@tinycloud/sdk-core 2.6.3 → 2.7.0-beta.3

package/dist/index.d.ts

@@ -1,7 +1,10 @@
 import { z } from 'zod';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
+export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
 export { ACCOUNT_INDEX_SCHEMA, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
+export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, a as Policy, P as PolicyEngineRecord, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, S as SignedObjectSigner, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, U as UnsignedPolicyEngineRecord, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from './signed-object-BHkLbCXI.js';
+export { b as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-DpdAwc1W.js';
 export { SiweMessage } from 'siwe';
 
 /**
@@ -659,8 +662,8 @@ interface SubsetCheckResult {
  *     - If `granted.path` ends with `/`, it covers any `requested.path` that
  *       starts with `granted.path`.
  *     - Otherwise, the paths must match exactly.
- * - Action containment: every URN in `requested.actions` must appear in
- *   `granted.actions` (set subset).
+ * - Action containment: every requested URN must be matched exactly or by a
+ *   service-scoped wildcard such as `tinycloud.kv/*`.
  *
  * Any `requested` entry that does not find a matching `granted` entry is
  * added to `missing` and the overall result is non-subset.
@@ -670,6 +673,8 @@ interface SubsetCheckResult {
  * or `expandActionShortNames` to normalize inputs first.
  */
 declare function isCapabilitySubset(requested: readonly PermissionEntry[], granted: readonly PermissionEntry[]): SubsetCheckResult;
+/** Return whether a granted action pattern covers one requested action. */
+declare function actionContains(grantedAction: string, requestedAction: string): boolean;
 /**
  * The raw shape returned from the WASM `parseRecapFromSiwe` export. The
  * Rust layer encodes the service in the short form (e.g. `"kv"`) because
@@ -891,19 +896,19 @@ declare const PersistedTinyCloudSessionSchema: z.ZodObject<{
     /** The verification method DID */
     verificationMethod: z.ZodString;
 }, "strip", z.ZodTypeAny, {
+    spaceId: string;
     delegationHeader: {
         Authorization: string;
     };
     delegationCid: string;
-    spaceId: string;
     verificationMethod: string;
     spaces?: Record<string, string> | undefined;
 }, {
+    spaceId: string;
     delegationHeader: {
         Authorization: string;
     };
     delegationCid: string;
-    spaceId: string;
     verificationMethod: string;
     spaces?: Record<string, string> | undefined;
 }>;
@@ -943,19 +948,19 @@ declare const PersistedSessionDataSchema: z.ZodObject<{
         /** The verification method DID */
         verificationMethod: z.ZodString;
     }, "strip", z.ZodTypeAny, {
+        spaceId: string;
         delegationHeader: {
             Authorization: string;
         };
         delegationCid: string;
-        spaceId: string;
         verificationMethod: string;
         spaces?: Record<string, string> | undefined;
     }, {
+        spaceId: string;
         delegationHeader: {
             Authorization: string;
         };
         delegationCid: string;
-        spaceId: string;
         verificationMethod: string;
         spaces?: Record<string, string> | undefined;
     }>>;
@@ -992,19 +997,19 @@ declare const PersistedSessionDataSchema: z.ZodObject<{
     sessionKey: string;
     siwe: string;
     signature: string;
-    expiresAt: string;
     createdAt: string;
+    expiresAt: string;
     version: string;
     ens?: {
         domain?: string | null | undefined;
         avatarUrl?: string | null | undefined;
     } | undefined;
     tinycloudSession?: {
+        spaceId: string;
         delegationHeader: {
             Authorization: string;
         };
         delegationCid: string;
-        spaceId: string;
         verificationMethod: string;
         spaces?: Record<string, string> | undefined;
     } | undefined;
@@ -1015,19 +1020,19 @@ declare const PersistedSessionDataSchema: z.ZodObject<{
     sessionKey: string;
     siwe: string;
     signature: string;
-    expiresAt: string;
     createdAt: string;
+    expiresAt: string;
     version: string;
     ens?: {
         domain?: string | null | undefined;
         avatarUrl?: string | null | undefined;
     } | undefined;
     tinycloudSession?: {
+        spaceId: string;
         delegationHeader: {
             Authorization: string;
         };
         delegationCid: string;
-        spaceId: string;
         verificationMethod: string;
         spaces?: Record<string, string> | undefined;
     } | undefined;
@@ -1074,11 +1079,11 @@ declare const TinyCloudSessionSchema: z.ZodObject<{
     sessionKey: string;
     siwe: string;
     signature: string;
+    spaceId: string;
     delegationHeader: {
         Authorization: string;
     };
     delegationCid: string;
-    spaceId: string;
     verificationMethod: string;
     jwk: {} & {
         [k: string]: unknown;
@@ -1090,11 +1095,11 @@ declare const TinyCloudSessionSchema: z.ZodObject<{
     sessionKey: string;
     siwe: string;
     signature: string;
+    spaceId: string;
     delegationHeader: {
         Authorization: string;
     };
     delegationCid: string;
-    spaceId: string;
     verificationMethod: string;
     jwk: {} & {
         [k: string]: unknown;
@@ -1459,6 +1464,265 @@ declare const DelegationSchema: z.ZodObject<{
     authHeader?: string | undefined;
 }>;
 type Delegation = z.infer<typeof DelegationSchema>;
+/** Node-confirmed lifecycle state for one delegation. */
+declare const DelegationStatusSchema: z.ZodEffects<z.ZodObject<{
+    cid: z.ZodString;
+    status: z.ZodEnum<["active", "revoked", "expired", "unavailable", "not_found"]>;
+    exists: z.ZodBoolean;
+    active: z.ZodBoolean;
+    revoked: z.ZodBoolean;
+    expired: z.ZodBoolean;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}>, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}>;
+type DelegationStatus = z.infer<typeof DelegationStatusSchema>;
+declare const DelegationRevocationReceiptSchema: z.ZodObject<{
+    revoked: z.ZodLiteral<true>;
+    cid: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    revoked: true;
+    cid: string;
+}, {
+    revoked: true;
+    cid: string;
+}>;
+type DelegationRevocationReceipt = z.infer<typeof DelegationRevocationReceiptSchema>;
+declare const AccountDelegationResourceSchema: z.ZodObject<{
+    resource: z.ZodString;
+    actions: z.ZodArray<z.ZodString, "many">;
+    caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+}, "strict", z.ZodTypeAny, {
+    actions: string[];
+    caveats: Record<string, unknown>[];
+    resource: string;
+}, {
+    actions: string[];
+    caveats: Record<string, unknown>[];
+    resource: string;
+}>;
+declare const AccountDelegationRecordSchema: z.ZodObject<{
+    cid: z.ZodString;
+    direction: z.ZodEnum<["granted", "received"]>;
+    delegatorDid: z.ZodString;
+    delegateDid: z.ZodString;
+    resources: z.ZodArray<z.ZodObject<{
+        resource: z.ZodString;
+        actions: z.ZodArray<z.ZodString, "many">;
+        caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }, {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }>, "many">;
+    parents: z.ZodArray<z.ZodString, "many">;
+    issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
+    revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
+    revokedBy: z.ZodOptional<z.ZodString>;
+    revokedAncestorCid: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+    notBefore: Date | null;
+    resources: {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }[];
+    expiresAt: Date | null;
+    issuedAt: Date | null;
+    cid: string;
+    direction: "received" | "granted";
+    delegatorDid: string;
+    delegateDid: string;
+    parents: string[];
+    revokedAt?: Date | null | undefined;
+    revokedBy?: string | undefined;
+    revokedAncestorCid?: string | undefined;
+}, {
+    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+    notBefore: string | null;
+    resources: {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }[];
+    expiresAt: string | null;
+    issuedAt: string | null;
+    cid: string;
+    direction: "received" | "granted";
+    delegatorDid: string;
+    delegateDid: string;
+    parents: string[];
+    revokedAt?: string | null | undefined;
+    revokedBy?: string | undefined;
+    revokedAncestorCid?: string | undefined;
+}>;
+declare const AccountDelegationPageSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    items: z.ZodArray<z.ZodObject<{
+        cid: z.ZodString;
+        direction: z.ZodEnum<["granted", "received"]>;
+        delegatorDid: z.ZodString;
+        delegateDid: z.ZodString;
+        resources: z.ZodArray<z.ZodObject<{
+            resource: z.ZodString;
+            actions: z.ZodArray<z.ZodString, "many">;
+            caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }, {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }>, "many">;
+        parents: z.ZodArray<z.ZodString, "many">;
+        issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
+        revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
+        revokedBy: z.ZodOptional<z.ZodString>;
+        revokedAncestorCid: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: Date | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: Date | null;
+        issuedAt: Date | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: Date | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }, {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: string | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: string | null;
+        issuedAt: string | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: string | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }>, "many">;
+    nextCursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: 2;
+    items: {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: Date | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: Date | null;
+        issuedAt: Date | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: Date | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }[];
+    nextCursor?: string | undefined;
+}, {
+    schemaVersion: 2;
+    items: {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: string | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: string | null;
+        issuedAt: string | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: string | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }[];
+    nextCursor?: string | undefined;
+}>;
+type AccountDelegationResource = z.infer<typeof AccountDelegationResourceSchema>;
+type AccountDelegationRecord = z.infer<typeof AccountDelegationRecordSchema>;
+type AccountDelegationPage = z.infer<typeof AccountDelegationPageSchema>;
+declare const AccountDelegationQueryOptionsSchema: z.ZodObject<{
+    direction: z.ZodOptional<z.ZodEnum<["granted", "received", "all"]>>;
+    status: z.ZodOptional<z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>>;
+    space: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
+    space?: string | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}, {
+    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
+    space?: string | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}>;
+type AccountDelegationQueryOptions = z.infer<typeof AccountDelegationQueryOptionsSchema>;
 /**
  * Entry in the capability registry mapping a capability to available keys.
  */
@@ -1725,8 +1989,8 @@ declare const DelegationRecordSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     path: string;
     actions: string[];
-    spaceId: string;
     createdAt: Date;
+    spaceId: string;
     cid: string;
     isRevoked: boolean;
     delegator: string;
@@ -1738,8 +2002,8 @@ declare const DelegationRecordSchema: z.ZodObject<{
 }, {
     path: string;
     actions: string[];
-    spaceId: string;
     createdAt: Date;
+    spaceId: string;
     cid: string;
     isRevoked: boolean;
     delegator: string;
@@ -2119,23 +2383,23 @@ declare const DelegationFiltersSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     path?: string | undefined;
     actions?: string[] | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
     delegator?: string | undefined;
     delegatee?: string | undefined;
-    direction?: "received" | "all" | "granted" | undefined;
     includeRevoked?: boolean | undefined;
     validAt?: Date | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
 }, {
     path?: string | undefined;
     actions?: string[] | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
     delegator?: string | undefined;
     delegatee?: string | undefined;
-    direction?: "received" | "all" | "granted" | undefined;
     includeRevoked?: boolean | undefined;
     validAt?: Date | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
 }>;
 type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;
 /**
@@ -2248,8 +2512,6 @@ declare const ShareLinkSchema: z.ZodObject<{
     /** Human-readable description of what is being shared */
     description: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    schema: "base64" | "compact" | "ipfs";
-    url: string;
     delegation: {
         path: string;
         expiry: Date;
@@ -2264,12 +2526,12 @@ declare const ShareLinkSchema: z.ZodObject<{
         allowSubDelegation?: boolean | undefined;
         authHeader?: string | undefined;
     };
+    schema: "base64" | "compact" | "ipfs";
+    url: string;
     token: string;
     description?: string | undefined;
     expiresAt?: Date | undefined;
 }, {
-    schema: "base64" | "compact" | "ipfs";
-    url: string;
     delegation: {
         path: string;
         expiry: Date;
@@ -2284,6 +2546,8 @@ declare const ShareLinkSchema: z.ZodObject<{
         allowSubDelegation?: boolean | undefined;
         authHeader?: string | undefined;
     };
+    schema: "base64" | "compact" | "ipfs";
+    url: string;
     token: string;
     description?: string | undefined;
