@tinycloud/node-sdk 3.8.0-beta.10 → 3.8.0-beta.13

package/dist/{TinyCloudNode-Dy65bxqs.d.cts → TinyCloudNode-BVDUdEcf.d.cts}

@@ -81,6 +81,8 @@ interface OpenKeyAuthorizeTinyCloud {
          * validates and size-bounds it before use.
          */
         presentation?: CapabilityPresentationEnvelopeV1;
+    }, opts?: {
+        mode?: "iframe" | "popup" | "redirect";
     }): Promise<{
         protocolVersion: 1;
         address: string;
@@ -143,9 +145,22 @@ type NodeUserAuthorizationAuthorizeFn = (input: OpenKeyBridgeInput) => Promise<{
  * const clientSession = await nodeAuth.signInWithOpenKey(authorize);
  * ```
  */
-declare function wireOpenKeyAuthorize(openkey: OpenKeyAuthorizeTinyCloud): NodeUserAuthorizationAuthorizeFn;
+declare function wireOpenKeyAuthorize(openkey: OpenKeyAuthorizeTinyCloud, opts?: {
+    mode?: "iframe" | "popup" | "redirect";
+}): NodeUserAuthorizationAuthorizeFn;
 
 type OpenKeyAuthorizeInput = OpenKeyBridgeInput;
+/** SIWE and session key prepared before an OpenKey approval click. */
+interface PreparedOpenKeyAuthorization {
+    readonly request: OpenKeyAuthorizeInput;
+    readonly prepared: PreparedOpenKeySession;
+    readonly keyId: string;
+    readonly jwk: Record<string, unknown>;
+    readonly address: string;
+    readonly chainId: number;
+    readonly generation: number;
+    readonly createdAt: number;
+}
 type OpenKeyAuthorizationResultV1 = Awaited<ReturnType<NodeUserAuthorizationAuthorizeFn>>;
 type PreparedOpenKeySession = {
     siwe: string;
@@ -366,6 +381,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private readonly includeAccountRegistryPermissions;
     private sessionManager;
     private activeSessionKeyId;
+    private preparedSessionCounter;
     /** Incremented by resetSession; a sign-in started earlier publishes nothing. */
     private sessionGeneration;
     /**
@@ -738,6 +754,10 @@ declare class NodeUserAuthorization implements IUserAuthorization {
          */
         retryResult?: (error: Error, originalRequest: OpenKeyAuthorizeInput, attempt: number) => Promise<OpenKeyAuthorizationResultV1 | null>;
     }): Promise<ClientSession>;
+    /** Finish address, host and SIWE preparation before an approval click. */
+    prepareOpenKeySignIn(options?: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[1]): Promise<PreparedOpenKeyAuthorization>;
+    /** Complete a prepared approval. The caller starts authorization before awaiting this method. */
+    completeOpenKeySignIn(pending: PreparedOpenKeyAuthorization, authorization: Promise<OpenKeyAuthorizationResultV1>, options?: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[1]): Promise<ClientSession>;
     /**
      * Build a `CapabilityPresentationEnvelopeV1` from `this._manifest`. The
      * envelope is display-only — the OpenKey widget renders it under an
@@ -1280,6 +1300,7 @@ declare class TinyCloudNode {
     private readonly explicitHost?;
     private signer;
     private auth;
+    private readonly consumedOpenKeyPendings;
     private tc;
     private _address?;
     private _chainId;
@@ -1656,6 +1677,10 @@ declare class TinyCloudNode {
      * bytes before the network session or replica stamp is committed.
      */
     signInWithOpenKey(authorizeFn: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[0], options?: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[1]): Promise<void>;
