@tinycloud/node-sdk 3.6.0-beta.7 → 3.6.0-beta.8

package/dist/core.d.cts

@@ -1,4 +1,4 @@
-import { ReplicationOptions } from '@tinycloud/sdk-core';
+import { ReplicationOptions, Manifest, PermissionEntry } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
 import { _ as __gated_network } from './gated-network-BEF2XSTC.cjs';
 import { _ as __authority } from './authority-Beg1WM2U.cjs';
@@ -45,4 +45,11 @@ type ReplicationModuleLoaders = {
 declare function registerReplicationLoaders(loaders: ReplicationModuleLoaders): void;
 declare function getNodeReplicationLoaders(): ReplicationModuleLoaders;
 
-export { type ReplicationModuleLoaders, getNodeReplicationLoaders, registerReplicationLoaders };
+/**
+ * Throws `CaveatedDelegationUnsupportedError` for permission entries, or the
+ * permissions of manifests, that carry a caveat. Only absent, `[]` and `[{}]`
+ * pass; `null` and malformed caveats fail closed.
+ */
+declare function refuseCaveated(input: Manifest | readonly (Manifest | PermissionEntry)[] | undefined): void;
+
+export { type ReplicationModuleLoaders, getNodeReplicationLoaders, refuseCaveated, registerReplicationLoaders };

package/dist/core.d.ts

@@ -1,4 +1,4 @@
-import { ReplicationOptions } from '@tinycloud/sdk-core';
+import { ReplicationOptions, Manifest, PermissionEntry } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
 import { _ as __gated_network } from './gated-network-BEF2XSTC.js';
 import { _ as __authority } from './authority-Vh7ike0I.js';
@@ -45,4 +45,11 @@ type ReplicationModuleLoaders = {
 declare function registerReplicationLoaders(loaders: ReplicationModuleLoaders): void;
 declare function getNodeReplicationLoaders(): ReplicationModuleLoaders;
 
-export { type ReplicationModuleLoaders, getNodeReplicationLoaders, registerReplicationLoaders };
+/**
+ * Throws `CaveatedDelegationUnsupportedError` for permission entries, or the
+ * permissions of manifests, that carry a caveat. Only absent, `[]` and `[{}]`
+ * pass; `null` and malformed caveats fail closed.
+ */
+declare function refuseCaveated(input: Manifest | readonly (Manifest | PermissionEntry)[] | undefined): void;
+
+export { type ReplicationModuleLoaders, getNodeReplicationLoaders, refuseCaveated, registerReplicationLoaders };

package/dist/core.js

@@ -325,6 +325,22 @@ function augmentSignInEntriesWithReplication(input) {
   return out;
 }
 
+// src/authorization/caveatRefusal.ts
+import {
+  CaveatedDelegationUnsupportedError,
+  recapCaveatsEqual
+} from "@tinycloud/sdk-core";
+function refuseCaveated(input) {
+  const caveated = [input ?? []].flat().flatMap((item) => [item, ...item.permissions ?? []]).filter(({ caveats }) => {
+    try {
+      return caveats === null || !recapCaveatsEqual(caveats, void 0);
+    } catch {
+      return true;
+    }
+  });
+  if (caveated.length) throw new CaveatedDelegationUnsupportedError(caveated);
+}
+
 // src/authorization/strategies.ts
 import { createOpenKeyCallbackSigningStrategy } from "@tinycloud/sdk-core";
 var defaultSignStrategy = { type: "auto-sign" };
@@ -1222,6 +1238,7 @@ var NodeUserAuthorization = class {
     this._lastActivationSkippedSpaceIds = result.status === 404 ? [primarySpaceId] : [];
   }
   async createBootstrapSession(options) {
+    refuseCaveated(options.capabilityRequest.manifests);
     if (!this._address || !this._chainId) {
       throw new Error("Must be signed in before creating bootstrap sessions");
     }
@@ -1323,6 +1340,7 @@ var NodeUserAuthorization = class {
    * @param options - Optional per-call SIWE overrides for this sign-in only
    */
   async signIn(options) {
+    refuseCaveated(this.getCapabilityRequest()?.manifests);
     const generation = this.sessionGeneration;
     const address = canonicalizeAddress(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
@@ -1474,6 +1492,7 @@ var NodeUserAuthorization = class {
    * ```
    */
   async prepareSessionForSigning() {
+    refuseCaveated(this.getCapabilityRequest()?.manifests);
     const address = canonicalizeAddress(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     const keyId = `session-${Date.now()}`;
@@ -1605,6 +1624,7 @@ var NodeUserAuthorization = class {
    * @param options Optional overrides for the OpenKey request.
    */
   async signInWithOpenKey(authorizeFn, options) {
+    refuseCaveated(this.getCapabilityRequest()?.manifests);
     if (options?.host !== void 0) {
       const overrideHost = options.host.trim();
       if (!overrideHost) {
@@ -2736,11 +2756,11 @@ import {
   bootstrapSteps,
   ErrorCodes as ErrorCodes2,
   ENCRYPTION_PERMISSION_SERVICE as ENCRYPTION_PERMISSION_SERVICE2,
-  CaveatedDelegationUnsupportedError,
+  CaveatedDelegationUnsupportedError as CaveatedDelegationUnsupportedError2,
   PermissionNotInManifestError,
   SessionExpiredError,
   canonicalizeRecapCaveats as canonicalizeRecapCaveats2,
-  recapCaveatsEqual,
+  recapCaveatsEqual as recapCaveatsEqual2,
   expandPermissionEntries as expandPermissionEntriesCore,
   isCapabilitySubset as isCapabilitySubset2,
   isExplicitOnlyAction,
@@ -3546,6 +3566,7 @@ function ownerDelegationPermissions(params) {
     if (!Array.isArray(params.permissions)) {
       throw new Error("Owner delegation permissions are invalid");
     }
+    refuseCaveated(params.permissions);
     permissions.push(...params.permissions.map((permission) => ({
       service: permission.service,
       path: permission.path,
@@ -3920,7 +3941,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         if (!granted?.caveats?.length) {
           return entry;
         }
-        if (entry.caveats !== void 0 && !recapCaveatsEqual(entry.caveats, granted.caveats)) {
+        if (entry.caveats !== void 0 && !recapCaveatsEqual2(entry.caveats, granted.caveats)) {
           throw new Error("Invocation caveats do not match signed ReCap authority.");
         }
         return { ...entry, caveats: cloneRecapCaveats(granted.caveats) };
@@ -4639,6 +4660,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     await this.signInWith(() => this.auth.signInWithOpenKey(authorizeFn, options));
   }
   async signInWith(performSignIn) {
+    refuseCaveated(this.auth?.capabilityRequest?.manifests);
     const epoch = this.sessionEpoch;
     const attempt = ++this.latestSessionAttempt;
     await this.signOutInFlight;
@@ -8561,7 +8583,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         throw new SessionExpiredError(plan.expiredAt ?? sessionExpiry ?? /* @__PURE__ */ new Date(0));
       }
       if (plan.refused === "CAVEATED_AUTHORITY") {
-        throw new CaveatedDelegationUnsupportedError(plan.caveated ?? []);
+        throw new CaveatedDelegationUnsupportedError2(plan.caveated ?? []);
       }
       throw new PermissionNotInManifestError(plan.missing ?? [], plan.granted ?? []);
     }
@@ -8602,7 +8624,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   planDerivation(expandedEntries, session, effectiveExpiration, nowMs) {
     const caveatedRequest = expandedEntries.filter(
-      (entry) => !recapCaveatsEqual(entry.caveats, void 0)
+      (entry) => !recapCaveatsEqual2(entry.caveats, void 0)
     );
     if (caveatedRequest.length > 0) {
       return { refused: "CAVEATED_AUTHORITY", caveated: caveatedRequest };
@@ -8965,10 +8987,10 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   assertDelegationCaveatsPreservable(entries) {
     const caveated = entries.filter(
-      (entry) => !recapCaveatsEqual(entry.caveats, void 0)
+      (entry) => !recapCaveatsEqual2(entry.caveats, void 0)
     );
     if (caveated.length > 0) {
-      throw new CaveatedDelegationUnsupportedError(caveated);
+      throw new CaveatedDelegationUnsupportedError2(caveated);
     }
   }
   /**
@@ -8980,7 +9002,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   assertRuntimeGrantCaveatsPreservable(entries, requestedOperations, grant) {
     const caveated = this.caveatedRuntimeGrantEntries(entries, requestedOperations, grant);
     if (caveated.length > 0) {
-      throw new CaveatedDelegationUnsupportedError(caveated);
+      throw new CaveatedDelegationUnsupportedError2(caveated);
     }
   }
   /**
@@ -8997,7 +9019,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         const requested = requestedOperations[operationIndex++];
         if (!requested) continue;
         const constrained = grant.operations.find(
-          (granted) => this.operationCovers(granted, requested) && !recapCaveatsEqual(granted.caveats, void 0)
+          (granted) => this.operationCovers(granted, requested) && !recapCaveatsEqual2(granted.caveats, void 0)
         );
         if (constrained) {
           caveated.push({
@@ -9014,7 +9036,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   assertPortableDelegationCaveatsPreservable(delegation) {
     const entries = [];
     const add = (service, space, path, actions, caveats) => {
-      if (recapCaveatsEqual(caveats, void 0)) return;
+      if (recapCaveatsEqual2(caveats, void 0)) return;
       entries.push({
         service: service.startsWith("tinycloud.") ? service : `tinycloud.${service}`,
         space,
@@ -9034,7 +9056,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       add(resource.service, resource.space, resource.path, resource.actions, resource.caveats);
     }
     if (entries.length > 0) {
-      throw new CaveatedDelegationUnsupportedError(entries);
+      throw new CaveatedDelegationUnsupportedError2(entries);
     }
   }
   shortServiceName(service) {
@@ -9360,7 +9382,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (granted.service !== requested.service || !this.actionContains(granted.action, requested.action)) {
       return false;
     }
-    if (requested.caveats !== void 0 && !recapCaveatsEqual(granted.caveats, requested.caveats)) {
+    if (requested.caveats !== void 0 && !recapCaveatsEqual2(granted.caveats, requested.caveats)) {
       return false;
     }
     if (granted.resource !== void 0 || requested.resource !== void 0) {
@@ -9785,6 +9807,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   async createSubDelegation(parentDelegation, params) {
     this.assertPortableDelegationCaveatsPreservable(parentDelegation);
+    refuseCaveated(params.resources);
     if (!this.signer) {
       throw new Error("Cannot createSubDelegation() in session-only mode. Requires wallet mode.");
     }
@@ -9906,7 +9929,7 @@ import {
   DEFAULT_MANIFEST_SPACE as DEFAULT_MANIFEST_SPACE2,
   DEFAULT_MANIFEST_VERSION,
   VAULT_PERMISSION_SERVICE,
-  CaveatedDelegationUnsupportedError as CaveatedDelegationUnsupportedError2,
+  CaveatedDelegationUnsupportedError as CaveatedDelegationUnsupportedError3,
   PermissionNotInManifestError as PermissionNotInManifestError2,
   SessionExpiredError as SessionExpiredError2,
   ManifestValidationError,
@@ -9978,7 +10001,7 @@ export {
   AutoApproveSpaceCreationHandler2 as AutoApproveSpaceCreationHandler,
   CapabilityKeyRegistry2 as CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
-  CaveatedDelegationUnsupportedError2 as CaveatedDelegationUnsupportedError,
+  CaveatedDelegationUnsupportedError3 as CaveatedDelegationUnsupportedError,
   DEFAULT_MANIFEST_SPACE2 as DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION,
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
@@ -10064,6 +10087,7 @@ export {
   pkhDid3 as pkhDid,
   principalDid,
   principalDidEquals4 as principalDidEquals,
+  refuseCaveated,
   registerReplicationLoaders,
   resolveManifest2 as resolveManifest,
   resolveSecretListPrefix2 as resolveSecretListPrefix,