@tinycloud/sdk-core 3.0.0-beta.0 → 3.0.0-beta.2

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { b7 as CredentialHolderBinding, b8 as CredentialFlowDescriptor, b9 as CredentialRequirement, ba as StoredCredentialRecord, bb as VerifiedCredential, bc as CredentialStorageReceipt, bd as IssuedCredentialEnvelope, be as CredentialIssuerMetadata } from './credential-admission-C_cO1QqB.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, B as BuildPolicyCredentialPresentationV3Input, C as CONTENT_SOURCE_V1_DOMAIN, bf as CREDENTIAL_ACQUISITION_PROTOCOL, bg as CREDENTIAL_CONTRACT_VERSION, bh as CREDENTIAL_FORMAT, bf as CREDENTIAL_PROTOCOL, bi as CREDENTIAL_STEP_REGISTRY_VERSION, d as CompactUcanAuthorizationV1, bj as CredentialClaimDescriptor, bk as CredentialEndpointId, bl as CredentialInputDescriptor, bm as CredentialProgressEvent, bn as CredentialStepDescriptor, bo as CredentialStepType, bp as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, e as EIP191_JCS_SIGNATURE_SUITE, bq as HOLDER_BINDING_DOMAIN, br as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, f as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, g as POLICY_CAPABILITY_V1_DOMAIN, h as POLICY_CAPABILITY_V1_SCHEMA, i as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, j as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, k as POLICY_ENGINE_RECORD_SCHEMA, l as POLICY_PRESENTATION_V3_DOMAIN, m as POLICY_PRESENTATION_V3_SCHEMA, n as POLICY_SCHEMA, o as POLICY_SESSION_UCAN_V1_PROFILE, p as POLICY_STATUS_SCHEMA, q as POLICY_V1_DOMAIN, r as POLICY_V1_SCHEMA, s as POLICY_V2_DOMAIN, t as POLICY_V2_SCHEMA, a as Policy, v as PolicyCredentialAdmissionV3, w as PolicyCredentialPresentationV3, x as PolicyCredentialRequirementV1, P as PolicyEngineRecord, y as PolicyRootStatusV3, z as PolicySessionUcanV1, D as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, F as ROOT_REVOCATION_V1_SCHEMA, G as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, H as ROOT_STATUS_RENEWAL_V1_DOMAIN, I as ROOT_STATUS_V1_DOMAIN, K as SignCompactUcanAuthorizationInput, O as SignCompactUcanRootAuthorizationInput, Q as SignatureMaterialError, T as SignatureSuite, V as SignatureVerificationError, W as SignedObjectCanonicalizationError, X as SignedObjectDigestError, Y as SignedObjectErrorCode, Z as SignedObjectIdError, _ as SignedObjectKind, $ as SignedObjectMaterial, a0 as SignedObjectProfileError, a1 as SignedObjectSchemaError, a2 as SignedObjectSignature, S as SignedObjectSigner, a3 as SignedObjectVerificationResult, a4 as SignedPolicyObject, a5 as SigningKeyBindingError, a6 as UnifiedContentSource, a7 as UnifiedEncryptionCapability, a8 as UnifiedKvCapability, a9 as UnifiedNativeCapability, aa as UnifiedPolicyCapability, ab as UnifiedPolicyV1, ac as UnifiedPolicyV2, ad as UnifiedResourceSelector, ae as UnsignedPolicy, U as UnsignedPolicyEngineRecord, af as UnsignedPolicyObject, ag as UnsignedPolicyStatus, ah as UnsignedUnifiedPolicyV2, ai as UnsupportedSignatureSuiteError, aj as admitPolicyCredentialV3, ak as buildPolicyCredentialPresentationV3, al as canonicalizeSignedObjectUnsigned, am as canonicalizeUnifiedPolicyCapability, an as compactAttenuationContains, ao as contentSourceDigestHex, ap as createAndSignPolicy, aq as createAndSignPolicyEngineRecord, ar as createAndSignPolicyStatus, as as createAndSignSignedObject, av as deriveSignedObjectMaterial, aw as getPolicyRootStatusV3, ay as normalizeUnifiedPolicyCapability, az as parseCompactUcanAuthorization, aA as parsePolicySessionUcan, aB as policyCidFromCanonicalBytes, aC as policyDigestHex, aD as policyIdForDigestHex, aE as policyV2DigestHex, aF as projectUnifiedPolicyCapabilities, aG as projectUnifiedPolicyCapability, aH as renewPolicyRootStatusV3, aJ as revokePolicyRootV3, aK