     expiresAt?: Date | undefined;
@@ -2362,20 +2626,28 @@ type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;
 declare const DelegationManagerConfigSchema: z.ZodObject<{
     /** TinyCloud host URLs */
     hosts: z.ZodArray<z.ZodString, "many">;
+    /** Account space used by account-wide delegation history queries */
+    accountSpaceId: z.ZodOptional<z.ZodString>;
     /** Active session for authentication */
     session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
     /** Platform-specific invoke function */
     invoke: z.ZodEffects<z.ZodUnknown, InvokeFunction, unknown>;
+    /** Platform-specific invoke function for raw resource URIs */
+    invokeAny: z.ZodOptional<z.ZodEffects<z.ZodUnknown, InvokeAnyFunction, unknown>>;
     /** Optional custom fetch implementation */
     fetch: z.ZodOptional<z.ZodEffects<z.ZodUnknown, FetchFunction, unknown>>;
 }, "strip", z.ZodTypeAny, {
     session: ServiceSession;
     hosts: string[];
     invoke: InvokeFunction;
+    invokeAny?: InvokeAnyFunction | undefined;
+    accountSpaceId?: string | undefined;
     fetch?: FetchFunction | undefined;
 }, {
     hosts: string[];
+    invokeAny?: unknown;
     session?: unknown;
+    accountSpaceId?: string | undefined;
     invoke?: unknown;
     fetch?: unknown;
 }>;
@@ -2562,8 +2834,8 @@ declare const CreateDelegationWasmResultSchema: z.ZodObject<{
         space: string;
         service: string;
     }[];
-    expiry: Date;
     delegation: string;
+    expiry: Date;
     cid: string;
     delegateDID: string;
 }, {
@@ -2573,8 +2845,8 @@ declare const CreateDelegationWasmResultSchema: z.ZodObject<{
         space: string;
         service: string;
     }[];
-    expiry: Date;
     delegation: string;
+    expiry: Date;
     cid: string;
     delegateDID: string;
 }>;
@@ -3630,7 +3902,9 @@ declare class DelegationManager {
     private hosts;
     private session;
     private invoke;
+    private invokeAny?;
     private fetchFn;
+    private accountSpaceId?;
     /**
      * Creates a new DelegationManager instance.
      *
@@ -3689,7 +3963,14 @@ declare class DelegationManager {
      * }
      * ```
      */
-    revoke(cid: string): Promise<Result<void>>;
+    revoke(cid: string): Promise<Result<DelegationRevocationReceipt>>;
+    /**
+     * Reads the node-confirmed lifecycle state of one delegation without
+     * exposing delegation metadata.
+     */
+    status(cid: string): Promise<Result<DelegationStatus>>;
+    /** Query lifecycle-complete delegation history for the authenticated account. */
+    query(options?: AccountDelegationQueryOptions): Promise<Result<AccountDelegationPage>>;
     /**
      * Lists all delegations for the current session's space.
      *
@@ -3821,6 +4102,55 @@ interface ShareAccess {
     /** The path prefix for this share */
     path: string;
 }
+/**
+ * Parameters for attenuating a received share to another principal.
+ *
+ * Omitted path/actions/expiry inherit the received share's exact values. Any
+ * supplied value must be equal to or an attenuated subset of the parent.
+ */
+interface DelegateReceivedShareParams {
+    /** DID that may exercise the child delegation. */
+    delegateDID: string;
+    /** Equal to or below the shared path. Defaults to the shared path. */
+    path?: string;
+    /** Subset of the shared actions. Defaults to all shared actions. */
+    actions?: string[];
+    /** No later than the sharing-link expiry. Defaults to the parent expiry. */
+    expiry?: Date;
+    /** Optional node origin that further narrows the configured-host allowlist. */
+    expectedHost?: string;
+}
+/**
+ * A transport-ready child delegation with non-secret source lineage.
+ *
+ * `delegation.delegationHeader` is a live bearer credential. Treat it like a
+ * secret: do not log it or persist it outside secure credential storage.
+ * Only `source` is safe to retain as non-secret lineage metadata.
+ */
+interface DelegatedShareAccess {
+    delegation: Delegation & {
+        delegationHeader: {
+            Authorization: string;
+        };
+        ownerAddress: string;
+        chainId: number;
+        host: string;
+        resources: Array<{
+            service: string;
+            space: string;
+            path: string;
+            actions: string[];
+        }>;
+        disableSubDelegation: boolean;
+    };
+    source: {
+        parentCid: string;
+        spaceId: string;
+        path: string;
+        host: string;
+        expiresAt: Date;
+    };
+}
 /**
  * Configuration for SharingService.
  */
@@ -3867,6 +4197,8 @@ interface SharingServiceConfig {
      * Creates UCAN delegations directly without requiring server roundtrip.
      */
     createDelegationWasm?: (params: CreateDelegationWasmParams) => CreateDelegationWasmResult;
+    /** Compute a CID for serialized delegation bytes. Required for share attenuation. */
+    computeCid?: (data: Uint8Array, codec: bigint) => string;
     /**
      * Path prefix for KV operations.
      * When set, paths passed to generate() are prefixed with this value.
@@ -3928,6 +4260,12 @@ interface ISharingService {
      * creates a sub-delegation to the current session key.
      */
     receive(link: string, options?: ReceiveOptions): Promise<Result<ShareAccess, DelegationError>>;
+    /**
+     * Consume a sharing link locally and create an attenuated child delegation.
+     * The raw link and embedded private JWK are never returned. The returned
+     * child delegation is itself a sensitive bearer credential.
+     */
+    delegateReceivedShare(link: string, params: DelegateReceivedShareParams): Promise<Result<DelegatedShareAccess, DelegationError>>;
     /**
      * Encode sharing data into a link string.
      */
@@ -3986,6 +4324,7 @@ declare class SharingService implements ISharingService {
     private baseUrl;
     private createDelegationFn?;
     private createDelegationWasmFn?;
+    private computeCidFn?;
     private pathPrefix;
     private sessionExpiry?;
     private onRootDelegationNeeded?;
@@ -4059,6 +4398,16 @@ declare class SharingService implements ISharingService {
      * 4. Return ShareAccess with pre-configured KV service
      */
     receive(link: string, options?: ReceiveOptions): Promise<Result<ShareAccess, DelegationError>>;
+    /**
+     * Create a constrained child delegation from a received sharing link.
+     *
+     * This is the safe handoff for a browser delegating shared input to an
+     * agent or service: the bearer link is decoded and used only in this SDK
+     * instance, while the recipient receives a child UCAN without the embedded
+     * private key. The child UCAN is a sensitive bearer credential and must not
+     * be logged or stored insecurely.
+     */
+    delegateReceivedShare(link: string, params: DelegateReceivedShareParams): Promise<Result<DelegatedShareAccess, DelegationError>>;
     /**
      * Encode sharing data into a link string.
      *
@@ -4662,6 +5011,7 @@ interface AccountServiceConfig {
     getPrimarySpaceId: () => string | undefined;
     getAccountSpaceId: () => string | undefined;
     getSpaces: () => ISpaceService;
+    getDelegationManager?: () => Pick<DelegationManager, "query" | "revoke">;
     getAccountDb?: () => IDatabaseHandle | undefined;
     ensureAccountSpaceHosted?: () => Promise<void>;
 }
@@ -4683,8 +5033,9 @@ declare class AccountService {
         remove: (spaceId: string) => Promise<Result$1<void>>;
     };
     readonly delegations: {
+        query: (options?: AccountDelegationQueryOptions) => Promise<Result$1<AccountDelegationPage>>;
         list: (options?: AccountDelegationListOptions) => Promise<Result$1<AccountDelegation[]>>;
-        revoke: (options: AccountDelegationRevokeOptions) => Promise<Result$1<void>>;
+        revoke: (input: string | AccountDelegationRevokeOptions) => Promise<Result$1<DelegationRevocationReceipt | void>>;
     };
     readonly index: {
         ensure: () => Promise<Result$1<AccountIndexEnsureResult>>;
@@ -4748,6 +5099,8 @@ interface SpaceHostResult {
     activated?: string[];
     /** Space IDs that were skipped (e.g., space doesn't exist yet) */
     skipped?: string[];
+    /** Raw node receipt CID. This identifies the commit event, not the delegation. */
+    commitEventCid?: string;
 }
 /**
  * Fetch the peer ID from TinyCloud server for space hosting.
@@ -4947,4 +5300,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegatedResource, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DidCacheKeyOptions, type DidEqualsOptions, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidationError, VersionCheckError, type WasmRecapEntry, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, type AccountDelegationPage, type AccountDelegationQueryOptions, type AccountDelegationRecord, type AccountDelegationResource, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegateReceivedShareParams, type DelegatedResource, type DelegatedShareAccess, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DelegationRevocationReceipt, type DelegationStatus, type DidCacheKeyOptions, type DidEqualsOptions, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidationError, VersionCheckError, type WasmRecapEntry, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };