearer secret. It is a non-enumerable property, so spread
+ * omits it; `toJSON` and `util.inspect` redact it. Persist it only with owner-only storage.
+ */
+interface EmailProofPending {
+    readonly type: "TinyCloudEmailProofPending";
+    readonly version: 1;
+    readonly profile: EmailProofProfileId;
+    readonly address: string;
+    readonly requestId: string;
+    readonly verifier: string;
+    readonly holderDid: string;
+    readonly descriptorDigest: string;
+    readonly requirementDigest: string;
+    readonly openerOrigin: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+}
+/** Holds pending requests keyed by requestId. Implementations must never return an expired request from `findLive`. */
+interface EmailProofPendingStore {
+    /** Newest unexpired request for `address`, or undefined. */
+    findLive(address: string, now: Date): Promise<EmailProofPending | undefined>;
+    put(pending: EmailProofPending): Promise<void>;
+    delete(requestId: string): Promise<void>;
+    /** Pending request by id, or undefined if absent or past its deadline. */
+    get(requestId: string, now: Date): Promise<EmailProofPending | undefined>;
+}
+/** Process-local pending store for browsers and tests. Nothing survives a reload. */
+declare function createMemoryEmailProofPendingStore(): EmailProofPendingStore;
+interface EmailProofResult {
+    readonly envelope: IssuedCredentialEnvelope;
+    readonly verified: VerifiedCredential;
+    readonly credentialId: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+interface EmailProofAcquireInput extends EmailProofRequestInput {
+    /** Supplies the 8-digit code. Omit to only request one; the pending request is returned for a later call. */
+    readonly getCode?: (context: {
+        readonly pending: EmailProofPending;
+    }) => Promise<string>;
+    /** Resumes an unexpired pending request for this address, and keeps one across recoverable failures. */
+    readonly pendingStore?: EmailProofPendingStore;
+}
+type EmailProofAcquisition = {
+    readonly status: "issued";
+    readonly result: EmailProofResult; /** Non-fatal, e.g. the pending record could not be deleted after success. */
+    readonly warnings: readonly string[];
+} | {
+    readonly status: "code-requested";
+    readonly pending: EmailProofPending;
+};
+/**
+ * Step 1: start an email-proof request. The witness sends an 8-digit code to
+ * `address`. Returns the pending state to persist until the owner supplies the code.
+ */
+declare function requestEmailProofCode(input: EmailProofRequestInput): Promise<EmailProofPending>;
+/**
+ * Step 2: submit the owner's 8-digit code, sign the holder binding, issue, and
+ * verify. The caller must delete `pending` after this call, success or failure.
+ */
+declare function completeEmailProof(input: EmailProofOptions & {
+    readonly pending: EmailProofPending;
+    readonly code: string;
+    readonly holder: HolderSigner;
+}): Promise<EmailProofResult>;
+/**
+ * Request a code and, when `getCode` is given, complete the flow in one call.
+ * With a `pendingStore`, an unexpired request for the address is resumed instead of
+ * requesting a new code. A non-recoverable failure deletes the pending request.
+ *
+ * `store.put` throwing after the code was mailed: the code is in the owner's inbox but
+ * not persisted, so the error propagates and the owner must request a new code.
+ * `store.delete` failing after success: the credential is returned with a warning.
+ * `store.delete` failing on a non-recoverable failure: the original error propagates.
