@tinycloud/sdk-core 2.0.4 → 2.1.0-beta.1

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { InvokeFunction, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IDataVaultService } from '@tinycloud/sdk-services';
-export { BatchOptions, BatchResponse, ColumnInfo, DataVaultConfig, DataVaultService, DatabaseHandle, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IKVService, IPrefixedKVService, ISQLService, IService, IServiceContext, InvokeFunction, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, PrefixedKVService, QueryOptions, QueryResponse, Result, RetryPolicy, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SqlStatement, SqlValue, TableInfo, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, ViewInfo, WasmVaultFunctions, createVaultCrypto, defaultRetryPolicy, err, ok, serviceError } from '@tinycloud/sdk-services';
+import { InvokeFunction, InvokeAnyFunction, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService } from '@tinycloud/sdk-services';
+export { BatchOptions, BatchResponse, ColumnInfo, DataVaultConfig, DataVaultService, DatabaseHandle, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IHooksService, IKVService, IPrefixedKVService, ISQLService, IService, IServiceContext, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, PrefixedKVService, QueryOptions, QueryResponse, Result, RetryPolicy, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SqlStatement, SqlValue, SubscribeOptions, TableInfo, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, ViewInfo, WasmVaultFunctions, createVaultCrypto, defaultRetryPolicy, err, ok, serviceError } from '@tinycloud/sdk-services';
 export { SiweMessage } from 'siwe';
 
 /**
@@ -179,6 +179,359 @@ interface IENSResolver {
     resolveAvatar?(ensName: string): Promise<string | null>;
 }
 
+/**
+ * TinyCloud App Manifest
+ *
+ * A declarative description of an app's identity and the capabilities it
+ * needs. The manifest drives the SIWE recap at sign-in time, enabling a
+ * single wallet prompt that covers the app's own permissions plus any
+ * pre-declared delegations.
+ *
+ * The SDK does NOT fetch external manifests. Apps compose their own manifest
+ * (optionally including backend or agent addenda) before handing it to the
+ * SDK.
+ *
+ * Canonical spec: `.claude/specs/manifest.md`.
+ *
+ * @packageDocumentation
+ */
+/**
+ * A single permission entry inside a manifest. This is the shape apps write
+ * in their `manifest.json` and the shape we compare against when performing
+ * the capability-subset derivability check in the delegation flow.
+ *
+ * `service` uses the long form (e.g. `"tinycloud.kv"`, `"tinycloud.sql"`)
+ * which matches the ability-namespace half of the full action URN.
+ */
+interface PermissionEntry {
+    /** Service namespace, e.g. "tinycloud.kv", "tinycloud.sql", "tinycloud.duckdb", "tinycloud.capabilities". */
+    service: string;
+    /** "default" for the user's personal space, or a specific space id. */
+    space: string;
+    /**
+     * Service-specific path.
+     * - tinycloud.kv: hierarchical prefix. "/" = all, "foo/" = prefix match, "foo" = exact key
+     * - tinycloud.sql: database name/file (e.g. "data.sqlite") or "/" for all
+     * - tinycloud.duckdb: database name/file
+     * - tinycloud.capabilities: capability key URI or "/" for all
+     */
+    path: string;
+    /**
+     * Short action names (e.g. "get", "put", "read", "ddl"). The SDK expands
+     * these to full URNs (e.g. `tinycloud.kv/get`) during resolution.
+     * Already-expanded URNs are passed through unchanged.
+     */
+    actions: string[];
+    /** When true, the manifest prefix is NOT prepended to `path`. Default false. */
+    skipPrefix?: boolean;
+    /** Per-entry expiry override, ms-format. */
+    expiry?: string;
+}
+/**
+ * A pre-declared delegation that will be included in the main SIWE recap as
+ * an additional audience.
+ */
+interface ManifestDelegation {
+    /** DID of the delegate (e.g. a backend's wallet DID). */
+    to: string;
+    /** Informational display name. Optional. */
+    name?: string;
+    /** Expiry override for this delegation, ms-format. Optional. */
+    expiry?: string;
+    /**
+     * Permissions to delegate. Same shape as the top-level `permissions`, and
+     * the manifest prefix is inherited identically (unless `skipPrefix: true`).
+     */
+    permissions: PermissionEntry[];
+}
+/**
+ * The valid values for `Manifest.defaults`.
+ *
+ * - `false` → no auto-included permissions
+ * - `true` → standard tier (KV + SQL read/write + capabilities:read)
+ * - `"admin"` → standard + SQL ddl + capabilities:admin
+ * - `"all"` → everything the SDK supports (including DuckDB)
+ *
+ * Unknown string values silently fall back to `true`. Values are normalized
+ * (lowercase + trim) before matching.
+ */
+type ManifestDefaults = boolean | "admin" | "all";
+/**
+ * The raw manifest shape an app declares. See `.claude/specs/manifest.md`.
+ */
+interface Manifest {
+    /** Schema version. Optional, defaults to 1. */
+    version?: number;
+    /** Bundle identifier — reverse DNS. Required. */
+    id: string;
+    /** Display name. Required. */
+    name: string;
+    /** One-line description. Optional. */
+    description?: string;
+    /** URL to app icon. Optional. */
+    icon?: string;
+    /** App version string. Optional. */
+    appVersion?: string;
+    /** Default expiry for permissions. ms-format ("30d", "2h", "1y"). Default "30d". */
+    expiry?: string;
+    /**
+     * Path prefix auto-prepended to permission paths. Optional, defaults to
+     * `id`. Set to `""` to disable entirely. Individual permissions can opt
+     * out with `skipPrefix: true`.
+     */
+    prefix?: string;
+    /**
+     * Default permission set to auto-include. Optional, defaults to `true`.
+     * See {@link ManifestDefaults}.
+     */
+    defaults?: ManifestDefaults | string;
+    /** Whether to include the public-space companion delegation. Default `true`. */
+    includePublicSpace?: boolean;
+    /**
+     * Additional permissions beyond the defaults. Use for cross-space access,
+     * DuckDB (opt-in), or `skipPrefix: true` entries.
+     */
+    permissions?: PermissionEntry[];
+    /** Pre-delegations to other DIDs at sign-in. */
+    delegations?: ManifestDelegation[];
+}
+/**
+ * A resolved permission entry with fully-expanded paths and action URNs.
+ * This is the shape the delegation flow compares against parsed recap
+ * capabilities, and the shape the session-key delegation path actually uses.
+ */
+interface ResourceCapability {
+    /** Long-form service, e.g. "tinycloud.kv". */
+    service: string;
+    /** Space id — "default" stays as-is here; the caller resolves it to a full SpaceId at sign-in time. */
+    space: string;
+    /** Path with the manifest prefix applied (or skipped per `skipPrefix`). */
+    path: string;
+    /** Full-URN actions, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
+    actions: string[];
+    /** Per-entry expiry override in milliseconds. */
+    expiryMs?: number;
+}
+/**
+ * A resolved delegation entry with fully-expanded permissions.
+ */
+interface ResolvedDelegate {
+    /** DID of the delegate. */
+    did: string;
+    /** Informational display name. Optional. */
+    name?: string;
+    /** Expiry in milliseconds (per-delegation > manifest default > 30 days). */
+    expiryMs: number;
+    /** Fully resolved permissions. */
+    permissions: ResourceCapability[];
+}
+/**
+ * The output of {@link resolveManifest}: a fully-expanded capability set
+ * ready to drive the SIWE recap.
+ */
+interface ResolvedCapabilities {
+    /** Bundle identifier copied from manifest.id. */
+    id: string;
+    /** All session-key resources with paths fully resolved (prefix applied). */
+    resources: ResourceCapability[];
+    /** Default expiry for the session, in milliseconds. */
+    expiryMs: number;
+    /** Whether to include the public-space companion. */
+    includePublicSpace: boolean;
+    /** Additional delegate targets with resolved paths. */
+    additionalDelegates: ResolvedDelegate[];
+}
+/**
+ * Thrown when the manifest fails validation (missing id/name, bad expiry,
+ * empty actions on a permission, etc).
+ */
+declare class ManifestValidationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Default expiry when neither the manifest, delegation, nor permission
+ * specifies one. Spec: 30 days.
+ */
+declare const DEFAULT_EXPIRY = "30d";
+/**
+ * Default `defaults` value when the manifest omits it. Spec: standard tier.
+ */
+declare const DEFAULT_DEFAULTS: ManifestDefaults;
+/**
+ * Known services and their short-form (recap URI) names. The TinyCloud
+ * node encodes the recap resource URI with the short service name, while
+ * action URNs and manifest entries use the long `tinycloud.<short>` form.
+ * This table is the canonical bridge between the two.
+ */
+declare const SERVICE_SHORT_TO_LONG: Readonly<Record<string, string>>;
+/**
+ * Inverse of {@link SERVICE_SHORT_TO_LONG}.
+ */
+declare const SERVICE_LONG_TO_SHORT: Readonly<Record<string, string>>;
+/**
+ * Parse an ms-format duration string (e.g. "30d", "2h", "1y") into
+ * milliseconds.
+ *
+ * @throws {ManifestValidationError} on empty string, non-string input, or
+ * any input `ms()` cannot parse.
+ */
+declare function parseExpiry(duration: string): number;
+/**
+ * Expand a list of action short names (or already-expanded URNs) into full
+ * ability URNs of the form `<service>/<action>`.
+ *
+ * Examples:
+ *   `expandActionShortNames("tinycloud.kv", ["get", "put"])`
+ *     → `["tinycloud.kv/get", "tinycloud.kv/put"]`
+ *   `expandActionShortNames("tinycloud.kv", ["tinycloud.kv/get"])`
+ *     → `["tinycloud.kv/get"]` (passed through unchanged)
+ */
+declare function expandActionShortNames(service: string, actions: readonly string[]): string[];
+/**
+ * Apply the manifest prefix to a permission path per the spec rules.
+ *
+ * - `skipPrefix: true` → path is returned as-is
+ * - `prefix === ""` → path is returned as-is
+ * - path starts with "/" → `prefix + path`  (e.g. "com.listen.app" + "/" → "com.listen.app/")
+ * - otherwise → `prefix + "/" + path`  (e.g. "com.listen.app" + "data.sqlite" → "com.listen.app/data.sqlite")
+ */
+declare function applyPrefix(prefix: string, path: string, skipPrefix: boolean): string;
+/**
+ * Fetch and parse a manifest from a URL (browser) or file path (node).
+ * The runtime decides the fetch strategy via `globalThis.fetch`; this is
+ * platform-agnostic. Callers that want custom loading should JSON.parse a
+ * Manifest themselves and skip this helper.
+ *
+ * @throws if the fetch fails, the JSON is invalid, or the manifest fails
+ * validation.
+ */
+declare function loadManifest(url: string): Promise<Manifest>;
+/**
+ * Validate a manifest-shaped object and return it strongly-typed.
+ * Throws {@link ManifestValidationError} on any hard failure.
+ */
+declare function validateManifest(input: unknown): Manifest;
+/**
+ * Normalize a `defaults` value: lowercase + trim, then match against known
+ * tiers. Unknown string values silently fall back to `true` (standard).
+ * Boolean values pass through.
+ */
+declare function normalizeDefaults(value: Manifest["defaults"] | undefined): ManifestDefaults;
+/**
+ * Resolve a raw manifest into a {@link ResolvedCapabilities} object: expand
+ * shortform actions, apply the prefix, merge defaults, and compute effective
+ * expiries. Pure function — does no I/O.
+ *
+ * Resolution semantics (spec):
+ * - `prefix` defaults to `id`; set to `""` to disable prefix application entirely.
+ * - `defaults` defaults to `true` (standard tier); unknown string values fall back to `true`.
+ * - Per-entry expiry overrides per-delegation overrides manifest > `DEFAULT_EXPIRY`.
+ * - Default entries use `skipPrefix: false` so they inherit the manifest prefix.
+ * - Prefix inheritance applies identically to `permissions` and `delegations[*].permissions`.
+ */
+declare function resolveManifest(input: Manifest): ResolvedCapabilities;
+
+/**
+ * Capability subset checking and recap parsing.
+ *
+ * This module powers the capability-chain delegation flow. The key decision
+ * a `delegateTo` call has to make is: "are the requested capabilities a
+ * subset of what the current session already grants?"
+ *
+ * - If yes → issue the delegation via the session-key UCAN path (no wallet prompt).
+ * - If no → raise {@link PermissionNotInManifestError} so the caller can
+ *   trigger an escalation flow via `requestPermissions`.
+ *
+ * Canonical spec: `.claude/specs/capability-chain.md`.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Thrown when a `delegateTo` call requests capabilities that the current
+ * session does not already grant. The caller can catch this and trigger
+ * `requestPermissions(missing)` to show an escalation modal.
+ */
+declare class PermissionNotInManifestError extends Error {
+    readonly missing: PermissionEntry[];
+    readonly granted: PermissionEntry[];
+    constructor(missing: PermissionEntry[], granted: PermissionEntry[]);
+}
+/**
+ * Thrown when the current session has expired (or will expire within the
+ * safety margin). The caller should trigger a fresh sign-in.
+ */
+declare class SessionExpiredError extends Error {
+    readonly expiredAt: Date;
+    constructor(expiredAt: Date);
+}
+interface SubsetCheckResult {
+    /** True when every requested entry is covered by a granted entry. */
+    subset: boolean;
+    /** Entries the granted set does not cover (empty when `subset` is true). */
+    missing: PermissionEntry[];
+}
+/**
+ * Check whether `requested` is a strict subset of `granted`.
+ *
+ * Matching rules for each `requested[i]`:
+ * - `service` matches exactly.
+ * - `space` matches exactly.
+ * - Path containment:
+ *     - If `granted.path` ends with `/`, it covers any `requested.path` that
+ *       starts with `granted.path`.
+ *     - Otherwise, the paths must match exactly.
+ * - Action containment: every URN in `requested.actions` must appear in
+ *   `granted.actions` (set subset).
+ *
+ * Any `requested` entry that does not find a matching `granted` entry is
+ * added to `missing` and the overall result is non-subset.
+ *
+ * Both sides are expected to be in the canonical long-form shape (service
+ * starts with `tinycloud.`, actions are full URNs). Use {@link parseRecapCapabilities}
+ * or `expandActionShortNames` to normalize inputs first.
+ */
+declare function isCapabilitySubset(requested: readonly PermissionEntry[], granted: readonly PermissionEntry[]): SubsetCheckResult;
+/**
+ * The raw shape returned from the WASM `parseRecapFromSiwe` export. The
+ * Rust layer encodes the service in the short form (e.g. `"kv"`) because
+ * that is what the SIWE recap resource URI actually contains. We normalize
+ * to the manifest long form (`"tinycloud.kv"`) in {@link parseRecapCapabilities}.
+ *
+ * @internal
+ */
+interface WasmRecapEntry {
+    service: string;
+    space: string;
+    path: string;
+    actions: string[];
+}
+/**
+ * Signature of the WASM `parseRecapFromSiwe` export. Accepts the signed
+ * SIWE message string and returns an array of raw recap entries. Throws if
+ * the SIWE is malformed or the recap statement has been tampered.
+ *
+ * Exposed as an interface so the SDK can inject the web or node binding
+ * without `capabilities.ts` needing to know which.
+ */
+type ParseRecapFromSiwe = (siweString: string) => WasmRecapEntry[];
+/**
+ * Parse a signed SIWE message into an array of {@link PermissionEntry}
+ * objects in the canonical long-form manifest shape.
+ *
+ * This is a thin wrapper around the WASM `parseRecapFromSiwe` export that:
+ * 1. Normalizes short-form services (`"kv"`) to long-form (`"tinycloud.kv"`).
+ * 2. Returns entries in a deterministic order (sorted by space, then service,
+ *    then path) so downstream equality checks are stable.
+ *
+ * Returns an empty array when the SIWE has no recap resource (plain auth
+ * SIWE); this matches the WASM function's behavior and the spec.
+ *
+ * @param parseWasm The WASM `parseRecapFromSiwe` binding.
+ * @param siwe The signed SIWE message string (exactly what `session.siwe` stores).
+ */
+declare function parseRecapCapabilities(parseWasm: ParseRecapFromSiwe, siwe: string): PermissionEntry[];
+
 /**
  * WASM binding abstraction for TinyCloud SDK.
  *
@@ -198,6 +551,8 @@ interface IENSResolver {
 interface IWasmBindings {
     /** Invoke a TinyCloud action */
     invoke: InvokeFunction;
+    /** Invoke multiple TinyCloud capabilities in one authorization header */
+    invokeAny?: InvokeAnyFunction;
     /** Prepare a session (generate session key, build SIWE message) */
     prepareSession: (params: any) => any;
     /** Complete session setup (create delegation) */
@@ -208,6 +563,15 @@ interface IWasmBindings {
     makeSpaceId: (address: string, chainId: number, prefix: string) => string;
     /** Create a delegation */
     createDelegation: (...args: any[]) => any;
+    /**
+     * Parse the recap resource of a signed SIWE message into structured
+     * permission entries. Used by the capability-chain delegation flow to
+     * decide whether a requested delegation is derivable from the current
+     * session without a fresh wallet prompt.
+     *
+     * Returns an empty array when the SIWE has no recap resource.
+     */
+    parseRecapFromSiwe: (siweString: string) => WasmRecapEntry[];
     /** Generate a host SIWE message for space activation */
     generateHostSIWEMessage: (params: any) => string;
     /** Convert a signed SIWE message to delegation headers */
@@ -835,11 +1199,11 @@ declare const DelegationSchema: z.ZodObject<{
     authHeader: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
+    actions: string[];
+    expiry: Date;
     spaceId: string;
     cid: string;
     delegateDID: string;
-    actions: string[];
-    expiry: Date;
     isRevoked: boolean;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
@@ -848,11 +1212,11 @@ declare const DelegationSchema: z.ZodObject<{
     authHeader?: string | undefined;
 }, {
     path: string;
+    actions: string[];
+    expiry: Date;
     spaceId: string;
     cid: string;
     delegateDID: string;
-    actions: string[];
-    expiry: Date;
     isRevoked: boolean;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
@@ -993,11 +1357,11 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         authHeader: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1006,11 +1370,11 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         authHeader?: string | undefined;
     }, {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1042,11 +1406,11 @@ declare const CapabilityEntrySchema: z.ZodObject<{
     }[];
     delegation: {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1079,11 +1443,11 @@ declare const CapabilityEntrySchema: z.ZodObject<{
     }[];
     delegation: {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1126,10 +1490,10 @@ declare const DelegationRecordSchema: z.ZodObject<{
     parentCid: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
+    actions: string[];
     spaceId: string;
     createdAt: Date;
     cid: string;
-    actions: string[];
     isRevoked: boolean;
     delegator: string;
     delegatee: string;
@@ -1139,10 +1503,10 @@ declare const DelegationRecordSchema: z.ZodObject<{
     keyId?: string | undefined;
 }, {
     path: string;
+    actions: string[];
     spaceId: string;
     createdAt: Date;
     cid: string;
-    actions: string[];
     isRevoked: boolean;
     delegator: string;
     delegatee: string;
@@ -1170,15 +1534,15 @@ declare const CreateDelegationParamsSchema: z.ZodObject<{
     statement: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
-    delegateDID: string;
     actions: string[];
+    delegateDID: string;
     statement?: string | undefined;
     expiry?: Date | undefined;
     disableSubDelegation?: boolean | undefined;
 }, {
     path: string;
-    delegateDID: string;
     actions: string[];
+    delegateDID: string;
     statement?: string | undefined;
     expiry?: Date | undefined;
     disableSubDelegation?: boolean | undefined;
@@ -1214,11 +1578,11 @@ declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
     authHeader: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
+    actions: string[];
+    expiry: Date;
     spaceId: string;
     cid: string;
     delegateDID: string;
-    actions: string[];
-    expiry: Date;
     isRevoked: boolean;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
@@ -1227,11 +1591,11 @@ declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
     authHeader?: string | undefined;
 }, {
     path: string;
+    actions: string[];
+    expiry: Date;
     spaceId: string;
     cid: string;
     delegateDID: string;
-    actions: string[];
-    expiry: Date;
     isRevoked: boolean;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
@@ -1272,11 +1636,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1285,11 +1649,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader?: string | undefined;
     }, {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1325,11 +1689,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1338,11 +1702,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader?: string | undefined;
     }, {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1378,11 +1742,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1391,11 +1755,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         authHeader?: string | undefined;
     }, {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1406,11 +1770,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     root: {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1420,11 +1784,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
     };
     chain: {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1434,11 +1798,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
     }[];
     leaf: {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1449,11 +1813,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
 }, {
     root: {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1463,11 +1827,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
     };
     chain: {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1477,11 +1841,11 @@ declare const DelegationChainV2Schema: z.ZodObject<{
     }[];
     leaf: {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1523,7 +1887,7 @@ declare const DelegationFiltersSchema: z.ZodObject<{
     actions?: string[] | undefined;
     delegator?: string | undefined;
     delegatee?: string | undefined;
-    direction?: "received" | "granted" | "all" | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
     includeRevoked?: boolean | undefined;
     validAt?: Date | undefined;
     limit?: number | undefined;
@@ -1533,7 +1897,7 @@ declare const DelegationFiltersSchema: z.ZodObject<{
     actions?: string[] | undefined;
     delegator?: string | undefined;
     delegatee?: string | undefined;
-    direction?: "received" | "granted" | "all" | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
     includeRevoked?: boolean | undefined;
     validAt?: Date | undefined;
     limit?: number | undefined;
@@ -1618,11 +1982,11 @@ declare const ShareLinkSchema: z.ZodObject<{
         authHeader: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1631,11 +1995,11 @@ declare const ShareLinkSchema: z.ZodObject<{
         authHeader?: string | undefined;
     }, {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1653,11 +2017,11 @@ declare const ShareLinkSchema: z.ZodObject<{
     url: string;
     delegation: {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1673,11 +2037,11 @@ declare const ShareLinkSchema: z.ZodObject<{
     url: string;
     delegation: {
         path: string;
+        actions: string[];
+        expiry: Date;
         spaceId: string;
         cid: string;
         delegateDID: string;
-        actions: string[];
-        expiry: Date;
         isRevoked: boolean;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
@@ -1846,17 +2210,17 @@ declare const CreateDelegationWasmParamsSchema: z.ZodObject<{
     notBeforeSecs: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     path: string;
+    actions: string[];
     spaceId: string;
     session: ServiceSession;
     delegateDID: string;
-    actions: string[];
     expirationSecs: number;
     notBeforeSecs?: number | undefined;
 }, {
     path: string;
+    actions: string[];
     spaceId: string;
     delegateDID: string;
-    actions: string[];
     expirationSecs: number;
     session?: unknown;
     notBeforeSecs?: number | undefined;
@@ -1880,18 +2244,18 @@ declare const CreateDelegationWasmResultSchema: z.ZodObject<{
     expiry: z.ZodDate;
 }, "strip", z.ZodTypeAny, {
     path: string;
+    actions: string[];
+    expiry: Date;
     delegation: string;
     cid: string;
     delegateDID: string;
-    actions: string[];
-    expiry: Date;
 }, {
     path: string;
+    actions: string[];
+    expiry: Date;
     delegation: string;
     cid: string;
     delegateDID: string;
-    actions: string[];
-    expiry: Date;
 }>;
 type CreateDelegationWasmResult = z.infer<typeof CreateDelegationWasmResultSchema>;
 
@@ -2569,6 +2933,10 @@ interface TinyCloudConfig {
      * Required when using services.
      */
     invoke?: InvokeFunction;
+    /**
+     * Optional multi-resource invoke function for aggregated capability requests.
+     */
+    invokeAny?: InvokeAnyFunction;
     /**
      * Custom fetch implementation.
      * Defaults to globalThis.fetch.
@@ -2706,6 +3074,11 @@ declare class TinyCloud {
      * @throws Error if services are not initialized
      */
     get duckdb(): IDuckDbService;
+    /**
+     * Get the Hooks service.
+     * @throws Error if services are not initialized
+     */
+    get hooks(): IHooksService;
     /**
      * Get the Data Vault service.
      * @throws Error if services are not initialized or vault service is not registered
@@ -3864,4 +4237,4 @@ interface NodeInfo {
 }
 declare function checkNodeInfo(host: string, sdkProtocol: number, fetchFn?: typeof globalThis.fetch): Promise<NodeInfo>;
 
-export { AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type NodeInfo, type PartialSiweMessage, type PersistedSessionData, type PersistedTinyCloudSession, ProtocolMismatchError, type ReceiveOptions, type ServerHost, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, type ValidationError, VersionCheckError, activateSessionWithHost, buildSpaceUri, checkNodeInfo, createCapabilityKeyRegistry, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, fetchPeerId, makePublicSpaceId, parseSpaceUri, submitHostDelegation, validateClientSession, validatePersistedSessionData };
+export { AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type Manifest, type ManifestDefaults, type ManifestDelegation, ManifestValidationError, type NodeInfo, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedTinyCloudSession, ProtocolMismatchError, type ReceiveOptions, type ResolvedCapabilities, type ResolvedDelegate, type ResourceCapability, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, type ValidationError, VersionCheckError, type WasmRecapEntry, activateSessionWithHost, applyPrefix, buildSpaceUri, checkNodeInfo, createCapabilityKeyRegistry, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, expandActionShortNames, fetchPeerId, isCapabilitySubset, loadManifest, makePublicSpaceId, normalizeDefaults, parseExpiry, parseRecapCapabilities, parseSpaceUri, resolveManifest, submitHostDelegation, validateClientSession, validateManifest, validatePersistedSessionData };