as signCompactUcanAuthorization, aL as signCompactUcanRootAuthorization, aM as signedObjectIdFor, aN as toSignedObjectError, aO as unifiedNativeProjectionHashHex, aP as unifiedPolicyCapabilityContains, aQ as unifiedPolicyCapabilityDigestHex, aR as unifiedPolicyCapabilityFromNative, aS as validatePolicyCredentialRequirementV1, aT as validatePolicyEngineRecordSigned, aU as validatePolicyEngineRecordSignedShape, aV as validatePolicyEngineRecordUnsigned, aW as validatePolicySigned, aX as validatePolicySignedShape, aY as validatePolicyStatusSigned, aZ as validatePolicyStatusSignedShape, a_ as validatePolicyStatusUnsigned, a$ as validatePolicyUnsigned, b0 as validateUnifiedPolicyV2, b1 as verifyPolicy, b2 as verifyPolicyEngineRecord, b3 as verifyPolicyRootRevocationV3, b4 as verifyPolicyRootStatusCheckpointV3, b5 as verifyPolicyStatus, b6 as verifySignedObject } from './credential-admission-C_cO1QqB.cjs';
+import { bj as CredentialHolderBinding, bk as CredentialFlowDescriptor, bl as CredentialRequirement, bm as StoredCredentialRecord, bn as VerifiedCredential, bo as CredentialStorageReceipt, bp as IssuedCredentialEnvelope, bq as CredentialIssuerMetadata } from './credential-admission-BVUC6kdw.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, B as BuildPolicyCredentialPresentationV3Input, d as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, br as CREDENTIAL_ACQUISITION_PROTOCOL, bs as CREDENTIAL_CONTRACT_VERSION, bt as CREDENTIAL_FORMAT, br as CREDENTIAL_PROTOCOL, bu as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactUcanAuthorizationV1, bv as CredentialClaimDescriptor, bw as CredentialEndpointId, bx as CredentialInputDescriptor, by as CredentialProgressEvent, bz as CredentialStepDescriptor, bA as CredentialStepType, bB as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, g as EIP191_JCS_SIGNATURE_SUITE, bC as HOLDER_BINDING_DOMAIN, bD as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, h as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, i as POLICY_CAPABILITY_V1_DOMAIN, j as POLICY_CAPABILITY_V1_SCHEMA, k as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, l as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, m as POLICY_ENGINE_RECORD_SCHEMA, n as POLICY_PRESENTATION_V3_DOMAIN, o as POLICY_PRESENTATION_V3_SCHEMA, p as POLICY_PRESENTATION_V4_DOMAIN, q as POLICY_PRESENTATION_V4_SCHEMA, r as POLICY_SCHEMA, s as POLICY_SESSION_UCAN_V1_PROFILE, t as POLICY_STATUS_SCHEMA, u as POLICY_V1_DOMAIN, v as POLICY_V1_SCHEMA, w as POLICY_V2_DOMAIN, x as POLICY_V2_SCHEMA, a as Policy, z as PolicyCredentialAdmissionV3, D as PolicyCredentialAdmissionV4, F as PolicyCredentialPresentationV3, G as PolicyCredentialPresentationV4, H as PolicyCredentialRequirementV1, P as PolicyEngineRecord, I as PolicyRootStatusV3, K as PolicySessionUcanFactV1, O as PolicySessionUcanV1, Q as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, T as ROOT_REVOCATION_V1_SCHEMA, V as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, W as ROOT_STATUS_RENEWAL_V1_DOMAIN, X as ROOT_STATUS_V1_DOMAIN, Y as SignCompactUcanAuthorizationInput, Z as SignCompactUcanRootAuthorizationInput, _ as SignatureMaterialError, $ as SignatureSuite, a0 as SignatureVerificationError, a1 as SignedObjectCanonicalizationError, a2 as SignedObjectDigestError, a3 as SignedObjectErrorCode, a4 as SignedObjectIdError, a5 as SignedObjectKind, a6 as SignedObjectMaterial, a7 as SignedObjectProfileError, a8 as SignedObjectSchemaError, a9 as SignedObjectSignature, S as SignedObjectSigner, aa as SignedObjectVerificationResult, ab as SignedPolicyObject, ac as SigningKeyBindingError, ad as UnifiedContentSource, ae as UnifiedEncryptionCapability, af as UnifiedKvCapability, ag as UnifiedNativeCapability, ah as UnifiedPolicyCapability, ai as UnifiedPolicyV1, aj as UnifiedPolicyV2, ak as UnifiedResourceSelector, al as UnsignedPolicy, am as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, an as UnsignedPolicyObject, ao as UnsignedPolicyStatus, ap as UnsignedUnifiedPolicyV2, aq as UnsupportedSignatureSuiteError, ar as admitPolicyCredentialV3, as as admitPolicyCredentialV4, at as buildPolicyCredentialPresentationV3, au as buildPolicyCredentialPresentationV4, av as canonicalizeSignedObjectUnsigned, aw as canonicalizeUnifiedPolicyCapability, ax as compactAttenuationContains, ay as contentSourceDigestHex, az as createAndSignPolicy, aA as createAndSignPolicyEngineRecord, aB as createAndSignPolicyStatus, aC as createAndSignSignedObject, aF as deriveSignedObjectMaterial, aG as getPolicyRootStatusV3, aH as issuedCredentialEnvelopeFromVerified, aJ as normalizeUnifiedPolicyCapability, aK as parseCompactUcanAuthorization, aL as parsePolicySessionUcan, aM as policyCidFromCanonicalBytes, aN as policyDigestHex, aO as policyIdForDigestHex, aP as policyV2DigestHex, aQ as projectUnifiedPolicyCapabilities, aR as projectUnifiedPolicyCapability, aS as renewPolicyRootStatusV3, aU as revokePolicyRootV3, aV as signCompactUcanAuthorization, aW as signCompactUcanRootAuthorization, aX as signPolicyCredentialPresentationV4, aY as signedObjectIdFor, aZ as toSignedObjectError, a_ as unifiedNativeProjectionHashHex, a$ as unifiedPolicyCapabilityContains, b0 as unifiedPolicyCapabilityDigestHex, b1 as unifiedPolicyCapabilityFromNative, b2 as validatePolicyCredentialRequirementV1, b3 as validatePolicyEngineRecordSigned, b4 as validatePolicyEngineRecordSignedShape, b5 as validatePolicyEngineRecordUnsigned, b6 as validatePolicySigned, b7 as validatePolicySignedShape, b8 as validatePolicyStatusSigned, b9 as validatePolicyStatusSignedShape, ba as validatePolicyStatusUnsigned, bb as validatePolicyUnsigned, bc as validateUnifiedPolicyV2, bd as verifyPolicy, be as verifyPolicyEngineRecord, bf as verifyPolicyRootRevocationV3, bg as verifyPolicyRootStatusCheckpointV3, bh as verifyPolicyStatus, bi as verifySignedObject } from './credential-admission-BVUC6kdw.cjs';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
@@ -224,6 +224,12 @@ declare class CredentialError extends Error {
 }
 declare function credentialError(value: unknown, fallbackCode?: CredentialErrorCode): CredentialError;
 
+declare const EMAIL_CREDENTIAL_MAX_AGE_SECONDS: 3600;
+declare function createEmailCredentialRequirement(input: {
+    readonly email: string;
+    readonly profile: CredentialRequirement["profile"];
+    readonly credentialType: CredentialRequirement["credentialType"];
+}): CredentialRequirement;
 declare function validateCredentialRequirement(value: unknown): CredentialRequirement;
 declare function credentialRequirementDigest(requirement: CredentialRequirement): Promise<string>;
 declare function descriptorSatisfiesRequirement(descriptor: CredentialFlowDescriptor, requirement: CredentialRequirement): boolean;
@@ -1543,6 +1549,89 @@ type SignStrategy = AutoSignStrategy | AutoRejectStrategy | CallbackStrategy | E
  */
 declare const defaultSignStrategy: SignStrategy;
 
+/** OAuth scope which grants a client access to the canonical TinyCloud key. */
+declare const TINYCLOUD_MANAGE_KEY_SCOPE: "tinycloud:manage-key";
+/** OIDC claim containing the canonical identity selected by OpenKey. */
+declare const TINYCLOUD_CANONICAL_IDENTITY_CLAIM: "https://tinycloud.xyz/canonical_identity";
+/**
+ * Adds the canonical-key scope to an OAuth authorization request. Supplying
+ * this value to the authorization server is the explicit user-consent step;
+ * possession of an unrelated OAuth token is never treated as authority to
+ * sign for the canonical key.
