@tinycloud/sdk-core 2.7.0-beta.2 → 2.7.0-beta.3

package/dist/index.d.ts

@@ -3,8 +3,8 @@ import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Resul
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
 export { ACCOUNT_INDEX_SCHEMA, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
-export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, a as Policy, P as PolicyEngineRecord, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, S as SignedObjectSigner, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, U as UnsignedPolicyEngineRecord, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from './signed-object-C9Gur3ZY.js';
-export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-Dbx-xqUh.js';
+export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, a as Policy, P as PolicyEngineRecord, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, S as SignedObjectSigner, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, U as UnsignedPolicyEngineRecord, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from './signed-object-BHkLbCXI.js';
+export { b as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-DpdAwc1W.js';
 export { SiweMessage } from 'siwe';
 
 /**
@@ -1502,6 +1502,227 @@ declare const DelegationStatusSchema: z.ZodEffects<z.ZodObject<{
     exists: boolean;
 }>;
 type DelegationStatus = z.infer<typeof DelegationStatusSchema>;
+declare const DelegationRevocationReceiptSchema: z.ZodObject<{
+    revoked: z.ZodLiteral<true>;
+    cid: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    revoked: true;
+    cid: string;
+}, {
+    revoked: true;
+    cid: string;
+}>;
+type DelegationRevocationReceipt = z.infer<typeof DelegationRevocationReceiptSchema>;
+declare const AccountDelegationResourceSchema: z.ZodObject<{
+    resource: z.ZodString;
+    actions: z.ZodArray<z.ZodString, "many">;
+    caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+}, "strict", z.ZodTypeAny, {
+    actions: string[];
+    caveats: Record<string, unknown>[];
+    resource: string;
+}, {
+    actions: string[];
+    caveats: Record<string, unknown>[];
+    resource: string;
+}>;
+declare const AccountDelegationRecordSchema: z.ZodObject<{
+    cid: z.ZodString;
+    direction: z.ZodEnum<["granted", "received"]>;
+    delegatorDid: z.ZodString;
+    delegateDid: z.ZodString;
+    resources: z.ZodArray<z.ZodObject<{
+        resource: z.ZodString;
+        actions: z.ZodArray<z.ZodString, "many">;
+        caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }, {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }>, "many">;
+    parents: z.ZodArray<z.ZodString, "many">;
+    issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
+    revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
+    revokedBy: z.ZodOptional<z.ZodString>;
+    revokedAncestorCid: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+    notBefore: Date | null;
+    resources: {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }[];
+    expiresAt: Date | null;
+    issuedAt: Date | null;
+    cid: string;
+    direction: "received" | "granted";
+    delegatorDid: string;
+    delegateDid: string;
+    parents: string[];
+    revokedAt?: Date | null | undefined;
+    revokedBy?: string | undefined;
+    revokedAncestorCid?: string | undefined;
+}, {
+    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+    notBefore: string | null;
+    resources: {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }[];
+    expiresAt: string | null;
+    issuedAt: string | null;
+    cid: string;
+    direction: "received" | "granted";
+    delegatorDid: string;
+    delegateDid: string;
+    parents: string[];
+    revokedAt?: string | null | undefined;
+    revokedBy?: string | undefined;
+    revokedAncestorCid?: string | undefined;
+}>;
+declare const AccountDelegationPageSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    items: z.ZodArray<z.ZodObject<{
+        cid: z.ZodString;
+        direction: z.ZodEnum<["granted", "received"]>;
+        delegatorDid: z.ZodString;
+        delegateDid: z.ZodString;
+        resources: z.ZodArray<z.ZodObject<{
+            resource: z.ZodString;
+            actions: z.ZodArray<z.ZodString, "many">;
+            caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }, {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }>, "many">;
+        parents: z.ZodArray<z.ZodString, "many">;
+        issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
+        revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
+        revokedBy: z.ZodOptional<z.ZodString>;
+        revokedAncestorCid: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: Date | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: Date | null;
+        issuedAt: Date | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: Date | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }, {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: string | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: string | null;
+        issuedAt: string | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: string | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }>, "many">;
+    nextCursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: 2;
+    items: {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: Date | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: Date | null;
+        issuedAt: Date | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: Date | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }[];
+    nextCursor?: string | undefined;
+}, {
+    schemaVersion: 2;
+    items: {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: string | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: string | null;
+        issuedAt: string | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: string | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }[];
+    nextCursor?: string | undefined;
+}>;
+type AccountDelegationResource = z.infer<typeof AccountDelegationResourceSchema>;
+type AccountDelegationRecord = z.infer<typeof AccountDelegationRecordSchema>;
+type AccountDelegationPage = z.infer<typeof AccountDelegationPageSchema>;
+declare const AccountDelegationQueryOptionsSchema: z.ZodObject<{
+    direction: z.ZodOptional<z.ZodEnum<["granted", "received", "all"]>>;
+    status: z.ZodOptional<z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>>;
+    space: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
+    space?: string | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}, {
+    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
+    space?: string | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}>;
+type AccountDelegationQueryOptions = z.infer<typeof AccountDelegationQueryOptionsSchema>;
 /**
  * Entry in the capability registry mapping a capability to available keys.
  */
@@ -2162,23 +2383,23 @@ declare const DelegationFiltersSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     path?: string | undefined;
     actions?: string[] | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
     delegator?: string | undefined;
     delegatee?: string | undefined;
-    direction?: "received" | "all" | "granted" | undefined;
     includeRevoked?: boolean | undefined;
     validAt?: Date | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
 }, {
     path?: string | undefined;
     actions?: string[] | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
     delegator?: string | undefined;
     delegatee?: string | undefined;
-    direction?: "received" | "all" | "granted" | undefined;
     includeRevoked?: boolean | undefined;
     validAt?: Date | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
 }>;
 type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;
 /**
@@ -2405,6 +2626,8 @@ type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;
 declare const DelegationManagerConfigSchema: z.ZodObject<{
     /** TinyCloud host URLs */
     hosts: z.ZodArray<z.ZodString, "many">;
+    /** Account space used by account-wide delegation history queries */
+    accountSpaceId: z.ZodOptional<z.ZodString>;
     /** Active session for authentication */
     session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
     /** Platform-specific invoke function */
@@ -2418,11 +2641,13 @@ declare const DelegationManagerConfigSchema: z.ZodObject<{
     hosts: string[];
     invoke: InvokeFunction;
     invokeAny?: InvokeAnyFunction | undefined;
+    accountSpaceId?: string | undefined;
     fetch?: FetchFunction | undefined;
 }, {
     hosts: string[];
     invokeAny?: unknown;
     session?: unknown;
+    accountSpaceId?: string | undefined;
     invoke?: unknown;
     fetch?: unknown;
 }>;
@@ -3679,6 +3904,7 @@ declare class DelegationManager {
     private invoke;
     private invokeAny?;
     private fetchFn;
+    private accountSpaceId?;
     /**
      * Creates a new DelegationManager instance.
      *
@@ -3737,12 +3963,14 @@ declare class DelegationManager {
      * }
      * ```
      */
-    revoke(cid: string): Promise<Result<void>>;
+    revoke(cid: string): Promise<Result<DelegationRevocationReceipt>>;
     /**
      * Reads the node-confirmed lifecycle state of one delegation without
      * exposing delegation metadata.
      */
     status(cid: string): Promise<Result<DelegationStatus>>;
+    /** Query lifecycle-complete delegation history for the authenticated account. */
+    query(options?: AccountDelegationQueryOptions): Promise<Result<AccountDelegationPage>>;
     /**
      * Lists all delegations for the current session's space.
      *
@@ -4783,6 +5011,7 @@ interface AccountServiceConfig {
     getPrimarySpaceId: () => string | undefined;
     getAccountSpaceId: () => string | undefined;
     getSpaces: () => ISpaceService;
+    getDelegationManager?: () => Pick<DelegationManager, "query" | "revoke">;
     getAccountDb?: () => IDatabaseHandle | undefined;
     ensureAccountSpaceHosted?: () => Promise<void>;
 }
@@ -4804,8 +5033,9 @@ declare class AccountService {
         remove: (spaceId: string) => Promise<Result$1<void>>;
     };
     readonly delegations: {
+        query: (options?: AccountDelegationQueryOptions) => Promise<Result$1<AccountDelegationPage>>;
         list: (options?: AccountDelegationListOptions) => Promise<Result$1<AccountDelegation[]>>;
-        revoke: (options: AccountDelegationRevokeOptions) => Promise<Result$1<void>>;
+        revoke: (input: string | AccountDelegationRevokeOptions) => Promise<Result$1<DelegationRevocationReceipt | void>>;
     };
     readonly index: {
         ensure: () => Promise<Result$1<AccountIndexEnsureResult>>;
@@ -5070,4 +5300,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegateReceivedShareParams, type DelegatedResource, type DelegatedShareAccess, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DelegationStatus, type DidCacheKeyOptions, type DidEqualsOptions, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidationError, VersionCheckError, type WasmRecapEntry, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, type AccountDelegationPage, type AccountDelegationQueryOptions, type AccountDelegationRecord, type AccountDelegationResource, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegateReceivedShareParams, type DelegatedResource, type DelegatedShareAccess, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DelegationRevocationReceipt, type DelegationStatus, type DidCacheKeyOptions, type DidEqualsOptions, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidationError, VersionCheckError, type WasmRecapEntry, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };

package/dist/index.js

@@ -3455,6 +3455,43 @@ var DelegationStatusSchema = z4.object({
     });
   }
 });
+var DelegationRevocationReceiptSchema = z4.object({
+  revoked: z4.literal(true),
+  cid: z4.string().min(1)
+}).strict();
+var AccountDelegationResourceSchema = z4.object({
+  resource: z4.string().min(1),
+  actions: z4.array(z4.string()),
+  caveats: z4.array(z4.record(z4.string(), z4.unknown()))
+}).strict();
+var AccountDelegationDateSchema = z4.string().datetime({ offset: true }).transform((value) => new Date(value));
+var AccountDelegationRecordSchema = z4.object({
+  cid: z4.string().min(1),
+  direction: z4.enum(["granted", "received"]),
+  delegatorDid: z4.string().min(1),
+  delegateDid: z4.string().min(1),
+  resources: z4.array(AccountDelegationResourceSchema),
+  parents: z4.array(z4.string()),
+  issuedAt: AccountDelegationDateSchema.nullable(),
+  notBefore: AccountDelegationDateSchema.nullable(),
+  expiresAt: AccountDelegationDateSchema.nullable(),
+  status: z4.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]),
+  revokedAt: AccountDelegationDateSchema.nullable().optional(),
+  revokedBy: z4.string().optional(),
+  revokedAncestorCid: z4.string().optional()
+}).strict();
+var AccountDelegationPageSchema = z4.object({
+  schemaVersion: z4.literal(2),
+  items: z4.array(AccountDelegationRecordSchema),
+  nextCursor: z4.string().optional()
+}).strict();
+var AccountDelegationQueryOptionsSchema = z4.object({
+  direction: z4.enum(["granted", "received", "all"]).optional(),
+  status: z4.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]).optional(),
+  space: z4.string().trim().min(1).optional(),
+  limit: z4.number().int().min(1).max(100).optional(),
+  cursor: z4.string().min(1).optional()
+}).strict();
 var CapabilityEntrySchema = z4.object({
   /** Resource URI this capability applies to */
   resource: z4.string(),
@@ -3609,6 +3646,8 @@ var GenerateShareParamsSchema = z4.object({
 var DelegationManagerConfigSchema = z4.object({
   /** TinyCloud host URLs */
   hosts: z4.array(z4.string()),
+  /** Account space used by account-wide delegation history queries */
+  accountSpaceId: z4.string().min(1).optional(),
   /** Active session for authentication */
   session: z4.unknown().refine(
     (val) => val !== null && typeof val === "object",
@@ -5898,12 +5937,20 @@ function withCapabilitiesReadForSpaces(resources) {
   ]);
 }
 function accountRegistryPermissions() {
-  return [ACCOUNT_REGISTRY_PATH, "spaces/"].map((path) => ({
-    service: "tinycloud.kv",
-    space: ACCOUNT_REGISTRY_SPACE,
-    path,
-    actions: ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/list"]
-  }));
+  return [
+    ...[ACCOUNT_REGISTRY_PATH, "spaces/"].map((path) => ({
+      service: "tinycloud.kv",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path,
+      actions: ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/list"]
+    })),
+    {
+      service: "tinycloud.delegation",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: "",
+      actions: ["tinycloud.delegation/list"]
+    }
+  ];
 }
 function accountRegistryIndexPermission() {
   return {
@@ -6170,6 +6217,18 @@ var AccountService = class {
       }
     };
     this.delegations = {
+      query: async (options = {}) => {
+        const manager = this.config.getDelegationManager?.();
+        if (!manager) {
+          return err3(serviceError3(
+            "NOT_INITIALIZED",
+            "Delegation history requires an authenticated delegation manager",
+            SERVICE_NAME2
+          ));
+        }
+        const queried = await manager.query(options);
+        return queried.ok ? ok3(queried.data) : accountErr(queried.error);
+      },
       list: async (options = {}) => {
         if (options.preferIndex) {
           const indexed = await this.index.delegations.list(options);
@@ -6204,10 +6263,23 @@ var AccountService = class {
         delegations.sort((a, b) => a.spaceId.localeCompare(b.spaceId) || a.cid.localeCompare(b.cid));
         return ok3(delegations);
       },
-      revoke: async (options) => {
-        const space = await this.resolveSpace(options.space);
+      revoke: async (input) => {
+        const cid = typeof input === "string" ? input : input.cid;
+        const manager = this.config.getDelegationManager?.();
+        if (manager) {
+          const revoked2 = await manager.revoke(cid);
+          return revoked2.ok ? ok3(revoked2.data) : accountErr(revoked2.error);
+        }
+        if (typeof input === "string") {
+          return err3(serviceError3(
+            "NOT_INITIALIZED",
+            "CID-only revocation requires an authenticated delegation manager",
+            SERVICE_NAME2
+          ));
+        }
+        const space = await this.resolveSpace(input.space);
         if (!space.ok) return space;
-        const revoked = await this.config.getSpaces().get(space.data.id).delegations.revoke(options.cid);
+        const revoked = await this.config.getSpaces().get(space.data.id).delegations.revoke(cid);
         if (!revoked.ok) return accountErr(revoked.error);
         return ok3(void 0);
       }
@@ -6980,6 +7052,7 @@ var DelegationManager = class {
     this.invoke = config.invoke;
     this.invokeAny = config.invokeAny;
     this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
+    this.accountSpaceId = config.accountSpaceId;
   }
   /**
    * Updates the session (e.g., after re-authentication).
@@ -7185,7 +7258,19 @@ var DelegationManager = class {
           )
         };
       }
-      return { ok: true, data: void 0 };
+      const parsed = DelegationRevocationReceiptSchema.safeParse(await response.json());
+      if (!parsed.success || parsed.data.cid !== cid) {
+        return {
+          ok: false,
+          error: createError(
+            DelegationErrorCodes.REVOCATION_FAILED,
+            "Node returned an invalid delegation revocation receipt",
+            void 0,
+            { cid }
+          )
+        };
+      }
+      return { ok: true, data: parsed.data };
     } catch (error) {
       if (error instanceof Error && error.name === "AbortError") {
         return {
@@ -7282,6 +7367,86 @@ var DelegationManager = class {
       };
     }
   }
+  /** Query lifecycle-complete delegation history for the authenticated account. */
+  async query(options = {}) {
+    const validated = AccountDelegationQueryOptionsSchema.safeParse(options);
+    if (!validated.success) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.INVALID_INPUT,
+          "Invalid delegation query options",
+          void 0,
+          { issues: validated.error.issues }
+        )
+      };
+    }
+    if (!this.invokeAny) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.NOT_INITIALIZED,
+          "Delegation query requires an invokeAny function"
+        )
+      };
+    }
+    if (!this.accountSpaceId) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.NOT_INITIALIZED,
+          "Delegation query requires an account space"
+        )
+      };
+    }
+    try {
+      const invocationHeaders = this.invokeAny(this.session, [{
+        spaceId: this.accountSpaceId,
+        service: "delegation",
+        path: "",
+        action: DelegationAction.LIST
+      }]);
+      const headers = Object.fromEntries(new Headers(invocationHeaders).entries());
+      headers["content-type"] = "application/json";
+      const response = await this.fetchFn(`${this.host}/delegation/query`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(validated.data)
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        return {
+          ok: false,
+          error: createError(
+            DelegationErrorCodes.NETWORK_ERROR,
+            `Failed to query delegations: ${response.status} - ${errorText}`,
+            void 0,
+            { status: response.status }
+          )
+        };
+      }
+      const parsed = AccountDelegationPageSchema.safeParse(await response.json());
+      if (!parsed.success) {
+        return {
+          ok: false,
+          error: createError(
+            DelegationErrorCodes.INVALID_TOKEN,
+            "Node returned an invalid delegation query response"
+          )
+        };
+      }
+      return { ok: true, data: parsed.data };
+    } catch (error) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.NETWORK_ERROR,
+          `Network error during delegation query: ${String(error)}`,
+          error instanceof Error ? error : void 0
+        )
+      };
+    }
+  }
   /**
    * Lists all delegations for the current session's space.
    *