+ */
+declare function acquireEmailProof(input: EmailProofAcquireInput): Promise<EmailProofAcquisition>;
+/** Requirement for an email credential issued to `address` under the default profile. Storage and `show` key on its digest. */
+declare function emailProofRequirement(address: string): CredentialRequirement;
+
+export { DEFAULT_EMAIL_PROOF_PROFILE as D, EMAIL_PROOF_CREDENTIAL_TYPE as E, type HolderAlgorithm as H, EMAIL_PROOF_PENDING_MAX_MS as a, type EmailProofAcquireInput as b, type EmailProofAcquisition as c, EmailProofError as d, type EmailProofErrorCode as e, type EmailProofOptions as f, type EmailProofPending as g, type EmailProofPendingStore as h, type EmailProofProfileId as i, type EmailProofRequestInput as j, type EmailProofResult as k, type EmailProofStep as l, type HolderSigner as m, acquireEmailProof as n, completeEmailProof as o, createEd25519HolderSigner as p, createMemoryEmailProofPendingStore as q, emailProofRequirement as r, requestEmailProofCode as s };

package/dist/email-proof-Blhdm4ox.d.ts

@@ -0,0 +1,155 @@
+import { IssuedCredentialEnvelope, VerifiedCredential, CredentialRequirement } from '@tinycloud/sdk-core';
+
+declare const EMAIL_PROOF_CREDENTIAL_TYPE: {
+    readonly id: "opencredentials.email/v1";
+    readonly version: 1;
+};
+/** A pending request is never trusted beyond this window, measured from creation. */
+declare const EMAIL_PROOF_PENDING_MAX_MS: number;
+type EmailProofProfileId = "tinycloud.email-proof/v1";
+declare const DEFAULT_EMAIL_PROOF_PROFILE: EmailProofProfileId;
+/** Which part of the two-step flow failed. */
+type EmailProofStep = "request" | "code" | "credential" | "session";
+/**
+ * Stable error codes. `recoverable` = the same pending request may be retried
+ * (with another code, or after the network returns) before it expires.
+ *
+ * | code                    | recoverable | reason |
+ * |-------------------------|-------------|--------|
+ * | ADDRESS_INVALID         | false       | input is malformed; the same address cannot succeed |
+ * | HOLDER_INVALID          | false       | holder key is not an Ed25519 did:key with a matching kid |
+ * | CODE_INVALID            | true        | local format check (8 digits); no network; pending kept |
+ * | RATE_LIMITED            | witness     | witness `recoverable` flag decides (defaults to true); retryAfterMs set |
+ * | ISSUER_UNAVAILABLE      | true        | transient issuer outage (503); witness flag is honoured |
+ * | NETWORK                 | true        | transport failure or step timeout; pending kept |
+ * | PROFILE_UNAVAILABLE     | false       | catalog or descriptor does not match the pinned profile |
+ * | CODE_REJECTED           | true        | wrong code; witness flag decides whether another attempt is allowed |
+ * | CODE_ATTEMPTS_EXHAUSTED | false       | witness proof-attempt budget spent; pending is dead |
+ * | SIGNATURE_REJECTED      | true        | holder binding rejected; same pending may be retried |
+ * | CREDENTIAL_INVALID      | false       | issued credential failed local verification |
+ * | SESSION_EXPIRED         | false       | pending window or server expiry has passed |
+ * | SESSION_INVALID         | false       | pending does not match holder, descriptor, or requirement |
+ * | CANCELED                | false       | caller aborted; pending is deleted |
+ * | FAILED                  | false       | unclassified failure; pending is deleted |
+ */
+type EmailProofErrorCode = "ADDRESS_INVALID" | "HOLDER_INVALID" | "CODE_INVALID" | "RATE_LIMITED" | "ISSUER_UNAVAILABLE" | "NETWORK" | "PROFILE_UNAVAILABLE" | "CODE_REJECTED" | "CODE_ATTEMPTS_EXHAUSTED" | "SIGNATURE_REJECTED" | "CREDENTIAL_INVALID" | "SESSION_EXPIRED" | "SESSION_INVALID" | "CANCELED" | "FAILED";
+/** Stable, redaction-safe error. The message never includes the code, verifier, or key material. */
+declare class EmailProofError extends Error {
+    readonly name = "EmailProofError";
+    readonly step: EmailProofStep;
+    readonly code: EmailProofErrorCode;
+    readonly retryAfterMs: number | undefined;
+    readonly recoverable: boolean;
+    constructor(step: EmailProofStep, code: EmailProofErrorCode, retryAfterMs?: number, recoverable?: boolean);
+}
+type HolderAlgorithm = "EdDSA" | "EIP191";
+/**
+ * Holder key adapter. `sign` MUST return a raw signature over exactly the bytes it
+ * is given: the signer does no hashing, prefixing, or domain separation. `kid` names
+ * the key the witness verifies against. `completeEmailProof` rejects with
+ * SESSION_INVALID unless `did === pending.holderDid`.
+ */
+interface HolderSigner {
+    readonly did: string;
+    readonly alg: HolderAlgorithm;
+    readonly kid: string;
+    readonly sign: (bytes: Uint8Array) => Promise<Uint8Array>;
+}
+/**
+ * Ed25519 did:key holder. Accepts `did:key:z6Mk…` or `did:key:z6Mk…#<same multibase>`
+ * (the session-manager form) and normalises to the bare DID. `kid` is derived from the bare DID.
+ */
+declare function createEd25519HolderSigner(did: string, sign: (bytes: Uint8Array) => Promise<Uint8Array>): HolderSigner;
+/** Options shared by the public steps. Issuer keys are never caller-supplied. */
+interface EmailProofOptions {
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+    readonly now?: () => Date;
+}
+interface EmailProofRequestInput extends EmailProofOptions {
+    readonly address: string;
+    readonly holder: HolderSigner;
+    readonly profile?: EmailProofProfileId;
+}
+/**
+ * Durable state between `requestEmailProofCode` and `completeEmailProof`.
+ * `verifier` is a bearer secret. It is a non-enumerable property, so spread
+ * omits it; `toJSON` and `util.inspect` redact it. Persist it only with owner-only storage.
+ */
+interface EmailProofPending {
+    readonly type: "TinyCloudEmailProofPending";
+    readonly version: 1;
+    readonly profile: EmailProofProfileId;
+    readonly address: string;
+    readonly requestId: string;
+    readonly verifier: string;
+    readonly holderDid: string;
+    readonly descriptorDigest: string;
+    readonly requirementDigest: string;
+    readonly openerOrigin: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+}
+/** Holds pending requests keyed by requestId. Implementations must never return an expired request from `findLive`. */
+interface EmailProofPendingStore {
+    /** Newest unexpired request for `address`, or undefined. */
+    findLive(address: string, now: Date): Promise<EmailProofPending | undefined>;
+    put(pending: EmailProofPending): Promise<void>;
+    delete(requestId: string): Promise<void>;
+    /** Pending request by id, or undefined if absent or past its deadline. */
+    get(requestId: string, now: Date): Promise<EmailProofPending | undefined>;
+}
+/** Process-local pending store for browsers and tests. Nothing survives a reload. */
+declare function createMemoryEmailProofPendingStore(): EmailProofPendingStore;
+interface EmailProofResult {
+    readonly envelope: IssuedCredentialEnvelope;
+    readonly verified: VerifiedCredential;
+    readonly credentialId: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+interface EmailProofAcquireInput extends EmailProofRequestInput {
+    /** Supplies the 8-digit code. Omit to only request one; the pending request is returned for a later call. */
+    readonly getCode?: (context: {
+        readonly pending: EmailProofPending;
+    }) => Promise<string>;
+    /** Resumes an unexpired pending request for this address, and keeps one across recoverable failures. */
+    readonly pendingStore?: EmailProofPendingStore;
+}
+type EmailProofAcquisition = {
+    readonly status: "issued";
+    readonly result: EmailProofResult; /** Non-fatal, e.g. the pending record could not be deleted after success. */
+    readonly warnings: readonly string[];
+} | {
+    readonly status: "code-requested";
+    readonly pending: EmailProofPending;
+};
+/**
+ * Step 1: start an email-proof request. The witness sends an 8-digit code to
+ * `address`. Returns the pending state to persist until the owner supplies the code.
+ */
+declare function requestEmailProofCode(input: EmailProofRequestInput): Promise<EmailProofPending>;
+/**
+ * Step 2: submit the owner's 8-digit code, sign the holder binding, issue, and
+ * verify. The caller must delete `pending` after this call, success or failure.
+ */
+declare function completeEmailProof(input: EmailProofOptions & {
+    readonly pending: EmailProofPending;
+    readonly code: string;
+    readonly holder: HolderSigner;
+}): Promise<EmailProofResult>;
+/**
+ * Request a code and, when `getCode` is given, complete the flow in one call.
+ * With a `pendingStore`, an unexpired request for the address is resumed instead of
+ * requesting a new code. A non-recoverable failure deletes the pending request.
+ *
+ * `store.put` throwing after the code was mailed: the code is in the owner's inbox but
+ * not persisted, so the error propagates and the owner must request a new code.
+ * `store.delete` failing after success: the credential is returned with a warning.
+ * `store.delete` failing on a non-recoverable failure: the original error propagates.
+ */
+declare function acquireEmailProof(input: EmailProofAcquireInput): Promise<EmailProofAcquisition>;
+/** Requirement for an email credential issued to `address` under the default profile. Storage and `show` key on its digest. */
+declare function emailProofRequirement(address: string): CredentialRequirement;
+
+export { DEFAULT_EMAIL_PROOF_PROFILE as D, EMAIL_PROOF_CREDENTIAL_TYPE as E, type HolderAlgorithm as H, EMAIL_PROOF_PENDING_MAX_MS as a, type EmailProofAcquireInput as b, type EmailProofAcquisition as c, EmailProofError as d, type EmailProofErrorCode as e, type EmailProofOptions as f, type EmailProofPending as g, type EmailProofPendingStore as h, type EmailProofProfileId as i, type EmailProofRequestInput as j, type EmailProofResult as k, type EmailProofStep as l, type HolderSigner as m, acquireEmailProof as n, completeEmailProof as o, createEd25519HolderSigner as p, createMemoryEmailProofPendingStore as q, emailProofRequirement as r, requestEmailProofCode as s };

package/dist/index.d.cts

@@ -1,8 +1,9 @@
 import { ISigner, Bytes, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IStorageService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, StoredDelegationChain, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, appSecretScope, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, isStorageFullError, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
 export { F as FileSessionStorage, M as MemorySessionStorage, W as WasmKeyProvider, a as WasmKeyProviderConfig, c as createWasmKeyProvider } from './WasmKeyProvider-5Ee7fcAw.cjs';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationAuthorizeFn, l as NodeUserAuthorizationConfig, O as OpenKeyAuthorizationResultV1, m as OpenKeyAuthorizeInput, n as OpenKeyAuthorizeTinyCloud, o as OpenKeyBridgeInput, p as OwnerDelegationReceipt, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, q as RestorableSession, r as RuntimeDelegationActivator, s as RuntimeDelegationRejectedError, t as RuntimeDelegationRejection, u as RuntimePermissionGrantOptions, S as SecretPermissionHint, v as SecretReadInput, w as SecretReadResult, x as SessionGrantProof, y as SignStrategy, T as TinyCloudNode, z as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, F as UnifiedOwnerRootReceipt, G as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, H as VerifiedSessionGrant, J as activateCompactRuntimeDelegation, K as activateValidatedRuntimeDelegation, L as defaultSignStrategy, M as deserializeDelegation, Q as grantAuthRequest, W as serializeDelegation, X as signedCompactUcanExpiry, Y as siweRuntimeDelegation, Z as wireOpenKeyAuthorize } from './TinyCloudNode-N4mfZI_k.cjs';
+export { A as ACCEPTED_MARKER_VERSIONS, l as BOOTSTRAP_COMPLETION_MARKER_KEY, m as BOOTSTRAP_COMPLETION_MARKER_VERSION, n as BootstrapCompletionMarker, B as BootstrapWarning, C as CreateOwnerDelegationParams, D as DelegateToOptions, a as DelegateToResult, b as DelegatedAccess, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, c as NodeUserAuthorization, o as NodeUserAuthorizationAuthorizeFn, d as NodeUserAuthorizationConfig, p as OpenKeyAuthorizationResultV1, q as OpenKeyAuthorizeInput, r as OpenKeyAuthorizeTinyCloud, s as OpenKeyBridgeInput, O as OwnerDelegationReceipt, t as RestorableSession, R as RuntimePermissionGrantOptions, S as SecretPermissionHint, e as SecretReadInput, f as SecretReadResult, g as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, i as UnifiedOwnerRootReceipt, j as UnsupportedSessionRestoreError, k as defaultSignStrategy, w as wireOpenKeyAuthorize } from './TinyCloudNode-CIGurdHw.cjs';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
+export { A as AuthDelegationArtifact, b as AuthRequestArtifact, C as CompactRuntimeDelegationInput, D as DelegationAuthority, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, c as RuntimeDelegationActivator, e as RuntimeDelegationRejectedError, f as RuntimeDelegationRejection, S as SessionGrantProof, V as ValidatedRuntimeDelegation, g as VerifiedSessionGrant, a as activateCompactRuntimeDelegation, h as activateValidatedRuntimeDelegation, d as deserializeDelegation, i as grantAuthRequest, s as serializeDelegation, j as signedCompactUcanExpiry, k as siweRuntimeDelegation } from './delegation-0LKZkmP2.cjs';
 import { KVReplicaStorage } from '@tinycloud/sdk-services';
 import { ProfileReplicaPurge } from '@tinycloud/sdk-services/kv/replication';
 export { ProfileReplicaDeferredToken, ProfileReplicaPurge } from '@tinycloud/sdk-services/kv/replication';

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 import { ISigner, Bytes, IWasmBindings, PersistedSessionProof, ISessionManager } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, AccountDelegationRecord, AccountDelegationResource, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CallbackStrategy, CanonicalAddress, CanonicalDecryptRequest, CanonicalJson, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DelegationRevocationReceipt, DidCacheKeyOptions, DidEqualsOptions, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncodedShareData, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IEncryptionService, IHooksService, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IStorageService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InlineEncryptedEnvelope, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, OwnerDelegationPermission, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiveOptions, ReceiverKeyPair, ReceiverKeySigner, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SignedReceiverKeyInput, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, StoredDelegationChain, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, VersionCheckError, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, addressStorageKey, appSecretScope, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, buildSpaceUri, canonicalHashHex, canonicalSignedResponse, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeEncryptionJson, canonicalizeNetworkId, canonicalizeSecretScope, checkDecryptInvocationInput, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, decryptEnvelopeWithKey, defaultSpaceCreationHandler, deriveSignedReceiverKey, didCacheKey, didEquals, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, encryptionBase64Decode, encryptionBase64Encode, encryptionError, encryptionUtf8Decode, encryptionUtf8Encode, ensureNetworkUsableForDecrypt, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, isNetworkId, isStorageFullError, loadManifest, makePkhSpaceId, makePublicSpaceId, networkDiscoveryKey, openWrappedKey, parseCanonicalNetworkId, parseExpiry, parseNetworkId, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validateManifest, verifyDecryptResponse } from '@tinycloud/sdk-core';
 export { F as FileSessionStorage, M as MemorySessionStorage, W as WasmKeyProvider, a as WasmKeyProviderConfig, c as createWasmKeyProvider } from './WasmKeyProvider-5Ee7fcAw.js';
-export { A as ACCEPTED_MARKER_VERSIONS, a as AuthDelegationArtifact, b as AuthRequestArtifact, B as BOOTSTRAP_COMPLETION_MARKER_KEY, c as BOOTSTRAP_COMPLETION_MARKER_VERSION, d as BootstrapCompletionMarker, e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, i as DelegationAuthority, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, k as NodeUserAuthorizationAuthorizeFn, l as NodeUserAuthorizationConfig, O as OpenKeyAuthorizationResultV1, m as OpenKeyAuthorizeInput, n as OpenKeyAuthorizeTinyCloud, o as OpenKeyBridgeInput, p as OwnerDelegationReceipt, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, q as RestorableSession, r as RuntimeDelegationActivator, s as RuntimeDelegationRejectedError, t as RuntimeDelegationRejection, u as RuntimePermissionGrantOptions, S as SecretPermissionHint, v as SecretReadInput, w as SecretReadResult, x as SessionGrantProof, y as SignStrategy, T as TinyCloudNode, z as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, F as UnifiedOwnerRootReceipt, G as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, H as VerifiedSessionGrant, J as activateCompactRuntimeDelegation, K as activateValidatedRuntimeDelegation, L as defaultSignStrategy, M as deserializeDelegation, Q as grantAuthRequest, W as serializeDelegation, X as signedCompactUcanExpiry, Y as siweRuntimeDelegation, Z as wireOpenKeyAuthorize } from './TinyCloudNode-N4mfZI_k.js';