+ */
+declare function requestTinyCloudManageKeyScope(scopes?: string | readonly string[]): string;
+/** True only when an OAuth grant explicitly includes `tinycloud:manage-key`. */
+declare function hasTinyCloudManageKeyScope(scopes: unknown): boolean;
+/** The one canonical identity an OAuth `tinycloud:manage-key` token may use. */
+interface CanonicalTinyCloudIdentity {
+    version: "v1";
+    keyId: string;
+    address: CanonicalAddress;
+    chainId: number;
+    did: string;
+    spaceId: string;
+}
+type OpenKeyManageKeyErrorCode = "CONSENT_REQUIRED" | "GRANT_DISABLED" | "USER_EXCLUSIVE" | "TOKEN_EXPIRED" | "MESSAGE_REJECTED" | "IDENTITY_MISMATCH" | "SIGNER_UNAVAILABLE";
+/** A typed denial or recoverable outage from the OAuth canonical-key boundary. */
+declare class OpenKeyManageKeyError extends Error {
+    readonly code: OpenKeyManageKeyErrorCode;
+    /** A user-visible OAuth recovery location, when the signer provides one. */
+    readonly approvalUrl?: string | undefined;
+    readonly retryable: boolean;
+    constructor(code: OpenKeyManageKeyErrorCode, message: string, 
+    /** A user-visible OAuth recovery location, when the signer provides one. */
+    approvalUrl?: string | undefined, retryable?: boolean);
+}
+/**
+ * Parse and fail closed on the OpenID canonical identity claim. The DID and
+ * space are derived from the checksummed address instead of trusted
+ * independently. The identity claim chooses its chain and space name; this
+ * shared contract does not impose an application's chain or space.
+ */
+declare function parseCanonicalTinyCloudIdentity(value: unknown): CanonicalTinyCloudIdentity;
+/** Parse the canonical identity directly from an OAuth/OIDC claims object. */
+declare function parseCanonicalTinyCloudIdentityClaims(claims: unknown): CanonicalTinyCloudIdentity;
+interface OpenKeyManageKeySigningRequestBody {
+    address: string;
+    chainId: number;
+    message: string;
+    type: "siwe";
+}
+interface OpenKeyManageKeySigningResponseBody {
+    approved?: boolean;
+    signature?: string;
+    canonicalIdentity?: unknown;
+    code?: string;
+    reason?: string;
+    error?: string;
+    approvalUrl?: string;
+}
+/** Minimal fetch surface used by the manage-key signer. */
+type OpenKeyManageKeyFetch = (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => Promise<Response>;
+interface OpenKeyManageKeySigningStrategyOptions {
+    /** The OpenKey public signer route for a consented OAuth client. */
+    endpoint: string;
+    /** A bearer token obtained with `tinycloud:manage-key` consent. */
+    token: string | (() => string | Promise<string | undefined>);
+    /** OAuth grant scopes returned with the bearer token. */
+    scopes: string | readonly string[];
+    /** Canonical identity parsed from the token's OIDC claims. */
+    identity: CanonicalTinyCloudIdentity;
+    /** Fetch implementation. Defaults to `globalThis.fetch`. */
+    fetch?: OpenKeyManageKeyFetch;
+}
+interface OpenKeyManageKeyCallbackStrategy extends CallbackStrategy {
+    /** Lets the SDK avoid bootstrap paths that require broader signing authority. */
+    openKeyAutoSign: true;
+}
+/**
+ * Create a client-bound signer for an OAuth token consented for
+ * `tinycloud:manage-key`. It sends exactly one bearer-authenticated, cookie-
+ * free request for the original SIWE string and accepts only the claimed
+ * canonical identity's EIP-191 signature.
+ */
+declare function createOpenKeyManageKeySigningStrategy(options: OpenKeyManageKeySigningStrategyOptions): OpenKeyManageKeyCallbackStrategy;
+
 /**
  * Space creation handler types for TinyCloud authorization.