+    /** Prepare the OpenKey request before the approval click. */
+    prepareOpenKeySignIn(): Promise<PreparedOpenKeyAuthorization>;
+    /** Start OpenKey authorization synchronously, then complete normal session setup. */
+    signInWithPreparedOpenKey(pending: PreparedOpenKeyAuthorization, authorizeFn: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[0]): Promise<void>;
     private signInWith;
     private establishSignIn;
     /**
@@ -2708,4 +2733,4 @@ declare class TinyCloudNode {
     }): Promise<PortableDelegation>;
 }
 
-export { ACCEPTED_MARKER_VERSIONS as A, type BootstrapWarning as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, InvalidRestoredSessionError as I, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type RuntimePermissionGrantOptions as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type DelegateToResult as a, DelegatedAccess as b, NodeUserAuthorization as c, type NodeUserAuthorizationConfig as d, type SecretReadInput as e, type SecretReadResult as f, type SignStrategy as g, type TinyCloudNodeConfig as h, type UnifiedOwnerRootReceipt as i, UnsupportedSessionRestoreError as j, defaultSignStrategy as k, BOOTSTRAP_COMPLETION_MARKER_KEY as l, BOOTSTRAP_COMPLETION_MARKER_VERSION as m, type BootstrapCompletionMarker as n, type NodeUserAuthorizationAuthorizeFn as o, type OpenKeyAuthorizationResultV1 as p, type OpenKeyAuthorizeInput as q, type OpenKeyAuthorizeTinyCloud as r, type OpenKeyBridgeInput as s, type RestorableSession as t, wireOpenKeyAuthorize as w };
+export { ACCEPTED_MARKER_VERSIONS as A, type BootstrapWarning as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, InvalidRestoredSessionError as I, type NodeEventEmitterStrategy as N, type OpenKeyAuthorizeTinyCloud as O, type PreparedOpenKeyAuthorization as P, type RuntimePermissionGrantOptions as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type DelegateToResult as a, DelegatedAccess as b, NodeUserAuthorization as c, type NodeUserAuthorizationConfig as d, type OwnerDelegationReceipt as e, type SecretReadInput as f, type SecretReadResult as g, type SignStrategy as h, type TinyCloudNodeConfig as i, type UnifiedOwnerRootReceipt as j, UnsupportedSessionRestoreError as k, defaultSignStrategy as l, BOOTSTRAP_COMPLETION_MARKER_KEY as m, BOOTSTRAP_COMPLETION_MARKER_VERSION as n, type BootstrapCompletionMarker as o, type NodeUserAuthorizationAuthorizeFn as p, type OpenKeyAuthorizationResultV1 as q, type OpenKeyAuthorizeInput as r, type OpenKeyBridgeInput as s, type RestorableSession as t, wireOpenKeyAuthorize as w };

package/dist/{TinyCloudNode-DnD-SH6t.d.ts → TinyCloudNode-jMK_2Uj8.d.ts}

@@ -81,6 +81,8 @@ interface OpenKeyAuthorizeTinyCloud {
          * validates and size-bounds it before use.
          */
         presentation?: CapabilityPresentationEnvelopeV1;
+    }, opts?: {
+        mode?: "iframe" | "popup" | "redirect";
     }): Promise<{
         protocolVersion: 1;
         address: string;
@@ -143,9 +145,22 @@ type NodeUserAuthorizationAuthorizeFn = (input: OpenKeyBridgeInput) => Promise<{
  * const clientSession = await nodeAuth.signInWithOpenKey(authorize);
  * ```
  */
-declare function wireOpenKeyAuthorize(openkey: OpenKeyAuthorizeTinyCloud): NodeUserAuthorizationAuthorizeFn;
+declare function wireOpenKeyAuthorize(openkey: OpenKeyAuthorizeTinyCloud, opts?: {
+    mode?: "iframe" | "popup" | "redirect";
+}): NodeUserAuthorizationAuthorizeFn;
 