+export { A as ACCEPTED_MARKER_VERSIONS, l as BOOTSTRAP_COMPLETION_MARKER_KEY, m as BOOTSTRAP_COMPLETION_MARKER_VERSION, n as BootstrapCompletionMarker, B as BootstrapWarning, C as CreateOwnerDelegationParams, D as DelegateToOptions, a as DelegateToResult, b as DelegatedAccess, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, c as NodeUserAuthorization, o as NodeUserAuthorizationAuthorizeFn, d as NodeUserAuthorizationConfig, p as OpenKeyAuthorizationResultV1, q as OpenKeyAuthorizeInput, r as OpenKeyAuthorizeTinyCloud, s as OpenKeyBridgeInput, O as OwnerDelegationReceipt, t as RestorableSession, R as RuntimePermissionGrantOptions, S as SecretPermissionHint, e as SecretReadInput, f as SecretReadResult, g as SignStrategy, T as TinyCloudNode, h as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, i as UnifiedOwnerRootReceipt, j as UnsupportedSessionRestoreError, k as defaultSignStrategy, w as wireOpenKeyAuthorize } from './TinyCloudNode-B5WCe_ps.js';
 import { invoke, invokeAny, computeCid, prepareSession, completeSessionSetup, ensureEip55, makeSpaceId, createDelegation, parseRecapFromSiwe, parseVerifiedRecapFromSiwe, generateHostSIWEMessage, siweToDelegationHeaders, protocolVersion, vault_encrypt, vault_decrypt, vault_derive_key, vault_x25519_from_seed, vault_x25519_dh, vault_random_bytes, vault_sha256 } from '@tinycloud/node-sdk-wasm';
+export { A as AuthDelegationArtifact, b as AuthRequestArtifact, C as CompactRuntimeDelegationInput, D as DelegationAuthority, P as PortableDelegation, R as RUNTIME_DELEGATION_REJECTIONS, c as RuntimeDelegationActivator, e as RuntimeDelegationRejectedError, f as RuntimeDelegationRejection, S as SessionGrantProof, V as ValidatedRuntimeDelegation, g as VerifiedSessionGrant, a as activateCompactRuntimeDelegation, h as activateValidatedRuntimeDelegation, d as deserializeDelegation, i as grantAuthRequest, s as serializeDelegation, j as signedCompactUcanExpiry, k as siweRuntimeDelegation } from './delegation-0LKZkmP2.js';
 import { KVReplicaStorage } from '@tinycloud/sdk-services';
 import { ProfileReplicaPurge } from '@tinycloud/sdk-services/kv/replication';
 export { ProfileReplicaDeferredToken, ProfileReplicaPurge } from '@tinycloud/sdk-services/kv/replication';

package/dist/replication/authority.d.cts

@@ -1,6 +1,7 @@
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services';
 import '@tinycloud/sdk-services/kv/replication';
-import '../TinyCloudNode-N4mfZI_k.cjs';
-export { A as AUTHORITY_EXPIRY_MARGIN_MS, D as DelegationPlanResult, R as ReplicationAuthorityHost, a as ReplicationAuthoritySession, b as assertRenewalParent, c as assertValidReplicationConfig, d as augmentSignInEntriesWithReplication, e as createReplicationAuthority, f as establishReplicaSessionStamp, h as hasUnrestrictedGetCoverage, m as mintNodeReplicationGrant, r as replicationScopeFromSignedSession, g as reportReplicaDenial, i as restoreReplicaSessionStamp, u as ucanAttCovers, j as ucanAttUnconstrainedFor, v as verifiedOwnerConsentAnchor } from '../authority-BgZpUFss.cjs';
+import '../TinyCloudNode-CIGurdHw.cjs';
+export { A as AUTHORITY_EXPIRY_MARGIN_MS, D as DelegationPlanResult, R as ReplicationAuthorityHost, a as ReplicationAuthoritySession, b as assertRenewalParent, c as assertValidReplicationConfig, d as augmentSignInEntriesWithReplication, e as createReplicationAuthority, f as establishReplicaSessionStamp, h as hasUnrestrictedGetCoverage, m as mintNodeReplicationGrant, r as replicationScopeFromSignedSession, g as reportReplicaDenial, i as restoreReplicaSessionStamp, u as ucanAttCovers, j as ucanAttUnconstrainedFor, v as verifiedOwnerConsentAnchor } from '../authority-Beg1WM2U.cjs';
 import 'events';
+import '../delegation-0LKZkmP2.cjs';