  *
@@ -3346,4 +3435,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyStorageReceipt };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { b7 as CredentialHolderBinding, b8 as CredentialFlowDescriptor, b9 as CredentialRequirement, ba as StoredCredentialRecord, bb as VerifiedCredential, bc as CredentialStorageReceipt, bd as IssuedCredentialEnvelope, be as CredentialIssuerMetadata } from './credential-admission-cvHe-HUC.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, B as BuildPolicyCredentialPresentationV3Input, C as CONTENT_SOURCE_V1_DOMAIN, bf as CREDENTIAL_ACQUISITION_PROTOCOL, bg as CREDENTIAL_CONTRACT_VERSION, bh as CREDENTIAL_FORMAT, bf as CREDENTIAL_PROTOCOL, bi as CREDENTIAL_STEP_REGISTRY_VERSION, d as CompactUcanAuthorizationV1, bj as CredentialClaimDescriptor, bk as CredentialEndpointId, bl as CredentialInputDescriptor, bm as CredentialProgressEvent, bn as CredentialStepDescriptor, bo as CredentialStepType, bp as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, e as EIP191_JCS_SIGNATURE_SUITE, bq as HOLDER_BINDING_DOMAIN, br as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, f as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, g as POLICY_CAPABILITY_V1_DOMAIN, h as POLICY_CAPABILITY_V1_SCHEMA, i as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, j as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, k as POLICY_ENGINE_RECORD_SCHEMA, l as POLICY_PRESENTATION_V3_DOMAIN, m as POLICY_PRESENTATION_V3_SCHEMA, n as POLICY_SCHEMA, o as POLICY_SESSION_UCAN_V1_PROFILE, p as POLICY_STATUS_SCHEMA, q as POLICY_V1_DOMAIN, r as POLICY_V1_SCHEMA, s as POLICY_V2_DOMAIN, t as POLICY_V2_SCHEMA, a as Policy, v as PolicyCredentialAdmissionV3, w as PolicyCredentialPresentationV3, x as PolicyCredentialRequirementV1, P as PolicyEngineRecord, y as PolicyRootStatusV3, z as PolicySessionUcanV1, D as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, F as ROOT_REVOCATION_V1_SCHEMA, G as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, H as ROOT_STATUS_RENEWAL_V1_DOMAIN, I as ROOT_STATUS_V1_DOMAIN, K as SignCompactUcanAuthorizationInput, O as SignCompactUcanRootAuthorizationInput, Q as SignatureMaterialError, T as SignatureSuite, V as SignatureVerificationError, W as SignedObjectCanonicalizationError, X as SignedObjectDigestError, Y as SignedObjectErrorCode, Z as SignedObjectIdError, _ as SignedObjectKind, $ as SignedObjectMaterial, a0 as SignedObjectProfileError, a1 as SignedObjectSchemaError, a2 as SignedObjectSignature, S as SignedObjectSigner, a3 as SignedObjectVerificationResult, a4 as SignedPolicyObject, a5 as SigningKeyBindingError, a6 as UnifiedContentSource, a7 as UnifiedEncryptionCapability, a8 as UnifiedKvCapability, a9 as UnifiedNativeCapability, aa as UnifiedPolicyCapability, ab as UnifiedPolicyV1, ac as UnifiedPolicyV2, ad as UnifiedResourceSelector, ae as UnsignedPolicy, U as UnsignedPolicyEngineRecord, af as UnsignedPolicyObject, ag as UnsignedPolicyStatus, ah as UnsignedUnifiedPolicyV2, ai as UnsupportedSignatureSuiteError, aj as admitPolicyCredentialV3, ak as buildPolicyCredentialPresentationV3, al as canonicalizeSignedObjectUnsigned, am as canonicalizeUnifiedPolicyCapability, an as compactAttenuationContains, ao as contentSourceDigestHex, ap as createAndSignPolicy, aq as createAndSignPolicyEngineRecord, ar as createAndSignPolicyStatus, as as createAndSignSignedObject, av as deriveSignedObjectMaterial, aw as getPolicyRootStatusV3, ay as normalizeUnifiedPolicyCapability, az as parseCompactUcanAuthorization, aA as parsePolicySessionUcan, aB as policyCidFromCanonicalBytes, aC as policyDigestHex, aD as policyIdForDigestHex, aE as policyV2DigestHex, aF as projectUnifiedPolicyCapabilities, aG as projectUnifiedPolicyCapability, aH as renewPolicyRootStatusV3, aJ as revokePolicyRootV3, aK as signCompactUcanAuthorization, aL as signCompactUcanRootAuthorization, aM as signedObjectIdFor, aN as toSignedObjectError, aO as unifiedNativeProjectionHashHex, aP as unifiedPolicyCapabilityContains, aQ as unifiedPolicyCapabilityDigestHex, aR as unifiedPolicyCapabilityFromNative, aS as validatePolicyCredentialRequirementV1, aT as validatePolicyEngineRecordSigned, aU as validatePolicyEngineRecordSignedShape, aV as validatePolicyEngineRecordUnsigned, aW as validatePolicySigned, aX as validatePolicySignedShape, aY as validatePolicyStatusSigned, aZ as validatePolicyStatusSignedShape, a_ as validatePolicyStatusUnsigned, a$ as validatePolicyUnsigned, b0 as validateUnifiedPolicyV2, b1 as verifyPolicy, b2 as verifyPolicyEngineRecord, b3 as verifyPolicyRootRevocationV3, b4 as verifyPolicyRootStatusCheckpointV3, b5 as verifyPolicyStatus, b6 as verifySignedObject } from './credential-admission-cvHe-HUC.js';
+import { bj as CredentialHolderBinding, bk as CredentialFlowDescriptor, bl as CredentialRequirement, bm as StoredCredentialRecord, bn as VerifiedCredential, bo as CredentialStorageReceipt, bp as IssuedCredentialEnvelope, bq as CredentialIssuerMetadata } from './credential-admission-BgvwOTIV.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, B as BuildPolicyCredentialPresentationV3Input, d as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, br as CREDENTIAL_ACQUISITION_PROTOCOL, bs as CREDENTIAL_CONTRACT_VERSION, bt as CREDENTIAL_FORMAT, br as CREDENTIAL_PROTOCOL, bu as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactUcanAuthorizationV1, bv as CredentialClaimDescriptor, bw as CredentialEndpointId, bx as CredentialInputDescriptor, by as CredentialProgressEvent, bz as CredentialStepDescriptor, bA as CredentialStepType, bB as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, g as EIP191_JCS_SIGNATURE_SUITE, bC as HOLDER_BINDING_DOMAIN, bD as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, h as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, i as POLICY_CAPABILITY_V1_DOMAIN, j as POLICY_CAPABILITY_V1_SCHEMA, k as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, l as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, m as POLICY_ENGINE_RECORD_SCHEMA, n as POLICY_PRESENTATION_V3_DOMAIN, o as POLICY_PRESENTATION_V3_SCHEMA, p as POLICY_PRESENTATION_V4_DOMAIN, q as POLICY_PRESENTATION_V4_SCHEMA, r as POLICY_SCHEMA, s as POLICY_SESSION_UCAN_V1_PROFILE, t as POLICY_STATUS_SCHEMA, u as POLICY_V1_DOMAIN, v as POLICY_V1_SCHEMA, w as POLICY_V2_DOMAIN, x as POLICY_V2_SCHEMA, a as Policy, z as PolicyCredentialAdmissionV3, D as PolicyCredentialAdmissionV4, F as PolicyCredentialPresentationV3, G as PolicyCredentialPresentationV4, H as PolicyCredentialRequirementV1, P as PolicyEngineRecord, I as PolicyRootStatusV3, K as PolicySessionUcanFactV1, O as PolicySessionUcanV1, Q as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, T as ROOT_REVOCATION_V1_SCHEMA, V as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, W as ROOT_STATUS_RENEWAL_V1_DOMAIN, X as ROOT_STATUS_V1_DOMAIN, Y as SignCompactUcanAuthorizationInput, Z as SignCompactUcanRootAuthorizationInput, _ as SignatureMaterialError, $ as SignatureSuite, a0 as SignatureVerificationError, a1 as SignedObjectCanonicalizationError, a2 as SignedObjectDigestError, a3 as SignedObjectErrorCode, a4 as SignedObjectIdError, a5 as SignedObjectKind, a6 as SignedObjectMaterial, a7 as SignedObjectProfileError, a8 as SignedObjectSchemaError, a9 as SignedObjectSignature, S as SignedObjectSigner, aa as SignedObjectVerificationResult, ab as SignedPolicyObject, ac as SigningKeyBindingError, ad as UnifiedContentSource, ae as UnifiedEncryptionCapability, af as UnifiedKvCapability, ag as UnifiedNativeCapability, ah as UnifiedPolicyCapability, ai as UnifiedPolicyV1, aj as UnifiedPolicyV2, ak as UnifiedResourceSelector, al as UnsignedPolicy, am as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, an as UnsignedPolicyObject, ao as UnsignedPolicyStatus, ap as UnsignedUnifiedPolicyV2, aq as UnsupportedSignatureSuiteError, ar as admitPolicyCredentialV3, as as admitPolicyCredentialV4, at as buildPolicyCredentialPresentationV3, au as buildPolicyCredentialPresentationV4, av as canonicalizeSignedObjectUnsigned, aw as canonicalizeUnifiedPolicyCapability, ax as compactAttenuationContains, ay as contentSourceDigestHex, az as createAndSignPolicy, aA as createAndSignPolicyEngineRecord, aB as createAndSignPolicyStatus, aC as createAndSignSignedObject, aF as deriveSignedObjectMaterial, aG as getPolicyRootStatusV3, aH as issuedCredentialEnvelopeFromVerified, aJ as normalizeUnifiedPolicyCapability, aK as parseCompactUcanAuthorization, aL as parsePolicySessionUcan, aM as policyCidFromCanonicalBytes, aN as policyDigestHex, aO as policyIdForDigestHex, aP as policyV2DigestHex, aQ as projectUnifiedPolicyCapabilities, aR as projectUnifiedPolicyCapability, aS as renewPolicyRootStatusV3, aU as revokePolicyRootV3, aV as signCompactUcanAuthorization, aW as signCompactUcanRootAuthorization, aX as signPolicyCredentialPresentationV4, aY as signedObjectIdFor, aZ as toSignedObjectError, a_ as unifiedNativeProjectionHashHex, a$ as unifiedPolicyCapabilityContains, b0 as unifiedPolicyCapabilityDigestHex, b1 as unifiedPolicyCapabilityFromNative, b2 as validatePolicyCredentialRequirementV1, b3 as validatePolicyEngineRecordSigned, b4 as validatePolicyEngineRecordSignedShape, b5 as validatePolicyEngineRecordUnsigned, b6 as validatePolicySigned, b7 as validatePolicySignedShape, b8 as validatePolicyStatusSigned, b9 as validatePolicyStatusSignedShape, ba as validatePolicyStatusUnsigned, bb as validatePolicyUnsigned, bc as validateUnifiedPolicyV2, bd as verifyPolicy, be as verifyPolicyEngineRecord, bf as verifyPolicyRootRevocationV3, bg as verifyPolicyRootStatusCheckpointV3, bh as verifyPolicyStatus, bi as verifySignedObject } from './credential-admission-BgvwOTIV.js';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
@@ -224,6 +224,12 @@ declare class CredentialError extends Error {
 }
 declare function credentialError(value: unknown, fallbackCode?: CredentialErrorCode): CredentialError;
 
+declare const EMAIL_CREDENTIAL_MAX_AGE_SECONDS: 3600;
+declare function createEmailCredentialRequirement(input: {
+    readonly email: string;
+    readonly profile: CredentialRequirement["profile"];
+    readonly credentialType: CredentialRequirement["credentialType"];
+}): CredentialRequirement;
 declare function validateCredentialRequirement(value: unknown): CredentialRequirement;
 declare function credentialRequirementDigest(requirement: CredentialRequirement): Promise<string>;
 declare function descriptorSatisfiesRequirement(descriptor: CredentialFlowDescriptor, requirement: CredentialRequirement): boolean;
@@ -1543,6 +1549,89 @@ type SignStrategy = AutoSignStrategy | AutoRejectStrategy | CallbackStrategy | E
  */
 declare const defaultSignStrategy: SignStrategy;
 
+/** OAuth scope which grants a client access to the canonical TinyCloud key. */
+declare const TINYCLOUD_MANAGE_KEY_SCOPE: "tinycloud:manage-key";
+/** OIDC claim containing the canonical identity selected by OpenKey. */
+declare const TINYCLOUD_CANONICAL_IDENTITY_CLAIM: "https://tinycloud.xyz/canonical_identity";
+/**
+ * Adds the canonical-key scope to an OAuth authorization request. Supplying
+ * this value to the authorization server is the explicit user-consent step;
+ * possession of an unrelated OAuth token is never treated as authority to
+ * sign for the canonical key.
+ */
+declare function requestTinyCloudManageKeyScope(scopes?: string | readonly string[]): string;
+/** True only when an OAuth grant explicitly includes `tinycloud:manage-key`. */
+declare function hasTinyCloudManageKeyScope(scopes: unknown): boolean;
+/** The one canonical identity an OAuth `tinycloud:manage-key` token may use. */
+interface CanonicalTinyCloudIdentity {
+    version: "v1";
+    keyId: string;
+    address: CanonicalAddress;
+    chainId: number;
+    did: string;
+    spaceId: string;
+}
+type OpenKeyManageKeyErrorCode = "CONSENT_REQUIRED" | "GRANT_DISABLED" | "USER_EXCLUSIVE" | "TOKEN_EXPIRED" | "MESSAGE_REJECTED" | "IDENTITY_MISMATCH" | "SIGNER_UNAVAILABLE";
+/** A typed denial or recoverable outage from the OAuth canonical-key boundary. */
+declare class OpenKeyManageKeyError extends Error {
+    readonly code: OpenKeyManageKeyErrorCode;
+    /** A user-visible OAuth recovery location, when the signer provides one. */
+    readonly approvalUrl?: string | undefined;
+    readonly retryable: boolean;
+    constructor(code: OpenKeyManageKeyErrorCode, message: string, 
+    /** A user-visible OAuth recovery location, when the signer provides one. */
+    approvalUrl?: string | undefined, retryable?: boolean);
+}
+/**
+ * Parse and fail closed on the OpenID canonical identity claim. The DID and
+ * space are derived from the checksummed address instead of trusted
+ * independently. The identity claim chooses its chain and space name; this
+ * shared contract does not impose an application's chain or space.
+ */
+declare function parseCanonicalTinyCloudIdentity(value: unknown): CanonicalTinyCloudIdentity;
+/** Parse the canonical identity directly from an OAuth/OIDC claims object. */
+declare function parseCanonicalTinyCloudIdentityClaims(claims: unknown): CanonicalTinyCloudIdentity;
+interface OpenKeyManageKeySigningRequestBody {
+    address: string;
+    chainId: number;
+    message: string;
+    type: "siwe";
+}
+interface OpenKeyManageKeySigningResponseBody {
+    approved?: boolean;
+    signature?: string;
+    canonicalIdentity?: unknown;
+    code?: string;
+    reason?: string;
+    error?: string;
+    approvalUrl?: string;
+}
+/** Minimal fetch surface used by the manage-key signer. */
+type OpenKeyManageKeyFetch = (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => Promise<Response>;
+interface OpenKeyManageKeySigningStrategyOptions {
+    /** The OpenKey public signer route for a consented OAuth client. */
+    endpoint: string;
+    /** A bearer token obtained with `tinycloud:manage-key` consent. */
+    token: string | (() => string | Promise<string | undefined>);
+    /** OAuth grant scopes returned with the bearer token. */
+    scopes: string | readonly string[];
+    /** Canonical identity parsed from the token's OIDC claims. */
+    identity: CanonicalTinyCloudIdentity;
+    /** Fetch implementation. Defaults to `globalThis.fetch`. */
+    fetch?: OpenKeyManageKeyFetch;
+}
+interface OpenKeyManageKeyCallbackStrategy extends CallbackStrategy {
+    /** Lets the SDK avoid bootstrap paths that require broader signing authority. */
+    openKeyAutoSign: true;
+}
+/**
+ * Create a client-bound signer for an OAuth token consented for
+ * `tinycloud:manage-key`. It sends exactly one bearer-authenticated, cookie-
+ * free request for the original SIWE string and accepts only the claimed
+ * canonical identity's EIP-191 signature.
+ */
+declare function createOpenKeyManageKeySigningStrategy(options: OpenKeyManageKeySigningStrategyOptions): OpenKeyManageKeyCallbackStrategy;
+
 /**
  * Space creation handler types for TinyCloud authorization.
  *
@@ -3346,4 +3435,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyStorageReceipt };