@tinycloud/sdk-core 2.4.0-beta.1 → 2.4.0-beta.6

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService } from '@tinycloud/sdk-services';
+import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, hexDecode, hexEncode, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { SiweMessage } from 'siwe';
 
@@ -3505,63 +3505,6 @@ declare class TinyCloud {
     static readPublicKey<T = unknown>(host: string, address: string, chainId: number, key: string, fetchFn?: FetchFunction): Promise<Result$1<T, ServiceError>>;
 }
 
-/**
- * Shared space utilities for TinyCloud.
- *
- * These functions are platform-agnostic and can be used by both
- * web-sdk and node-sdk for space hosting and session activation.
- */
-/**
- * Result of a space hosting or session activation attempt.
- */
-interface SpaceHostResult {
-    /** Whether the operation succeeded (2xx status) */
-    success: boolean;
-    /** HTTP status code */
-    status: number;
-    /** Error message if failed */
-    error?: string;
-    /** Space IDs that were successfully activated */
-    activated?: string[];
-    /** Space IDs that were skipped (e.g., space doesn't exist yet) */
-    skipped?: string[];
-}
-/**
- * Fetch the peer ID from TinyCloud server for space hosting.
- *
- * The peer ID identifies the TinyCloud server instance that will host the space.
- *
- * @param host - TinyCloud server URL (e.g., "https://node.tinycloud.xyz")
- * @param spaceId - The space ID to host
- * @returns The peer ID string
- * @throws Error if the request fails
- */
-declare function fetchPeerId(host: string, spaceId: string): Promise<string>;
-/**
- * Submit a space hosting delegation to TinyCloud server.
- *
- * This registers a new space with the server, allowing the user
- * to store data in it.
- *
- * @param host - TinyCloud server URL
- * @param headers - Delegation headers (from siweToDelegationHeaders)
- * @returns Result indicating success/failure
- */
-declare function submitHostDelegation(host: string, headers: Record<string, string>): Promise<SpaceHostResult>;
-/**
- * Activate a session with TinyCloud server.
- *
- * This submits the session delegation to the server, enabling the session
- * key to perform operations on behalf of the user.
- *
- * @param host - TinyCloud server URL
- * @param delegationHeader - Session delegation header (from session.delegationHeader)
- * @returns Result indicating success/failure (404 means space doesn't exist)
- */
-declare function activateSessionWithHost(host: string, delegationHeader: {
-    Authorization: string;
-}): Promise<SpaceHostResult>;
-
 /**
  * DelegationManager - Handles delegation CRUD operations.
  *
@@ -4535,6 +4478,145 @@ declare class SpaceService implements ISpaceService {
  */
 declare function createSpaceService(config: SpaceServiceConfig): ISpaceService;
 
+interface AccountApplication {
+    appId: string;
+    manifests: Manifest[];
+    updatedAt?: string;
+    name?: string;
+    description?: string;
+}
+interface AccountDelegation {
+    cid: string;
+    direction: "granted" | "received";
+    spaceId: string;
+    spaceName?: string;
+    counterpartyDid: string;
+    delegateDid: string;
+    delegatorDid?: string;
+    path: string;
+    actions: string[];
+    expiry: Date;
+    status: "active" | "expired" | "revoked";
+    createdAt?: Date;
+}
+interface AccountStatus {
+    did: string;
+    host: string;
+    primarySpaceId?: string;
+    accountSpaceId?: string;
+    applications: number;
+    grantedDelegations: number;
+    receivedDelegations: number;
+}
+interface AccountIndexRebuildResult {
+    database: string;
+    applications: number;
+    delegations: number;
+    syncedAt: string;
+}
+interface AccountDelegationListOptions {
+    direction?: "granted" | "received" | "all";
+    space?: string;
+}
+interface AccountDelegationRevokeOptions {
+    cid: string;
+    space: string;
+}
+interface AccountServiceConfig {
+    getDid: () => string;
+    getHost: () => string;
+    getPrimarySpaceId: () => string | undefined;
+    getAccountSpaceId: () => string | undefined;
+    getSpaces: () => ISpaceService;
+    getAccountDb?: () => IDatabaseHandle | undefined;
+    ensureAccountSpaceHosted?: () => Promise<void>;
+}
+declare class AccountService {
+    private readonly config;
+    constructor(config: AccountServiceConfig);
+    status(): Promise<Result$1<AccountStatus>>;
+    readonly applications: {
+        list: () => Promise<Result$1<AccountApplication[]>>;
+        get: (appId: string) => Promise<Result$1<AccountApplication>>;
+        register: (manifest: Manifest | Manifest[]) => Promise<Result$1<AccountApplication>>;
+        remove: (appId: string) => Promise<Result$1<void>>;
+    };
+    readonly delegations: {
+        list: (options?: AccountDelegationListOptions) => Promise<Result$1<AccountDelegation[]>>;
+        revoke: (options: AccountDelegationRevokeOptions) => Promise<Result$1<void>>;
+    };
+    readonly index: {
+        rebuild: () => Promise<Result$1<AccountIndexRebuildResult>>;
+        applications: {
+            list: () => Promise<Result$1<AccountApplication[]>>;
+        };
+        delegations: {
+            list: (options?: AccountDelegationListOptions) => Promise<Result$1<AccountDelegation[]>>;
+        };
+        query: <T = Record<string, unknown>>(sql: string, params?: SqlValue[]) => Promise<Result$1<QueryResponse<T>>>;
+    };
+    private accountKV;
+    private accountDb;
+    private resolveSpace;
+}
+
+/**
+ * Shared space utilities for TinyCloud.
+ *
+ * These functions are platform-agnostic and can be used by both
+ * web-sdk and node-sdk for space hosting and session activation.
+ */
+/**
+ * Result of a space hosting or session activation attempt.
+ */
+interface SpaceHostResult {
+    /** Whether the operation succeeded (2xx status) */
+    success: boolean;
+    /** HTTP status code */
+    status: number;
+    /** Error message if failed */
+    error?: string;
+    /** Space IDs that were successfully activated */
+    activated?: string[];
+    /** Space IDs that were skipped (e.g., space doesn't exist yet) */
+    skipped?: string[];
+}
+/**
+ * Fetch the peer ID from TinyCloud server for space hosting.
+ *
+ * The peer ID identifies the TinyCloud server instance that will host the space.
+ *
+ * @param host - TinyCloud server URL (e.g., "https://node.tinycloud.xyz")
+ * @param spaceId - The space ID to host
+ * @returns The peer ID string
+ * @throws Error if the request fails
+ */
+declare function fetchPeerId(host: string, spaceId: string): Promise<string>;
+/**
+ * Submit a space hosting delegation to TinyCloud server.
+ *
+ * This registers a new space with the server, allowing the user
+ * to store data in it.
+ *
+ * @param host - TinyCloud server URL
+ * @param headers - Delegation headers (from siweToDelegationHeaders)
+ * @returns Result indicating success/failure
+ */
+declare function submitHostDelegation(host: string, headers: Record<string, string>): Promise<SpaceHostResult>;
+/**
+ * Activate a session with TinyCloud server.
+ *
+ * This submits the session delegation to the server, enabling the session
+ * key to perform operations on behalf of the user.
+ *
+ * @param host - TinyCloud server URL
+ * @param delegationHeader - Session delegation header (from session.delegationHeader)
+ * @returns Result indicating success/failure (404 means space doesn't exist)
+ */
+declare function activateSessionWithHost(host: string, delegationHeader: {
+    Authorization: string;
+}): Promise<SpaceHostResult>;
+
 /**
  * Protocol version checking for SDK-to-node compatibility.
  *
@@ -4697,4 +4779,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegatedResource, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DidCacheKeyOptions, type DidEqualsOptions, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidationError, VersionCheckError, type WasmRecapEntry, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveCloudLocation, resolveManifest, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountDelegation, type AccountDelegationListOptions, type AccountDelegationRevokeOptions, type AccountIndexRebuildResult, AccountService, type AccountServiceConfig, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegatedResource, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DidCacheKeyOptions, type DidEqualsOptions, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidationError, VersionCheckError, type WasmRecapEntry, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveCloudLocation, resolveManifest, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService } from '@tinycloud/sdk-services';
+import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, hexDecode, hexEncode, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { SiweMessage } from 'siwe';
 