 type OpenKeyAuthorizeInput = OpenKeyBridgeInput;
+/** SIWE and session key prepared before an OpenKey approval click. */
+interface PreparedOpenKeyAuthorization {
+    readonly request: OpenKeyAuthorizeInput;
+    readonly prepared: PreparedOpenKeySession;
+    readonly keyId: string;
+    readonly jwk: Record<string, unknown>;
+    readonly address: string;
+    readonly chainId: number;
+    readonly generation: number;
+    readonly createdAt: number;
+}
 type OpenKeyAuthorizationResultV1 = Awaited<ReturnType<NodeUserAuthorizationAuthorizeFn>>;
 type PreparedOpenKeySession = {
     siwe: string;
@@ -366,6 +381,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private readonly includeAccountRegistryPermissions;
     private sessionManager;
     private activeSessionKeyId;
+    private preparedSessionCounter;
     /** Incremented by resetSession; a sign-in started earlier publishes nothing. */
     private sessionGeneration;
     /**
@@ -738,6 +754,10 @@ declare class NodeUserAuthorization implements IUserAuthorization {
          */
         retryResult?: (error: Error, originalRequest: OpenKeyAuthorizeInput, attempt: number) => Promise<OpenKeyAuthorizationResultV1 | null>;
     }): Promise<ClientSession>;
+    /** Finish address, host and SIWE preparation before an approval click. */
+    prepareOpenKeySignIn(options?: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[1]): Promise<PreparedOpenKeyAuthorization>;
+    /** Complete a prepared approval. The caller starts authorization before awaiting this method. */
+    completeOpenKeySignIn(pending: PreparedOpenKeyAuthorization, authorization: Promise<OpenKeyAuthorizationResultV1>, options?: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[1]): Promise<ClientSession>;
     /**
      * Build a `CapabilityPresentationEnvelopeV1` from `this._manifest`. The
      * envelope is display-only — the OpenKey widget renders it under an
@@ -1280,6 +1300,7 @@ declare class TinyCloudNode {
     private readonly explicitHost?;
     private signer;
     private auth;
+    private readonly consumedOpenKeyPendings;
     private tc;
     private _address?;
     private _chainId;
@@ -1656,6 +1677,10 @@ declare class TinyCloudNode {
      * bytes before the network session or replica stamp is committed.
      */
     signInWithOpenKey(authorizeFn: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[0], options?: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[1]): Promise<void>;
+    /** Prepare the OpenKey request before the approval click. */
+    prepareOpenKeySignIn(): Promise<PreparedOpenKeyAuthorization>;
+    /** Start OpenKey authorization synchronously, then complete normal session setup. */
+    signInWithPreparedOpenKey(pending: PreparedOpenKeyAuthorization, authorizeFn: Parameters<NodeUserAuthorization["signInWithOpenKey"]>[0]): Promise<void>;
     private signInWith;
     private establishSignIn;
     /**
@@ -2708,4 +2733,4 @@ declare class TinyCloudNode {
     }): Promise<PortableDelegation>;
 }
 
-export { ACCEPTED_MARKER_VERSIONS as A, type BootstrapWarning as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, InvalidRestoredSessionError as I, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type RuntimePermissionGrantOptions as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type DelegateToResult as a, DelegatedAccess as b, NodeUserAuthorization as c, type NodeUserAuthorizationConfig as d, type SecretReadInput as e, type SecretReadResult as f, type SignStrategy as g, type TinyCloudNodeConfig as h, type UnifiedOwnerRootReceipt as i, UnsupportedSessionRestoreError as j, defaultSignStrategy as k, BOOTSTRAP_COMPLETION_MARKER_KEY as l, BOOTSTRAP_COMPLETION_MARKER_VERSION as m, type BootstrapCompletionMarker as n, type NodeUserAuthorizationAuthorizeFn as o, type OpenKeyAuthorizationResultV1 as p, type OpenKeyAuthorizeInput as q, type OpenKeyAuthorizeTinyCloud as r, type OpenKeyBridgeInput as s, type RestorableSession as t, wireOpenKeyAuthorize as w };
+export { ACCEPTED_MARKER_VERSIONS as A, type BootstrapWarning as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, InvalidRestoredSessionError as I, type NodeEventEmitterStrategy as N, type OpenKeyAuthorizeTinyCloud as O, type PreparedOpenKeyAuthorization as P, type RuntimePermissionGrantOptions as R, type SecretPermissionHint as S, TinyCloudNode as T, type UnifiedOwnerRootInput as U, type DelegateToResult as a, DelegatedAccess as b, NodeUserAuthorization as c, type NodeUserAuthorizationConfig as d, type OwnerDelegationReceipt as e, type SecretReadInput as f, type SecretReadResult as g, type SignStrategy as h, type TinyCloudNodeConfig as i, type UnifiedOwnerRootReceipt as j, UnsupportedSessionRestoreError as k, defaultSignStrategy as l, BOOTSTRAP_COMPLETION_MARKER_KEY as m, BOOTSTRAP_COMPLETION_MARKER_VERSION as n, type BootstrapCompletionMarker as o, type NodeUserAuthorizationAuthorizeFn as p, type OpenKeyAuthorizationResultV1 as q, type OpenKeyAuthorizeInput as r, type OpenKeyBridgeInput as s, type RestorableSession as t, wireOpenKeyAuthorize as w };

package/dist/{WasmKeyProvider-5Ee7fcAw.d.cts → WasmKeyProvider-BKCPRC-c.d.cts}

@@ -106,6 +106,26 @@ declare class FileSessionStorage implements ISessionStorage {
     isAvailable(): boolean;
 }
 
+/**
+ * Whether sign-in at `origin` can be granted named-key abilities for the app
+ * whose manifest `keys_app_id` (or `app_id`) is `keysAppId`.
+ *
+ * "Bound" means the key app id equals the reversed host of the origin, or
+ * extends it with further dot-separated labels: `tinycloud.chat` binds
+ * `chat.tinycloud.tinychat` and `chat.tinycloud.tinychat.worker`. Origins with
+ * no registrable host (`localhost`, `tauri.localhost`, IP addresses) or with
+ * lookalike hosts (`evil-tinycloud.chat`, `tinycloud.chat.evil.com`) are not
+ * bound. `origin` is a URL, an origin string such as `https://tinycloud.chat`,
+ * or a bare SIWE domain such as `tinycloud.chat`; the host (including any
+ * non-default port, which makes the origin unbound) is what is checked.
+ *
+ * This is the check `NodeUserAuthorization` applies when it decides whether a
+ * manifest's `keys` rows are granted at sign-in. A bound origin still needs a
+ * node that lists `encryption-named-keys-v1` in `/info` to actually receive
+ * the row.
+ */
+declare function isAppKeyHostBound(keysAppId: string, origin: string | URL): boolean;
+
 /**
  * WasmKeyProvider - KeyProvider implementation using WASM session manager.
  *
@@ -214,4 +234,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c };
+export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c, isAppKeyHostBound as i };

package/dist/{WasmKeyProvider-5Ee7fcAw.d.ts → WasmKeyProvider-BKCPRC-c.d.ts}

@@ -106,6 +106,26 @@ declare class FileSessionStorage implements ISessionStorage {
     isAvailable(): boolean;
 }
 
+/**
+ * Whether sign-in at `origin` can be granted named-key abilities for the app
+ * whose manifest `keys_app_id` (or `app_id`) is `keysAppId`.
+ *
+ * "Bound" means the key app id equals the reversed host of the origin, or
+ * extends it with further dot-separated labels: `tinycloud.chat` binds
+ * `chat.tinycloud.tinychat` and `chat.tinycloud.tinychat.worker`. Origins with
+ * no registrable host (`localhost`, `tauri.localhost`, IP addresses) or with
+ * lookalike hosts (`evil-tinycloud.chat`, `tinycloud.chat.evil.com`) are not
+ * bound. `origin` is a URL, an origin string such as `https://tinycloud.chat`,
+ * or a bare SIWE domain such as `tinycloud.chat`; the host (including any
+ * non-default port, which makes the origin unbound) is what is checked.
+ *
+ * This is the check `NodeUserAuthorization` applies when it decides whether a
+ * manifest's `keys` rows are granted at sign-in. A bound origin still needs a
+ * node that lists `encryption-named-keys-v1` in `/info` to actually receive
+ * the row.
+ */
+declare function isAppKeyHostBound(keysAppId: string, origin: string | URL): boolean;
+
 /**
  * WasmKeyProvider - KeyProvider implementation using WASM session manager.
  *
@@ -214,4 +234,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c };
+export { FileSessionStorage as F, MemorySessionStorage as M, WasmKeyProvider as W, type WasmKeyProviderConfig as a, createWasmKeyProvider as c, isAppKeyHostBound as i };

package/dist/{authority-Rbye1U4o.d.cts → authority-DJ-PE4Xo.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-Dy65bxqs.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-BVDUdEcf.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/{authority-BQnTX3fI.d.ts → authority-i22vHbbp.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaLocalEraseOutcome, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaPurgeFailedEvent, ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-DnD-SH6t.js';
+import { T as TinyCloudNode } from './TinyCloudNode-jMK_2Uj8.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/core.cjs

@@ -111,6 +111,7 @@ __export(core_exports, {
   getNodeReplicationLoaders: () => getNodeReplicationLoaders,
   getTinyCloudDebugLogs: () => import_sdk_core13.getTinyCloudDebugLogs,
   installTinyCloudDebugGlobals: () => import_sdk_core13.installTinyCloudDebugGlobals,
+  isAppKeyHostBound: () => isAppKeyHostBound,
   isCapabilitySubset: () => import_sdk_core14.isCapabilitySubset,
   isEvmAddress: () => import_sdk_core13.isEvmAddress,
   loadManifest: () => import_sdk_core14.loadManifest,
@@ -132,7 +133,8 @@ __export(core_exports, {
   resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core14.resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation: () => serializeDelegation,
   tinyCloudDebugLogger: () => import_sdk_core13.tinyCloudDebugLogger,
-  validateManifest: () => import_sdk_core14.validateManifest
+  validateManifest: () => import_sdk_core14.validateManifest,
+  wireOpenKeyAuthorize: () => wireOpenKeyAuthorize
 });
 module.exports = __toCommonJS(core_exports);
 var import_sdk_core12 = require("@tinycloud/sdk-core");
@@ -373,6 +375,18 @@ function appKeyHostBinding(domain, appId) {
   const reversed = labels.reverse().join(".");
   return appId === reversed || appId.startsWith(`${reversed}.`);
 }
+function isAppKeyHostBound(keysAppId, origin) {
+  if (typeof origin === "string" && !origin.includes("://")) {
+    return appKeyHostBinding(origin, keysAppId);
+  }
+  let url;
+  try {
+    url = typeof origin === "string" ? new URL(origin) : origin;
+  } catch {
+    return false;
+  }
+  return appKeyHostBinding(url.host, keysAppId);
+}
 
 // src/replication/authority-sign-in.ts
 var import_sdk_core2 = require("@tinycloud/sdk-core");
@@ -504,6 +518,7 @@ function cloneAbilitiesMap(actions) {
 var NodeUserAuthorization = class {
   constructor(config) {
     this.activeSessionKeyId = "default";
+    this.preparedSessionCounter = 0;
     /** Incremented by resetSession; a sign-in started earlier publishes nothing. */
     this.sessionGeneration = 0;
     /**
@@ -1637,9 +1652,8 @@ var NodeUserAuthorization = class {
     const address = (0, import_sdk_core5.canonicalizeAddress)(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     await this.refreshNamedKeyFeatureForSignIn(address, chainId);
-    const keyId = `session-${Date.now()}`;
-    this.sessionManager.renameSessionKeyId(this.activeSessionKeyId, keyId);
-    this.activeSessionKeyId = keyId;
+    const keyId = `openkey-session-${Date.now()}-${++this.preparedSessionCounter}`;
+    this.sessionManager.createSessionKey(keyId);
     const jwkString = this.sessionManager.jwk(keyId);
     if (!jwkString) {
       throw new Error("Failed to create session key");
@@ -1720,6 +1734,7 @@ var NodeUserAuthorization = class {
     await this.sessionStorage.save(address, persistedData);
     this._session = clientSession;
     this._tinyCloudSession = tinyCloudSession;
+    this.activeSessionKeyId = keyId;
     this._address = address;
     this._chainId = chainId;
     await this.refreshNodeInfo();
@@ -1766,6 +1781,11 @@ var NodeUserAuthorization = class {
    * @param options Optional overrides for the OpenKey request.
    */
   async signInWithOpenKey(authorizeFn, options) {
+    const pending = await this.prepareOpenKeySignIn(options);
+    return this.completeOpenKeySignIn(pending, authorizeFn(pending.request), options);
+  }
+  /** Finish address, host and SIWE preparation before an approval click. */
+  async prepareOpenKeySignIn(options) {
     refuseCaveated(this.getCapabilityRequest()?.manifests);
     if (options?.host !== void 0) {
       const overrideHost = options.host.trim();
@@ -1777,7 +1797,7 @@ var NodeUserAuthorization = class {
     const signingAddress = (0, import_sdk_core5.canonicalizeAddress)(await this.signer.getAddress());
     const signingChainId = await this.signer.getChainId();
     await this.resolveTinyCloudHostsForSignIn(signingAddress, signingChainId);
-    const { prepared, keyId, jwk } = await this.prepareSessionForSigning();
+    const { prepared, keyId, jwk, address, chainId } = await this.prepareSessionForSigning();
     const presentation = this.buildPresentationEnvelope(options?.reason);
     const hostHint = this.primaryTinyCloudHost;
     const originalRequest = {
@@ -1789,12 +1809,32 @@ var NodeUserAuthorization = class {
       keyId: options?.openkeyKeyId,
       presentation
     };
+    return {
+      request: originalRequest,
+      prepared,
+      keyId,
+      jwk,
+      address,
+      chainId,
+      generation: this.sessionGeneration,
+      createdAt: Date.now()
+    };
+  }
+  /** Complete a prepared approval. The caller starts authorization before awaiting this method. */
+  async completeOpenKeySignIn(pending, authorization, options) {
+    if (Date.now() - pending.createdAt > 5 * 6e4) {
+      throw new Error("Prepared OpenKey sign-in expired; prepare again");
+    }
+    if (pending.generation !== this.sessionGeneration) {
+      throw new Error("Prepared OpenKey sign-in expired after sign-out");
+    }
+    const { request: originalRequest, prepared, keyId, jwk } = pending;
     let result;
     let signed;
     let signature;
     for (let attempt = 0; ; ) {
       try {
-        result ?? (result = await authorizeFn(originalRequest));
+        result ?? (result = await authorization);
         signed = await this.verifyOpenKeyResult(result, prepared);
         signature = result.signature;
         break;
@@ -2215,6 +2255,50 @@ var NodeUserAuthorization = class {
   }
 };
 
+// src/authorization/openKeyBridge.ts
+function wireOpenKeyAuthorize(openkey, opts) {
+  return async (input) => {
+    const result = await openkey.authorizeTinyCloud({
+      protocolVersion: 1,
+      siwe: input.siwe,
+      keyId: input.keyId,
+      jwk: input.jwk,
+      host: input.host,
+      // Forward the presentation envelope verbatim — the OpenKey SDK
+      // validates and size-bounds it before use.
+      presentation: input.presentation
+    }, opts);
+    if (result.protocolVersion !== 1) {
+      throw new Error(
+        `wireOpenKeyAuthorize: OpenKey returned unsupported protocolVersion ${result.protocolVersion}`
+      );
+    }
+    if (typeof result.signedMessage !== "string" || !result.signedMessage) {
+      throw new Error(
+        "wireOpenKeyAuthorize: OpenKey returned no signedMessage \u2014 cannot complete a TinyCloud session"
+      );
+    }
+    if (!Array.isArray(result.selectedActionKeys)) {
+      throw new Error(
+        "wireOpenKeyAuthorize: OpenKey returned no selectedActionKeys"
+      );
+    }
+    if (!Array.isArray(result.permissions)) {
+      throw new Error(
+        "wireOpenKeyAuthorize: OpenKey returned no permissions"
+      );
+    }
+    return {
+      protocolVersion: 1,
+      address: result.address,
+      signature: result.signature,
+      signedMessage: result.signedMessage,
+      selectedActionKeys: result.selectedActionKeys,
+      permissions: result.permissions
+    };
+  };
+}
+
 // src/recordingServiceContext.ts
 var import_sdk_services3 = require("@tinycloud/sdk-services");
 var import_requestLog = require("@tinycloud/sdk-services/telemetry/requestLog");
@@ -3834,6 +3918,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   constructor(config = {}) {
     this.signer = null;
     this.auth = null;
+    this.consumedOpenKeyPendings = /* @__PURE__ */ new WeakSet();
     this.tc = null;
     this._chainId = 1;
     this.replicaPurgeFailedHandlers = /* @__PURE__ */ new Set();
@@ -4774,6 +4859,37 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     await this.signInWith(() => this.auth.signInWithOpenKey(authorizeFn, options));
   }
+  /** Prepare the OpenKey request before the approval click. */
+  async prepareOpenKeySignIn() {
+    if (!this.signer || !this.tc || !this.auth) {
+      throw new Error("Cannot prepare OpenKey sign-in in session-only mode. Provide a signer in config.");
+    }
+    await this.signOutInFlight;
+    await this.accountRegistryTail;
+    await this.wasmBindings.ensureInitialized?.();
+    return this.auth.prepareOpenKeySignIn();
+  }
+  /** Start OpenKey authorization synchronously, then complete normal session setup. */
+  signInWithPreparedOpenKey(pending, authorizeFn) {
+    if (!this.signer || !this.tc || !this.auth || this.signOutInFlight) {
+      throw new Error("Prepared OpenKey sign-in is unavailable");
+    }
+    if (this.consumedOpenKeyPendings.has(pending)) {
+      throw new Error("Prepared OpenKey sign-in was already used");
+    }
+    if (Date.now() - pending.createdAt > 5 * 6e4) {
+      throw new Error("Prepared OpenKey sign-in expired; prepare again");
+    }
+    this.consumedOpenKeyPendings.add(pending);
+    const authorization = authorizeFn(pending.request);
+    void authorization.catch(() => void 0);
+    return this.signInWith(() => {
+      if (this._address !== pending.address || this._chainId !== pending.chainId) {
+        throw new Error("OpenKey account changed after sign-in preparation");
+      }
+      return this.auth.completeOpenKeySignIn(pending, authorization);
+    });
+  }
   async signInWith(performSignIn) {
     refuseCaveated(this.auth?.capabilityRequest?.manifests);
     const epoch = this.sessionEpoch;
@@ -10222,6 +10338,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   getNodeReplicationLoaders,
   getTinyCloudDebugLogs,
   installTinyCloudDebugGlobals,
+  isAppKeyHostBound,
   isCapabilitySubset,
   isEvmAddress,
   loadManifest,
@@ -10243,6 +10360,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation,
   tinyCloudDebugLogger,
-  validateManifest
+  validateManifest,
+  wireOpenKeyAuthorize
 });
 //# sourceMappingURL=core.cjs.map