@tinycloud/sdk-core 2.11.0-beta.0 → 2.11.0-beta.10

package/dist/index.d.ts

@@ -2,8 +2,8 @@ import { z } from 'zod';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
-import { m as Delegation, e as CreateDelegationParams, G as GenerateShareParams, az as ShareLink, b8 as SpaceInfo, I as ICapabilityKeyRegistry, y as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, w as DelegationRevocationReceipt } from './recipient-types.schema-B2wH53_t.js';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, bH as CapabilityKeyRegistry, bI as CapabilityKeyRegistryErrorCode, bJ as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, a as DelegationError, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, R as DelegationResult, x as DelegationStatus, E as EncodedShareData, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationReceipt, T as OwnerShareAction, U as OwnerShareMatcher, V as OwnerSharePolicyRegistration, W as OwnerSharePolicyRegistrationReceipt, X as OwnerSharePolicyV2, Y as ReceiveOptions, Z as RegisterOwnerSharePolicyParams, _ as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, $ as SenderShareKeyStorage, a0 as SenderShareRecord, a1 as SenderShareRecordStorage, a2 as SenderShareRevocationScope, a3 as SenderShareStore, a4 as ShareAccess, a5 as ShareAccessError, a6 as ShareAccessV2, a7 as ShareAction, a9 as ShareAddressedDelegationEnvelopeV2, aa as ShareAddressedDelegationEnvelopeV2Schema, ab as ShareAddressedDelegationRequestV2, ac as ShareAddressedDelegationRequestV2Schema, ad as ShareAddressedDelegationResponseV2, ae as ShareAddressedDelegationResponseV2Schema, af as ShareAddressedRecipientMatcher, ag as ShareArtifactInput, ah as ShareArtifactResult, ai as ShareArtifactV2, aj as ShareCache, ak as ShareCacheEntry, al as ShareCacheKey, am as ShareCacheMetadata, an as ShareCapabilityLike, ao as ShareConflict, ap as ShareContentMetadata, aq as ShareContentSource, ar as ShareDeliveryAuthorization, as as ShareDeliveryAuthorizationReceipt, at as ShareDeliveryAuthorizationRequest, au as ShareDetachedProof, av as ShareEnvelopeError, aw as ShareEnvelopeV2, ax as ShareExpiryBounds, ay as ShareKvContentSource, aA as ShareLinkData, aB as ShareLinkLocation, aC as ShareListEntry, aD as ShareListResult, aE as ShareNativeAction, aF as ShareNativeInvokeEnvelopeV1, aG as ShareNativeInvokeErrorResult, aH as ShareNativeInvokeInput, aI as ShareNativeInvokeResult, aJ as ShareNativeInvokeSuccessResult, aK as ShareNativeResponse, aL as ShareNativeResponseSchema, aM as SharePolicy, aN as SharePolicyBinding, aO as SharePolicySession, aP as SharePolicySessionV1, aQ as SharePolicySessionWireV1, aR as ShareReadInvocationV1, aS as ShareReadResult, aT as ShareRecipientClient, aU as ShareRecipientClientOptions, aW as ShareRecipientPolicy, aY as ShareRecipientResult, aZ as ShareRecipientTarget, a$ as ShareResource, b1 as ShareSaveOptions, b2 as ShareSchema, b3 as ShareSqlContentSource, b4 as ShareWireAction, b5 as SharingService, b6 as SharingServiceConfig, b7 as SignedDelegation, b9 as SpaceOwnership, bK as StoredDelegationChain, ba as ValidateShareDeliveryAuthorizationExpected, bb as VerifyShareEnvelopeOptions, bc as canonicalOwnerSharePolicy, bd as computeOwnerShareRegistrationCid, be as computeShareCid, bL as createCapabilityKeyRegistry, bf as createDelegatedShareKey, bg as createPolicyEnforcementDelegation, bh as createShareArtifact, bi as createShareArtifactAsync, bj as createSharePolicy, bk as createSharingService, bl as decryptShareBytesAsync, bm as encodeInlineShareUrl, bn as encodeShareArtifact, bo as encodeShareUrl, bp as encryptShareBytes, bq as encryptShareBytesAsync, br as intersectShareCapabilities, bs as isV2ShareLink, bt as normalizeShareActions, bu as normalizeShareRecipientTarget, bv as normalizeShareResource, bw as parseShareArtifact, bx as parseShareUrl, by as restoreDelegatedShareKey, bz as shareCapabilityAllows, bA as shareDeliveryTrustedKid, bB as signShareEnvelope, bC as validateOwnerSharePolicyRegistration, bD as validateOwnerSharePolicyRegistrationBytes, bE as validateShareDeliveryAuthorizationBytes, bF as verifyShareCid, bG as verifyShareEnvelope } from './recipient-types.schema-B2wH53_t.js';
+import { m as Delegation, e as CreateDelegationParams, G as GenerateShareParams, aB as ShareLink, ba as SpaceInfo, I as ICapabilityKeyRegistry, y as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, w as DelegationRevocationReceipt } from './recipient-types.schema-D5pDlIqn.js';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, bJ as CapabilityKeyRegistry, bK as CapabilityKeyRegistryErrorCode, bL as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, a as DelegationError, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, R as DelegationResult, x as DelegationStatus, E as EncodedShareData, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as ReceiveOptions, $ as RegisterOwnerSharePolicyParams, a0 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a1 as SenderShareKeyStorage, a2 as SenderShareRecord, a3 as SenderShareRecordStorage, a4 as SenderShareRevocationScope, a5 as SenderShareStore, a6 as ShareAccess, a7 as ShareAccessError, a8 as ShareAccessV2, a9 as ShareAction, ab as ShareAddressedDelegationEnvelopeV2, ac as ShareAddressedDelegationEnvelopeV2Schema, ad as ShareAddressedDelegationRequestV2, ae as ShareAddressedDelegationRequestV2Schema, af as ShareAddressedDelegationResponseV2, ag as ShareAddressedDelegationResponseV2Schema, ah as ShareAddressedRecipientMatcher, ai as ShareArtifactInput, aj as ShareArtifactResult, ak as ShareArtifactV2, al as ShareCache, am as ShareCacheEntry, an as ShareCacheKey, ao as ShareCacheMetadata, ap as ShareCapabilityLike, aq as ShareConflict, ar as ShareContentMetadata, as as ShareContentSource, at as ShareDeliveryAuthorization, au as ShareDeliveryAuthorizationReceipt, av as ShareDeliveryAuthorizationRequest, aw as ShareDetachedProof, ax as ShareEnvelopeError, ay as ShareEnvelopeV2, az as ShareExpiryBounds, aA as ShareKvContentSource, aC as ShareLinkData, aD as ShareLinkLocation, aE as ShareListEntry, aF as ShareListResult, aG as ShareNativeAction, aH as ShareNativeInvokeEnvelopeV1, aI as ShareNativeInvokeErrorResult, aJ as ShareNativeInvokeInput, aK as ShareNativeInvokeResult, aL as ShareNativeInvokeSuccessResult, aM as ShareNativeResponse, aN as ShareNativeResponseSchema, aO as SharePolicy, aP as SharePolicyBinding, aQ as SharePolicySession, aR as SharePolicySessionV1, aS as SharePolicySessionWireV1, aT as ShareReadInvocationV1, aU as ShareReadResult, aV as ShareRecipientClient, aW as ShareRecipientClientOptions, aY as ShareRecipientPolicy, a_ as ShareRecipientResult, a$ as ShareRecipientTarget, b1 as ShareResource, b3 as ShareSaveOptions, b4 as ShareSchema, b5 as ShareSqlContentSource, b6 as ShareWireAction, b7 as SharingService, b8 as SharingServiceConfig, b9 as SignedDelegation, bb as SpaceOwnership, bM as StoredDelegationChain, bc as ValidateShareDeliveryAuthorizationExpected, bd as VerifyShareEnvelopeOptions, be as canonicalOwnerSharePolicy, bf as computeOwnerShareRegistrationCid, bg as computeShareCid, bN as createCapabilityKeyRegistry, bh as createDelegatedShareKey, bi as createPolicyEnforcementDelegation, bj as createShareArtifact, bk as createShareArtifactAsync, bl as createSharePolicy, bm as createSharingService, bn as decryptShareBytesAsync, bo as encodeInlineShareUrl, bp as encodeShareArtifact, bq as encodeShareUrl, br as encryptShareBytes, bs as encryptShareBytesAsync, bt as intersectShareCapabilities, bu as isV2ShareLink, bv as normalizeShareActions, bw as normalizeShareRecipientTarget, bx as normalizeShareResource, by as parseShareArtifact, bz as parseShareUrl, bA as restoreDelegatedShareKey, bB as shareCapabilityAllows, bC as shareDeliveryTrustedKid, bD as signShareEnvelope, bE as validateOwnerSharePolicyRegistration, bF as validateOwnerSharePolicyRegistrationBytes, bG as validateShareDeliveryAuthorizationBytes, bH as verifyShareCid, bI as verifyShareEnvelope } from './recipient-types.schema-D5pDlIqn.js';
 export { ACCOUNT_INDEX_SCHEMA, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, a as Policy, P as PolicyEngineRecord, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, S as SignedObjectSigner, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, U as UnsignedPolicyEngineRecord, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from './signed-object-C6mWbTbB.js';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';
@@ -680,8 +680,11 @@ interface SubsetCheckResult {
  * - Action containment: every requested URN must be matched exactly or by a
  *   service-scoped wildcard such as `tinycloud.kv/*`.
  *
- * Any `requested` entry that does not find a matching `granted` entry is
- * added to `missing` and the overall result is non-subset.
+ * Grant entries with the same service, space, path coverage, and caveats are
+ * considered together. This matters because ReCap parsers may return one
+ * entry per action even when the original manifest grouped those actions.
+ * Any `requested` entry whose actions are not collectively covered is added
+ * to `missing` and the overall result is non-subset.
  *
  * Both sides are expected to be in the canonical long-form shape (service
  * starts with `tinycloud.`, actions are full URNs). Use {@link parseRecapCapabilities}
@@ -1559,6 +1562,259 @@ declare class AutoApproveSpaceCreationHandler implements ISpaceCreationHandler {
  */
 declare const defaultSpaceCreationHandler: ISpaceCreationHandler;
 
+interface TinyCloudAuthorizationRequestV1 {
+    protocolVersion: 1;
+    /** The suggested SIWE. OpenKey may narrow this before signing. */
+    siwe: string;
+    /** Which OpenKey keyId to sign with. Optional; user may pick. */
+    keyId?: string;
+    /** Optional presentation envelope for the review page. */
+    presentation?: CapabilityPresentationEnvelopeV1;
+}
+interface TinyCloudAuthorizationResultV1 {
+    protocolVersion: 1;
+    /** EIP-55 encoded signer address. */
+    address: string;
+    /** Signature over `signedMessage`, hex-encoded (0x…). */
+    signature: string;
+    /**
+     * The EXACT bytes the signature verifies against. When the user narrows
+     * capabilities in the review, this is the regenerated SIWE — not the
+     * caller's original request.
+     */
+    signedMessage: string;
+    /** Action IDs the user selected (or default consent). Opaque strings. */
+    selectedActionKeys: string[];
+    /** Effective grant set after narrowing. */
+    permissions: Array<TinyCloudEffectiveGrantV1>;
+}
+interface TinyCloudEffectiveGrantV1 {
+    service: string;
+    space: string;
+    path: string;
+    actions: string[];
+}
+interface CapabilityPresentationEnvelopeV1 {
+    protocolVersion: 1;
+    displayName?: string;
+    /**
+     * Reason string the caller supplied for the delegation. Rendered as
+     * caller-supplied context — NEVER treated as verified metadata unless
+     * the receiving side origin-binds a manifest that carries the same
+     * text. The OpenKey widget marks this as "reason provided by caller".
+     */
+    reason?: string;
+    manifestId?: string;
+    manifestDigest?: string;
+    /**
+     * Full manifest payload(s) the SDK forwards so the OpenKey review UI
+     * can render honest provenance labels. Display-only:
+     *   - The envelope MUST NEVER expand authority; the ReCap payload is
+     *     the sole gate for what the user can approve.
+     *   - The widget transport size-bounds and validates the envelope
+     *     before use; oversized/malformed envelopes are dropped.
+     *   - The OpenKey server's /authorize-sign-prepare route decides trust
+     *     — even a well-formed envelope stays `unsigned` unless the
+     *     browser origin is verifiable and its well-known manifest
+     *     content-digest matches `manifestDigest`.
+     */
+    manifests?: Array<{
+        name?: string;
+        appId?: string;
+        payload?: Record<string, unknown>;
+    }>;
+}
+/**
+ * Runtime validator for a TinyCloudAuthorizationResultV1. Returns null when
+ * the payload matches the expected shape; returns an error message string
+ * otherwise. Designed for use at the js-sdk trust boundary (browser-auth,
+ * NodeUserAuthorization) so a compromised OpenKey response cannot inject
+ * unexpected fields into a session.
+ */
+declare function validateAuthorizationResultV1(value: unknown): {
+    ok: true;
+    value: TinyCloudAuthorizationResultV1;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Selected action ID rules. The OpenKey side builds these with the exact
+ * separator convention below (mirror of `packages/capability-review/src/ids`).
+ * Consumers should treat them as opaque; only equality comparisons and set
+ * membership are guaranteed to be stable.
+ */
+declare const OPENKEY_ACTION_ID_SEPARATOR = "\0";
+declare function isPlausibleOpenKeyActionId(id: unknown): id is string;
+/**
+ * Canonical decomposition of a ReCap `att` resource URI into `{ space, path }`
+ * matching the SEMANTIC the WASM `parseRecapFromSiwe` emitter uses.
+ *
+ * Sol final continuation contract requirement 1: every producer AND consumer
+ * of canonical four-part action IDs must parse resources the same way. The
+ * on-wire structure of a TinyCloud ReCap resource is:
+ *
+ *   `<space>/<short-service>[/<sub-path>]`
+ *
+ * where `<space>` is a `tinycloud:pkh:...` URN and `<short-service>` is the
+ * unqualified service name (`kv`, `sql`, `capabilities`, …). WASM's
+ * `parseRecapFromSiwe` returns `{ service: <short>, space: <space>, path: <sub-path OR "">}`
+ * — the service segment is NEVER part of the `path`. Prior consumer parsing
+ * left the service segment INSIDE `path`, which produced a four-part ID
+ * different from what OpenKey emits (which uses WASM's `entry.path`
+ * directly). That divergence caused every real production round-trip to
+ * fail the `grantedFourPartIndex.get(rawKey)` lookup silently — Sol
+ * explicitly cited this as blocking approval.
+ *
+ * Behaviour:
+ *   - Non-`tinycloud:` URIs are returned unchanged as `{ space: uri, path: "" }`.
+ *   - `tinycloud:<...>` without any `/` → `{ space: uri, path: "" }`.
+ *   - `tinycloud:<...>/short` → `{ space, path: "" }` (service segment stripped).
+ *   - `tinycloud:<...>/short/rest...` → `{ space, path: "rest..." }`.
+ *
+ * This makes the consumer's canonical `path` byte-for-byte equal to WASM's
+ * `entry.path`, and therefore byte-for-byte equal to the `path` OpenKey's
+ * `computeActionKey` uses when emitting four-part IDs.
+ */
+declare function parseCanonicalRecapResource(resource: string): {
+    space: string;
+    path: string;
+};
+/**
+ * Immutable SIWE header fields the OpenKey widget is NOT allowed to alter.
+ * The user may narrow capabilities (which changes the ReCap `urn:recap:`
+ * resource AND — because the WASM statement is a human-readable rendering of
+ * the ReCap — the statement text along with it). But domain/address/URI/
+ * version/chainId/nonce/issuedAt bind the message to a specific relying party
+ * plus a specific session-key request and MUST come back identical byte-for-byte.
+ *
+ * `statement` is intentionally NOT part of the immutable set: it derives from
+ * the ReCap and MUST be allowed to change when the ReCap changes. The
+ * capability-subset check (via `unauthorizedRecapCapabilities`) is the
+ * authoritative gate for what the widget was allowed to change.
+ */
+interface ImmutableSiweFields {
+    domain?: string;
+    address?: string;
+    uri?: string;
+    version?: string;
+    chainId?: string;
+    nonce?: string;
+    issuedAt?: string;
+    expirationTime?: string;
+    notBefore?: string;
+    requestId?: string;
+    statement?: string;
+    nonRecapResources?: string;
+}
+/**
+ * Extract the header fields that must be preserved byte-for-byte between the
+ * caller's original prepared SIWE and the bytes OpenKey actually signed. Uses
+ * line-based parsing tolerant of the specific format the WASM emitter uses:
+ *
+ *   <domain> wants you to sign in with your Ethereum account:
+ *   <address>
+ *
+ *   <statement>
+ *
+ *   URI: <uri>
+ *   Version: <n>
+ *   Chain ID: <n>
+ *   Nonce: <hex>
+ *   Issued At: <iso8601>
+ *   Resources:
+ *   - <resource1>
+ *   ...
+ *
+ * Returns fields it was able to identify; downstream comparison is field-by-field
+ * so a missing field on both sides is treated as equal.
+ */
+declare function extractImmutableSiweFields(siwe: string): ImmutableSiweFields;
+/**
+ * Diff two SIWE header field sets. Returns the field names that differ. An
+ * empty array means the caller's prepared header and the signed header agree
+ * on every immutable field.
+ *
+ * Sol final continuation contract requirement 2: `statement` is
+ * ReCap-DERIVED whenever the SIWE carries a `urn:recap:` resource — the
+ * WASM `prepareSession` emitter renders "I further authorize the stated URI
+ * to perform the following actions..." from the ReCap contents and DROPS
+ * any caller-supplied `statement`. Narrowing the ReCap therefore ALWAYS
+ * changes the statement, and treating statement as byte-immutable made
+ * every legitimate narrowing fail immediate rejection — the exact
+ * production round-trip failure Sol cited as blocking approval.
+ *
+ * Correct semantics:
+ *   - For ReCap-bearing SIWEs, statement is validated indirectly via the
+ *     `unauthorizedRecapCapabilities` subset check (the ReCap the
+ *     statement renders is the true authoritative narrowing check).
+ *   - For plain (no-ReCap) SIWEs, statement IS caller-authored and MUST
+ *     remain byte-for-byte identical.
+ *
+ * Callers signal which regime applies via `options.originalHasRecap`.
+ * When omitted (legacy callers), statement is included in the diff — the
+ * safer default for non-ReCap flows.
+ */
+declare function diffImmutableSiweFields(original: ImmutableSiweFields, signed: ImmutableSiweFields, options?: {
+    originalHasRecap?: boolean;
+}): string[];
+/**
+ * Parsed ReCap attenuation payload. Keyed by resource URI ("space/service/path"),
+ * each value is a map of action -> list of caveat objects. Consumers care about
+ * subset comparisons on (resource, action) pairs; caveats are compared shallowly
+ * (any narrowing of caveats is treated as still a subset when the parent grants
+ * the same action).
+ */
+interface RecapAttenuation {
+    [resource: string]: {
+        [action: string]: unknown[];
+    };
+}
+/**
+ * Extract the union of `att` maps from every `urn:recap:` resource in a SIWE
+ * message. Returns an empty object if the SIWE contains no ReCap resources
+ * (which is legal — a plain SIWE grants nothing beyond the message itself).
+ *
+ * Throws if a `urn:recap:` payload is present but cannot be decoded as
+ * base64url JSON with an `att` object. Silent tolerance would let a compromised
+ * OpenKey response bypass the subset check by returning garbage.
+ */
+declare function extractRecapAttenuations(siwe: string): RecapAttenuation;
+/**
+ * Prove that `child` grants are a subset of `parent` grants. Returns a list of
+ * unauthorized (resource, action) pairs — empty means every capability in
+ * `child` was authorized by `parent`.
+ *
+ * "Subset" here means:
+ *   1. Every (resource, action) pair the child grants must appear in the parent.
+ *   2. Every caveat object in the child's caveat list for a given (resource,
+ *      action) must be present (by deep-equality with sorted-key canonicalization)
+ *      in the parent's caveat list for the same pair. That is: child caveats ⊆
+ *      parent caveats as sets of caveat objects.
+ *
+ * ReCap caveat semantics: a caveat list is a DISJUNCTION of alternatives — the
+ * caller may exercise the ability under ANY listed caveat. Broadening a list
+ * (adding a new alternative not in parent) is a violation. Removing an
+ * alternative is fine (narrowing). Replacing a restrictive alternative with a
+ * less-restrictive one is a violation (the replacement is a different object).
+ *
+ * The conservative safe rule: reject if child has ANY caveat not present in the
+ * parent's caveat set. This catches:
+ *   - Removed caveats (parent had 1+, child has 0): the empty list is "no
+ *     restriction" which is broader than any restriction — reject.
+ *   - Broadened caveats (parent had caveat X, child has caveat Y not equal to
+ *     X): Y is a new alternative — reject.
+ *   - Incompatible duplicate caveats (child adds a new caveat alongside a
+ *     parent one): the new caveat is unauthorized — reject.
+ *
+ * Special case: when both parent and child have empty caveat lists, that means
+ * neither imposes restrictions, and the child is a subset.
+ */
+declare function unauthorizedRecapCapabilities(child: RecapAttenuation, parent: RecapAttenuation): Array<{
+    resource: string;
+    action: string;
+}>;
+
 /**
  * Interface for an extension to TCW.
  * This is the platform-agnostic subset — browser-coupled extensions
@@ -2484,6 +2740,13 @@ interface AccountSpace {
     updatedAt?: string;
     expiresAt?: Date;
 }
+interface RegisterBatchSuccess {
+    spaces: AccountSpace[];
+    /** Present iff the batch write failed ambiguously and per-space
+     *  reconciliation recovered it. The original batch error verbatim, so
+     *  callers can record the degradation structurally (TC-361). */
+    recoveredFromBatchError?: ServiceError;
+}
 interface AccountDelegation {
     cid: string;
     direction: "granted" | "received";
@@ -2523,6 +2786,20 @@ interface AccountIndexedReadOptions {
     refreshIndex?: boolean;
 }
 type AccountApplicationListOptions = AccountIndexedReadOptions;
+interface AccountApplicationRegisterOptions {
+    /**
+     * Skip the `application_state` manifest-hash pre-read that normally
+     * short-circuits a redundant write.
+     *
+     * The pre-read is a saving only when the application is already registered
+     * with the same manifest hash. On a freshly bootstrapped account it is
+     * definitionally a miss, so it costs a round trip and buys nothing — and the
+     * write it guards is an `INSERT OR REPLACE`, so performing it unconditionally
+     * is idempotent. Set this only when the caller knows the record cannot
+     * already be current (i.e. the account bootstrap path).
+     */
+    assumeUnregistered?: boolean;
+}
 type AccountSpaceListOptions = AccountIndexedReadOptions;
 interface AccountDelegationListOptions {
     direction?: "granted" | "received" | "all";
@@ -2546,18 +2823,45 @@ interface AccountServiceConfig {
 }
 declare class AccountService {
     private readonly config;
+    /**
+     * Per-account-space memo for {@link ensureAccountIndex}.
+     *
+     * Applying the index migration is a no-op once the schema exists, but the
+     * SQL service still spends two round trips discovering that (create the
+     * migrations table, then read the applied-migration rows). Account bootstrap
+     * touches the index eight times, so without a memo that is ~14 wasted
+     * requests on the cold sign-in path. The in-flight dedupe inside SQLService
+     * never helps here: the node SDK builds a fresh SQLService per
+     * `getAccountDb()` call, so its lock map is always empty.
+     *
+     * Keyed by account space id, so a different account never reuses this entry.
+     * Failures are evicted so a later call retries instead of inheriting a
+     * permanently poisoned result.
+     */
+    private readonly accountIndexReady;
     constructor(config: AccountServiceConfig);
     status(): Promise<Result<AccountStatus>>;
     readonly applications: {
         list: (options?: AccountApplicationListOptions) => Promise<Result<AccountApplication[]>>;
         get: (appId: string) => Promise<Result<AccountApplication>>;
-        register: (manifest: Manifest | Manifest[]) => Promise<Result<AccountApplication>>;
+        register: (manifest: Manifest | Manifest[], options?: AccountApplicationRegisterOptions) => Promise<Result<AccountApplication>>;
         remove: (appId: string) => Promise<Result<void>>;
     };
     readonly spaces: {
         list: (options?: AccountSpaceListOptions) => Promise<Result<AccountSpace[]>>;
         get: (spaceId: string) => Promise<Result<AccountSpace>>;
         register: (space: SpaceInfo | AccountSpace) => Promise<Result<AccountSpace>>;
+        /**
+         * Register multiple spaces in one KV batch write + one multi-row index
+         * write, instead of one `register()` round trip per space (TC-373).
+         *
+         * The stored records are computed exactly once and reused for both the
+         * batch attempt and any reconciliation below, so a fallback never mints a
+         * fresh timestamp for a space that already has a written record — a
+         * second `spaceRecordFromInput` call would produce a new content hash and
+         * leave the first attempt's blocks orphaned.