@@ -3505,63 +3505,6 @@ declare class TinyCloud {
     static readPublicKey<T = unknown>(host: string, address: string, chainId: number, key: string, fetchFn?: FetchFunction): Promise<Result$1<T, ServiceError>>;
 }
 
-/**
- * Shared space utilities for TinyCloud.
- *
- * These functions are platform-agnostic and can be used by both
- * web-sdk and node-sdk for space hosting and session activation.
- */
-/**
- * Result of a space hosting or session activation attempt.
- */
-interface SpaceHostResult {
-    /** Whether the operation succeeded (2xx status) */
-    success: boolean;
-    /** HTTP status code */
-    status: number;
-    /** Error message if failed */
-    error?: string;
-    /** Space IDs that were successfully activated */
-    activated?: string[];
-    /** Space IDs that were skipped (e.g., space doesn't exist yet) */
-    skipped?: string[];
-}
-/**
- * Fetch the peer ID from TinyCloud server for space hosting.
- *
- * The peer ID identifies the TinyCloud server instance that will host the space.
- *
- * @param host - TinyCloud server URL (e.g., "https://node.tinycloud.xyz")
- * @param spaceId - The space ID to host
- * @returns The peer ID string
- * @throws Error if the request fails
- */
-declare function fetchPeerId(host: string, spaceId: string): Promise<string>;
-/**
- * Submit a space hosting delegation to TinyCloud server.
- *
- * This registers a new space with the server, allowing the user
- * to store data in it.
- *
- * @param host - TinyCloud server URL
- * @param headers - Delegation headers (from siweToDelegationHeaders)
- * @returns Result indicating success/failure
- */
-declare function submitHostDelegation(host: string, headers: Record<string, string>): Promise<SpaceHostResult>;
-/**
- * Activate a session with TinyCloud server.
- *
- * This submits the session delegation to the server, enabling the session
- * key to perform operations on behalf of the user.
- *
- * @param host - TinyCloud server URL
- * @param delegationHeader - Session delegation header (from session.delegationHeader)
- * @returns Result indicating success/failure (404 means space doesn't exist)
- */
-declare function activateSessionWithHost(host: string, delegationHeader: {
-    Authorization: string;
-}): Promise<SpaceHostResult>;
-
 /**
  * DelegationManager - Handles delegation CRUD operations.
  *
@@ -4535,6 +4478,145 @@ declare class SpaceService implements ISpaceService {
  */
 declare function createSpaceService(config: SpaceServiceConfig): ISpaceService;
 
+interface AccountApplication {
+    appId: string;
+    manifests: Manifest[];
+    updatedAt?: string;
+    name?: string;
+    description?: string;
+}
+interface AccountDelegation {
+    cid: string;
+    direction: "granted" | "received";
+    spaceId: string;
+    spaceName?: string;
+    counterpartyDid: string;
+    delegateDid: string;
+    delegatorDid?: string;
+    path: string;
+    actions: string[];
+    expiry: Date;
+    status: "active" | "expired" | "revoked";
+    createdAt?: Date;
+}
+interface AccountStatus {
+    did: string;
+    host: string;
+    primarySpaceId?: string;
+    accountSpaceId?: string;
+    applications: number;
+    grantedDelegations: number;
+    receivedDelegations: number;
+}
+interface AccountIndexRebuildResult {
+    database: string;
+    applications: number;
+    delegations: number;
+    syncedAt: string;
+}
+interface AccountDelegationListOptions {
+    direction?: "granted" | "received" | "all";
+    space?: string;
+}
+interface AccountDelegationRevokeOptions {
+    cid: string;
+    space: string;
+}
+interface AccountServiceConfig {
+    getDid: () => string;
+    getHost: () => string;
+    getPrimarySpaceId: () => string | undefined;
+    getAccountSpaceId: () => string | undefined;
+    getSpaces: () => ISpaceService;
+    getAccountDb?: () => IDatabaseHandle | undefined;
+    ensureAccountSpaceHosted?: () => Promise<void>;
+}
+declare class AccountService {
+    private readonly config;
+    constructor(config: AccountServiceConfig);
+    status(): Promise<Result$1<AccountStatus>>;
+    readonly applications: {
+        list: () => Promise<Result$1<AccountApplication[]>>;
+        get: (appId: string) => Promise<Result$1<AccountApplication>>;
+        register: (manifest: Manifest | Manifest[]) => Promise<Result$1<AccountApplication>>;
+        remove: (appId: string) => Promise<Result$1<void>>;
+    };
+    readonly delegations: {
+        list: (options?: AccountDelegationListOptions) => Promise<Result$1<AccountDelegation[]>>;
+        revoke: (options: AccountDelegationRevokeOptions) => Promise<Result$1<void>>;
+    };
+    readonly index: {
+        rebuild: () => Promise<Result$1<AccountIndexRebuildResult>>;
+        applications: {
+            list: () => Promise<Result$1<AccountApplication[]>>;
+        };
+        delegations: {
+            list: (options?: AccountDelegationListOptions) => Promise<Result$1<AccountDelegation[]>>;
+        };
+        query: <T = Record<string, unknown>>(sql: string, params?: SqlValue[]) => Promise<Result$1<QueryResponse<T>>>;
+    };
+    private accountKV;
+    private accountDb;
+    private resolveSpace;
+}
+
+/**
+ * Shared space utilities for TinyCloud.
+ *
+ * These functions are platform-agnostic and can be used by both
+ * web-sdk and node-sdk for space hosting and session activation.
+ */
+/**
+ * Result of a space hosting or session activation attempt.
+ */
+interface SpaceHostResult {
+    /** Whether the operation succeeded (2xx status) */
+    success: boolean;
+    /** HTTP status code */
+    status: number;
+    /** Error message if failed */
+    error?: string;
+    /** Space IDs that were successfully activated */
+    activated?: string[];
+    /** Space IDs that were skipped (e.g., space doesn't exist yet) */
+    skipped?: string[];
+}
+/**
+ * Fetch the peer ID from TinyCloud server for space hosting.
+ *
+ * The peer ID identifies the TinyCloud server instance that will host the space.
+ *
+ * @param host - TinyCloud server URL (e.g., "https://node.tinycloud.xyz")
+ * @param spaceId - The space ID to host
+ * @returns The peer ID string
+ * @throws Error if the request fails
+ */
+declare function fetchPeerId(host: string, spaceId: string): Promise<string>;
+/**
+ * Submit a space hosting delegation to TinyCloud server.
+ *
+ * This registers a new space with the server, allowing the user
+ * to store data in it.
+ *
+ * @param host - TinyCloud server URL
+ * @param headers - Delegation headers (from siweToDelegationHeaders)
+ * @returns Result indicating success/failure
+ */
+declare function submitHostDelegation(host: string, headers: Record<string, string>): Promise<SpaceHostResult>;
+/**
+ * Activate a session with TinyCloud server.
+ *
+ * This submits the session delegation to the server, enabling the session
+ * key to perform operations on behalf of the user.
+ *
+ * @param host - TinyCloud server URL
+ * @param delegationHeader - Session delegation header (from session.delegationHeader)
+ * @returns Result indicating success/failure (404 means space doesn't exist)
+ */
+declare function activateSessionWithHost(host: string, delegationHeader: {
+    Authorization: string;
+}): Promise<SpaceHostResult>;
+
 /**
  * Protocol version checking for SDK-to-node compatibility.
  *
@@ -4697,4 +4779,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegatedResource, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DidCacheKeyOptions, type DidEqualsOptions, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidationError, VersionCheckError, type WasmRecapEntry, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveCloudLocation, resolveManifest, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountDelegation, type AccountDelegationListOptions, type AccountDelegationRevokeOptions, type AccountIndexRebuildResult, AccountService, type AccountServiceConfig, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegatedResource, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DidCacheKeyOptions, type DidEqualsOptions, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidationError, VersionCheckError, type WasmRecapEntry, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveCloudLocation, resolveManifest, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };