@tinycloud/sdk-core 2.11.1-beta.0 → 3.0.0-beta.1

package/dist/index.d.cts

@@ -1543,6 +1543,89 @@ type SignStrategy = AutoSignStrategy | AutoRejectStrategy | CallbackStrategy | E
  */
 declare const defaultSignStrategy: SignStrategy;
 
+/** OAuth scope which grants a client access to the canonical TinyCloud key. */
+declare const TINYCLOUD_MANAGE_KEY_SCOPE: "tinycloud:manage-key";
+/** OIDC claim containing the canonical identity selected by OpenKey. */
+declare const TINYCLOUD_CANONICAL_IDENTITY_CLAIM: "https://tinycloud.xyz/canonical_identity";
+/**
+ * Adds the canonical-key scope to an OAuth authorization request. Supplying
+ * this value to the authorization server is the explicit user-consent step;
+ * possession of an unrelated OAuth token is never treated as authority to
+ * sign for the canonical key.
+ */
+declare function requestTinyCloudManageKeyScope(scopes?: string | readonly string[]): string;
+/** True only when an OAuth grant explicitly includes `tinycloud:manage-key`. */
+declare function hasTinyCloudManageKeyScope(scopes: unknown): boolean;
+/** The one canonical identity an OAuth `tinycloud:manage-key` token may use. */
+interface CanonicalTinyCloudIdentity {
+    version: "v1";
+    keyId: string;
+    address: CanonicalAddress;
+    chainId: number;
+    did: string;
+    spaceId: string;
+}
+type OpenKeyManageKeyErrorCode = "CONSENT_REQUIRED" | "GRANT_DISABLED" | "USER_EXCLUSIVE" | "TOKEN_EXPIRED" | "MESSAGE_REJECTED" | "IDENTITY_MISMATCH" | "SIGNER_UNAVAILABLE";
+/** A typed denial or recoverable outage from the OAuth canonical-key boundary. */
+declare class OpenKeyManageKeyError extends Error {
+    readonly code: OpenKeyManageKeyErrorCode;
+    /** A user-visible OAuth recovery location, when the signer provides one. */
+    readonly approvalUrl?: string | undefined;
+    readonly retryable: boolean;
+    constructor(code: OpenKeyManageKeyErrorCode, message: string, 
+    /** A user-visible OAuth recovery location, when the signer provides one. */
+    approvalUrl?: string | undefined, retryable?: boolean);
+}
+/**
+ * Parse and fail closed on the OpenID canonical identity claim. The DID and
+ * space are derived from the checksummed address instead of trusted
+ * independently. The identity claim chooses its chain and space name; this
+ * shared contract does not impose an application's chain or space.
+ */
+declare function parseCanonicalTinyCloudIdentity(value: unknown): CanonicalTinyCloudIdentity;
+/** Parse the canonical identity directly from an OAuth/OIDC claims object. */
+declare function parseCanonicalTinyCloudIdentityClaims(claims: unknown): CanonicalTinyCloudIdentity;
+interface OpenKeyManageKeySigningRequestBody {
+    address: string;
+    chainId: number;
+    message: string;
+    type: "siwe";
+}
+interface OpenKeyManageKeySigningResponseBody {
+    approved?: boolean;
+    signature?: string;
+    canonicalIdentity?: unknown;
+    code?: string;
+    reason?: string;
+    error?: string;
+    approvalUrl?: string;
+}
+/** Minimal fetch surface used by the manage-key signer. */
+type OpenKeyManageKeyFetch = (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => Promise<Response>;
+interface OpenKeyManageKeySigningStrategyOptions {
+    /** The OpenKey public signer route for a consented OAuth client. */
+    endpoint: string;
+    /** A bearer token obtained with `tinycloud:manage-key` consent. */
+    token: string | (() => string | Promise<string | undefined>);
+    /** OAuth grant scopes returned with the bearer token. */
+    scopes: string | readonly string[];
+    /** Canonical identity parsed from the token's OIDC claims. */
+    identity: CanonicalTinyCloudIdentity;
+    /** Fetch implementation. Defaults to `globalThis.fetch`. */
+    fetch?: OpenKeyManageKeyFetch;
+}
+interface OpenKeyManageKeyCallbackStrategy extends CallbackStrategy {
+    /** Lets the SDK avoid bootstrap paths that require broader signing authority. */
+    openKeyAutoSign: true;
+}
+/**
+ * Create a client-bound signer for an OAuth token consented for
+ * `tinycloud:manage-key`. It sends exactly one bearer-authenticated, cookie-
+ * free request for the original SIWE string and accepts only the claimed
+ * canonical identity's EIP-191 signature.
+ */
+declare function createOpenKeyManageKeySigningStrategy(options: OpenKeyManageKeySigningStrategyOptions): OpenKeyManageKeyCallbackStrategy;
+
 /**
  * Space creation handler types for TinyCloud authorization.
  *
@@ -3346,4 +3429,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyStorageReceipt };

package/dist/index.d.ts

@@ -1543,6 +1543,89 @@ type SignStrategy = AutoSignStrategy | AutoRejectStrategy | CallbackStrategy | E
  */
 declare const defaultSignStrategy: SignStrategy;
 
+/** OAuth scope which grants a client access to the canonical TinyCloud key. */
+declare const TINYCLOUD_MANAGE_KEY_SCOPE: "tinycloud:manage-key";
+/** OIDC claim containing the canonical identity selected by OpenKey. */
+declare const TINYCLOUD_CANONICAL_IDENTITY_CLAIM: "https://tinycloud.xyz/canonical_identity";
+/**
+ * Adds the canonical-key scope to an OAuth authorization request. Supplying
+ * this value to the authorization server is the explicit user-consent step;
+ * possession of an unrelated OAuth token is never treated as authority to
+ * sign for the canonical key.
+ */
+declare function requestTinyCloudManageKeyScope(scopes?: string | readonly string[]): string;
+/** True only when an OAuth grant explicitly includes `tinycloud:manage-key`. */
+declare function hasTinyCloudManageKeyScope(scopes: unknown): boolean;
+/** The one canonical identity an OAuth `tinycloud:manage-key` token may use. */
+interface CanonicalTinyCloudIdentity {
+    version: "v1";
+    keyId: string;
+    address: CanonicalAddress;
+    chainId: number;
+    did: string;
+    spaceId: string;
+}
+type OpenKeyManageKeyErrorCode = "CONSENT_REQUIRED" | "GRANT_DISABLED" | "USER_EXCLUSIVE" | "TOKEN_EXPIRED" | "MESSAGE_REJECTED" | "IDENTITY_MISMATCH" | "SIGNER_UNAVAILABLE";
+/** A typed denial or recoverable outage from the OAuth canonical-key boundary. */
+declare class OpenKeyManageKeyError extends Error {
+    readonly code: OpenKeyManageKeyErrorCode;
+    /** A user-visible OAuth recovery location, when the signer provides one. */
+    readonly approvalUrl?: string | undefined;
+    readonly retryable: boolean;
+    constructor(code: OpenKeyManageKeyErrorCode, message: string, 
+    /** A user-visible OAuth recovery location, when the signer provides one. */
+    approvalUrl?: string | undefined, retryable?: boolean);
+}
+/**
+ * Parse and fail closed on the OpenID canonical identity claim. The DID and
+ * space are derived from the checksummed address instead of trusted
+ * independently. The identity claim chooses its chain and space name; this
+ * shared contract does not impose an application's chain or space.
+ */
+declare function parseCanonicalTinyCloudIdentity(value: unknown): CanonicalTinyCloudIdentity;
+/** Parse the canonical identity directly from an OAuth/OIDC claims object. */
+declare function parseCanonicalTinyCloudIdentityClaims(claims: unknown): CanonicalTinyCloudIdentity;
+interface OpenKeyManageKeySigningRequestBody {
+    address: string;
+    chainId: number;
+    message: string;
+    type: "siwe";
+}
+interface OpenKeyManageKeySigningResponseBody {
+    approved?: boolean;
+    signature?: string;
+    canonicalIdentity?: unknown;
+    code?: string;
+    reason?: string;
+    error?: string;
+    approvalUrl?: string;
+}
+/** Minimal fetch surface used by the manage-key signer. */
+type OpenKeyManageKeyFetch = (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => Promise<Response>;
+interface OpenKeyManageKeySigningStrategyOptions {
+    /** The OpenKey public signer route for a consented OAuth client. */
+    endpoint: string;
+    /** A bearer token obtained with `tinycloud:manage-key` consent. */
+    token: string | (() => string | Promise<string | undefined>);
+    /** OAuth grant scopes returned with the bearer token. */
+    scopes: string | readonly string[];
+    /** Canonical identity parsed from the token's OIDC claims. */
+    identity: CanonicalTinyCloudIdentity;
+    /** Fetch implementation. Defaults to `globalThis.fetch`. */
+    fetch?: OpenKeyManageKeyFetch;
+}
+interface OpenKeyManageKeyCallbackStrategy extends CallbackStrategy {
+    /** Lets the SDK avoid bootstrap paths that require broader signing authority. */
+    openKeyAutoSign: true;
+}
+/**
+ * Create a client-bound signer for an OAuth token consented for
+ * `tinycloud:manage-key`. It sends exactly one bearer-authenticated, cookie-
+ * free request for the original SIWE string and accepts only the claimed
+ * canonical identity's EIP-191 signature.
+ */
+declare function createOpenKeyManageKeySigningStrategy(options: OpenKeyManageKeySigningStrategyOptions): OpenKeyManageKeyCallbackStrategy;
+
 /**
  * Space creation handler types for TinyCloud authorization.
  *
@@ -3346,4 +3429,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyStorageReceipt };

package/dist/index.js

@@ -15048,6 +15048,236 @@ function createOpenKeyCallbackSigningStrategy(options2) {
 }
 var defaultSignStrategy = { type: "auto-sign" };
 
+// src/authorization/manage-key.ts
+var TINYCLOUD_MANAGE_KEY_SCOPE = "tinycloud:manage-key";
+var TINYCLOUD_CANONICAL_IDENTITY_CLAIM = "https://tinycloud.xyz/canonical_identity";
+function requestTinyCloudManageKeyScope(scopes = []) {
+  const requested = typeof scopes === "string" ? scopes.split(/\s+/u) : scopes;
+  return [
+    ...new Set([...requested, TINYCLOUD_MANAGE_KEY_SCOPE].filter(Boolean))
+  ].sort().join(" ");
+}
+function hasTinyCloudManageKeyScope(scopes) {
+  const values = Array.isArray(scopes) ? scopes : typeof scopes === "string" ? scopes.split(/\s+/u) : [];
+  return values.includes(TINYCLOUD_MANAGE_KEY_SCOPE);
+}
+var OpenKeyManageKeyError = class extends Error {
+  constructor(code3, message, approvalUrl, retryable = false) {
+    super(message);
+    this.code = code3;
+    this.approvalUrl = approvalUrl;
+    this.retryable = retryable;
+    this.name = "OpenKeyManageKeyError";
+  }
+};
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function rejected(message) {
+  return new OpenKeyManageKeyError("MESSAGE_REJECTED", message);
+}
+function identityMismatch(message) {
+  return new OpenKeyManageKeyError("IDENTITY_MISMATCH", message);
+}
+function parseCanonicalTinyCloudIdentity(value) {
+  if (!isRecord2(value))
+    throw rejected("Canonical TinyCloud identity is missing");
+  const expectedKeys = [
+    "address",
+    "chainId",
+    "did",
+    "keyId",
+    "spaceId",
+    "version"
+  ];
+  const actualKeys = Object.keys(value).sort();
+  if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
+    throw rejected("Canonical TinyCloud identity has an invalid shape");
+  }
+  if (value.version !== "v1")
+    throw rejected("Canonical TinyCloud identity version is unsupported");
+  if (typeof value.keyId !== "string" || value.keyId.trim() === "") {
+    throw rejected("Canonical TinyCloud identity key ID is invalid");
+  }
+  if (typeof value.address !== "string") {
+    throw rejected("Canonical TinyCloud identity address is invalid");
+  }
+  let address;
+  try {
+    address = canonicalizeAddress(value.address);
+  } catch {
+    throw rejected("Canonical TinyCloud identity address is invalid");
+  }
+  if (address !== value.address) {
+    throw rejected(
+      "Canonical TinyCloud identity address must use EIP-55 checksum casing"
+    );
+  }
+  if (typeof value.chainId !== "number" || !Number.isSafeInteger(value.chainId) || value.chainId <= 0) {
+    throw rejected("Canonical TinyCloud identity chain ID is invalid");
+  }
+  const did = pkhDid(address, value.chainId);
+  const spacePrefix = `tinycloud:pkh:eip155:${value.chainId}:${address}:`;
+  if (typeof value.spaceId !== "string" || !value.spaceId.startsWith(spacePrefix)) {
+    throw rejected("Canonical TinyCloud identity space is invalid");
+  }
+  const spaceName = value.spaceId.slice(spacePrefix.length);
+  let spaceId;
+  try {
+    spaceId = makePkhSpaceId(address, value.chainId, spaceName);
+  } catch {
+    throw rejected("Canonical TinyCloud identity space is invalid");
+  }
+  if (value.did !== did || value.spaceId !== spaceId) {
+    throw rejected("Canonical TinyCloud identity does not match its address");
+  }
+  return {
+    version: "v1",
+    keyId: value.keyId,
+    address,
+    chainId: value.chainId,
+    did,
+    spaceId
+  };
+}
+function parseCanonicalTinyCloudIdentityClaims(claims) {
+  if (!isRecord2(claims)) throw rejected("OAuth claims are missing");
+  return parseCanonicalTinyCloudIdentity(
+    claims[TINYCLOUD_CANONICAL_IDENTITY_CLAIM]
+  );
+}
+function identitiesEqual(left, right) {
+  return left.version === right.version && left.keyId === right.keyId && left.address === right.address && left.chainId === right.chainId && left.did === right.did && left.spaceId === right.spaceId;
+}
+function errorForResponse(body, status) {
+  const message = body?.reason ?? body?.error ?? `OpenKey manage-key signing failed with HTTP ${status}`;
+  switch (body?.code ?? body?.error) {
+    case "missing_scope":
+    case "consent_required":
+      return new OpenKeyManageKeyError("CONSENT_REQUIRED", message, body?.approvalUrl);
+    case "client_disabled":
+    case "signing_disabled":
+    case "grant_disabled":
+      return new OpenKeyManageKeyError("GRANT_DISABLED", message, body?.approvalUrl);
+    case "user_exclusive":
+      return new OpenKeyManageKeyError("USER_EXCLUSIVE", message, body?.approvalUrl);
+    case "token_expired":
+    case "token_too_old":
+    case "invalid_token":
+    case "expired_token":
+      return new OpenKeyManageKeyError("TOKEN_EXPIRED", message, body?.approvalUrl);
+    case "canonical_key_unavailable":
+    case "signer_failed":
+      return new OpenKeyManageKeyError(
+        "SIGNER_UNAVAILABLE",
+        "The canonical key signer is temporarily unavailable",
+        void 0,
+        true
+      );
+    default:
+      return new OpenKeyManageKeyError(
+        status === 401 ? "TOKEN_EXPIRED" : "MESSAGE_REJECTED",
+        message,
+        body?.approvalUrl
+      );
+  }
+}
+async function resolveToken(token) {
+  const value = typeof token === "function" ? await token() : token;
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new OpenKeyManageKeyError(
+      "CONSENT_REQUIRED",
+      "A manage-key OAuth bearer token is required"
+    );
+  }
+  return value;
+}
+function normalizeEndpoint(value) {
+  let endpoint;
+  try {
+    endpoint = new URL(value);
+  } catch {
+    throw rejected("OpenKey manage-key signing endpoint must be an absolute URL");
+  }
+  const rawHttpAuthority = value.match(/^http:\/\/([^/?#]*)/iu)?.[1];
+  const loopback = rawHttpAuthority !== void 0 && /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/u.test(rawHttpAuthority);
+  if (endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && loopback) || endpoint.username !== "" || endpoint.password !== "" || endpoint.search !== "" || endpoint.hash !== "") {
+    throw rejected("OpenKey manage-key signing endpoint must use HTTPS or exact loopback HTTP");
+  }
+  return endpoint.href;
+}
+function assertSignInRequest(request, identity3) {
+  if (request.type !== "siwe" || request.purpose !== "sign-in" || request.chainId !== identity3.chainId || request.address !== identity3.address || typeof request.message !== "string" || request.message.length === 0) {
+    throw rejected(
+      "Manage-key signing only permits the canonical sign-in SIWE request"
+    );
+  }
+}
+function createOpenKeyManageKeySigningStrategy(options2) {
+  const identity3 = parseCanonicalTinyCloudIdentity(options2.identity);
+  const endpoint = normalizeEndpoint(options2.endpoint);
+  return {
+    type: "callback",
+    openKeyAutoSign: true,
+    handler: async (request) => {
+      assertSignInRequest(request, identity3);
+      const fetchImpl = options2.fetch ?? globalThis.fetch;
+      if (!fetchImpl)
+        throw rejected("OpenKey manage-key signing requires fetch");
+      if (!hasTinyCloudManageKeyScope(options2.scopes)) {
+        throw new OpenKeyManageKeyError(
+          "CONSENT_REQUIRED",
+          "The OAuth bearer token was not granted tinycloud:manage-key"
+        );
+      }
+      const token = await resolveToken(options2.token);
+      const response = await fetchImpl(endpoint, {
+        method: "POST",
+        credentials: "omit",
+        headers: {
+          authorization: `Bearer ${token}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({
+          address: request.address,
+          chainId: request.chainId,
+          message: request.message,
+          type: "siwe"
+        })
+      });
+      let body;
+      try {
+        const value = await response.json();
+        body = isRecord2(value) ? value : void 0;
+      } catch {
+        body = void 0;
+      }
+      if (!response.ok || body?.approved !== true)
+        throw errorForResponse(body, response.status);
+      if (typeof body.signature !== "string")
+        throw rejected("OpenKey manage-key signer did not return a signature");
+      const responseIdentity = parseCanonicalTinyCloudIdentity(
+        body.canonicalIdentity
+      );
+      if (!identitiesEqual(identity3, responseIdentity)) {
+        throw identityMismatch(
+          "OpenKey manage-key signer returned a different canonical identity"
+        );
+      }
+      if (!await verifyEip191MessageSignature(
+        request.message,
+        body.signature,
+        identity3.address
+      )) {
+        throw rejected(
+          "OpenKey manage-key signer returned an invalid signature"
+        );
+      }
+      return { approved: true, signature: body.signature };
+    }
+  };
+}
+
 // src/authorization/spaceCreation.ts
 var AutoApproveSpaceCreationHandler = class {
   /**
@@ -17816,6 +18046,7 @@ export {
   NETWORK_NAME_PATTERN,
   NetworkIdError,
   OPENKEY_ACTION_ID_SEPARATOR,
+  OpenKeyManageKeyError,
   POLICY_CAPABILITY_V1_DOMAIN,
   POLICY_CAPABILITY_V1_SCHEMA,
   POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE,
@@ -17886,7 +18117,9 @@ export {
   SpaceService,
   TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
   TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_CANONICAL_IDENTITY_CLAIM,
   TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_MANAGE_KEY_SCOPE,
   TINYCLOUD_PUBLIC_SPACE_MANIFEST,
   TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud,
@@ -17947,6 +18180,7 @@ export {
   createInMemoryLocalNodeIdentityStore,
   createLocalStorageLocalNodeIdentityStore,
   createOpenKeyCallbackSigningStrategy,
+  createOpenKeyManageKeySigningStrategy,
   createPolicyEnforcementDelegation,
   createShareArtifact,
   createShareArtifactAsync,
@@ -18005,6 +18239,7 @@ export {
   generateRandomReceiverKey,
   getPolicyRootStatusV3,
   getTinyCloudDebugLogs,
+  hasTinyCloudManageKeyScope,
   hexDecode,
   hexEncode,
   holderBindingCanonicalBytes,
@@ -18037,6 +18272,8 @@ export {
   openWrappedKey,
   parseCanonicalNetworkId,
   parseCanonicalRecapResource,
+  parseCanonicalTinyCloudIdentity,
+  parseCanonicalTinyCloudIdentityClaims,
   parseCompactUcanAuthorization,
   parseExpiry,
   parseNetworkId2 as parseNetworkId,
@@ -18059,6 +18296,7 @@ export {
   projectUnifiedPolicyCapability,
   recapCaveatsEqual,
   renewPolicyRootStatusV3,
+  requestTinyCloudManageKeyScope,
   resolveCloudLocation,
   resolveManifest,
   resolveManifestKnowledgeRoot,