+         */
+        registerBatch: (spaces: readonly (SpaceInfo | AccountSpace)[]) => Promise<Result<RegisterBatchSuccess>>;
         syncAccessible: () => Promise<Result<AccountSpace[]>>;
         remove: (spaceId: string) => Promise<Result<void>>;
     };
@@ -2590,13 +2894,35 @@ declare class AccountService {
     private deleteApplicationIndex;
     private upsertSpaceIndexQuietly;
     private upsertSpaceIndex;
+    private upsertSpacesIndexQuietly;
+    /**
+     * Upsert multiple space index rows in ONE multi-row `INSERT OR REPLACE`
+     * statement (TC-373), rather than one statement per space. This matters
+     * because `IDatabaseHandle.batch()` executes its statement list as a plain
+     * loop, not a single database transaction — an N-statement batch is not
+     * atomic. A single multi-row INSERT is one SQLite statement, so it applies
+     * atomically: all rows or none.
+     */
+    private upsertSpacesIndex;
     private deleteSpaceIndexQuietly;
     private deleteSpaceIndex;
     private resolveSpace;
     private replaceApplicationsIndexQuietly;
     private replaceSpacesIndexQuietly;
     private replaceDelegationsIndexQuietly;
+    /**
+     * Apply the account index schema at most once per account space.
+     *
+     * The index is a cache over canonical KV state, and every caller already
+     * tolerates it being absent (`ignoreIndexFailure` / `isMissingIndexError`),
+     * so a memo that is wrong in the "already applied" direction degrades to a
+     * `no such table` read that the caller handles. A memo that is wrong in the
+     * other direction would be a real bug, so failures are never cached.
+     */
     private ensureAccountIndex;
+    /** Drop the memo so the next {@link ensureAccountIndex} re-applies the schema. */
+    private invalidateAccountIndexMemo;
+    private applyAccountIndex;
 }
 interface AccountIndexStatus {
     database: string;
@@ -2731,7 +3057,7 @@ interface LocationRecord extends LocationRecordPayload {
 type LocationSource = "explicit" | "local-loopback" | "local-link" | "blockchain" | "centralized" | "fallback";
 declare const DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 declare const DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
-/** Default local loopback node URL probed before registry/fallback resolution. */
+/** Conventional local loopback node URL. Probed only when explicitly configured. */
 declare const DEFAULT_LOCAL_NODE_URL = "http://127.0.0.1:8000";
 /** Probe timeout for the local loopback candidate. No retries. */
 declare const LOCAL_LOOPBACK_PROBE_TIMEOUT_MS = 250;
@@ -2818,7 +3144,7 @@ interface DiscoverLocalTinyCloudNodeOptions {
     subject?: string;
     /** Enable local-node auto-discovery. Default true. */
     autoDiscoverLocalNode?: boolean;
-    /** Local loopback node URL to probe. Default http://127.0.0.1:8000. */
+    /** Local loopback node URL to probe. Omit to avoid probing loopback. */
     localNodeUrl?: string;
     /** Known `*.local.tinycloud.link` subdomain name, probed directly. */
     localLinkName?: string;
@@ -2852,12 +3178,12 @@ interface ResolveTinyCloudHostsOptions {
     /** Verify centralized/blockchain record signatures. Default true. */
     verifyRecords?: boolean;
     /**
-     * Probe for a locally-running TinyCloud node before falling back to
-     * registry/hosted resolution. Default true. Setting false restores the
-     * exact pre-TC-106 resolution order (registry → fallback).
+     * Probe configured and registered local TinyCloud node endpoints before
+     * falling back to registry/hosted resolution. Default true. The loopback
+     * URL is probed only when `localNodeUrl` is explicitly configured.
      */
     autoDiscoverLocalNode?: boolean;
-    /** Local loopback node URL to probe. Default http://127.0.0.1:8000. */
+    /** Local loopback node URL to probe. Omit to avoid probing loopback. */
     localNodeUrl?: string;
     /** Known `*.local.tinycloud.link` subdomain name, probed directly. */
     localLinkName?: string;
@@ -2943,4 +3269,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, discoverLocalTinyCloudNode, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, type SubsetCheckResult, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };