@tinycloud/sdk-core 3.0.0-beta.13 → 3.0.0-beta.14

package/dist/index.d.cts

@@ -4,8 +4,8 @@ export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3I
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, parseSecretCatalogKey, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
-import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aE as ShareLink, be as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-Cz5zJzED.cjs';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bP as CapabilityKeyRegistry, bQ as CapabilityKeyRegistryErrorCode, bR as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDeliveryAuthorizationV3Receipt, ay as ShareDeliveryAuthorizationV3Request, az as ShareDetachedProof, aA as ShareEnvelopeError, aB as ShareEnvelopeV2, aC as ShareExpiryBounds, aD as ShareKvContentSource, aF as ShareLinkData, aG as ShareLinkLocation, aH as ShareListEntry, aI as ShareListResult, aJ as ShareNativeAction, aK as ShareNativeInvokeEnvelopeV1, aL as ShareNativeInvokeErrorResult, aM as ShareNativeInvokeInput, aN as ShareNativeInvokeResult, aO as ShareNativeInvokeSuccessResult, aP as ShareNativeResponse, aQ as ShareNativeResponseSchema, aR as SharePolicy, aS as SharePolicyBinding, aT as SharePolicySession, aU as SharePolicySessionV1, aV as SharePolicySessionWireV1, aW as SharePortableDelegation, aX as ShareReadInvocationV1, aY as ShareReadResult, aZ as ShareRecipientClient, a_ as ShareRecipientClientOptions, b0 as ShareRecipientPolicy, b2 as ShareRecipientResult, b3 as ShareRecipientTarget, b5 as ShareResource, b7 as ShareSaveOptions, b8 as ShareSchema, b9 as ShareSqlContentSource, ba as ShareWireAction, bb as SharingService, bc as SharingServiceConfig, bd as SignedDelegation, bf as SpaceOwnership, bS as StoredDelegationChain, bg as VerifyShareEnvelopeOptions, bh as canonicalOwnerSharePolicy, bi as computeOwnerShareRegistrationCid, bj as computeShareCid, bT as createCapabilityKeyRegistry, bk as createDelegatedShareKey, bl as createPolicyEnforcementDelegation, bm as createShareArtifact, bn as createShareArtifactAsync, bo as createSharePolicy, bp as createSharingService, bq as decryptShareBytesAsync, br as delegatePortablePolicySession, bs as encodeInlineShareUrl, bt as encodeShareArtifact, bu as encodeShareUrl, bv as encryptShareBytes, bw as encryptShareBytesAsync, bx as importPortableDelegation, by as intersectShareCapabilities, bz as isV2ShareLink, bA as normalizeShareActions, bB as normalizeShareRecipientTarget, bC as normalizeShareResource, bD as parsePortableDelegation, bE as parseShareArtifact, bF as parseShareUrl, bG as restoreDelegatedShareKey, bH as serializePortableDelegation, bI as shareCapabilityAllows, bJ as signShareEnvelope, bK as validateOwnerSharePolicyRegistration, bL as validateOwnerSharePolicyRegistrationBytes, bM as validateShareDeliveryAuthorizationV3Bytes, bN as verifyShareCid, bO as verifyShareEnvelope } from './recipient-types.schema-Cz5zJzED.cjs';
+import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aE as ShareLink, be as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-lAKNQlxx.cjs';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bP as CapabilityKeyRegistry, bQ as CapabilityKeyRegistryErrorCode, bR as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDeliveryAuthorizationV3Receipt, ay as ShareDeliveryAuthorizationV3Request, az as ShareDetachedProof, aA as ShareEnvelopeError, aB as ShareEnvelopeV2, aC as ShareExpiryBounds, aD as ShareKvContentSource, aF as ShareLinkData, aG as ShareLinkLocation, aH as ShareListEntry, aI as ShareListResult, aJ as ShareNativeAction, aK as ShareNativeInvokeEnvelopeV1, aL as ShareNativeInvokeErrorResult, aM as ShareNativeInvokeInput, aN as ShareNativeInvokeResult, aO as ShareNativeInvokeSuccessResult, aP as ShareNativeResponse, aQ as ShareNativeResponseSchema, aR as SharePolicy, aS as SharePolicyBinding, aT as SharePolicySession, aU as SharePolicySessionV1, aV as SharePolicySessionWireV1, aW as SharePortableDelegation, aX as ShareReadInvocationV1, aY as ShareReadResult, aZ as ShareRecipientClient, a_ as ShareRecipientClientOptions, b0 as ShareRecipientPolicy, b2 as ShareRecipientResult, b3 as ShareRecipientTarget, b5 as ShareResource, b7 as ShareSaveOptions, b8 as ShareSchema, b9 as ShareSqlContentSource, ba as ShareWireAction, bb as SharingService, bc as SharingServiceConfig, bd as SignedDelegation, bf as SpaceOwnership, bS as StoredDelegationChain, bg as VerifyShareEnvelopeOptions, bh as canonicalOwnerSharePolicy, bi as computeOwnerShareRegistrationCid, bj as computeShareCid, bT as createCapabilityKeyRegistry, bk as createDelegatedShareKey, bl as createPolicyEnforcementDelegation, bm as createShareArtifact, bn as createShareArtifactAsync, bo as createSharePolicy, bp as createSharingService, bq as decryptShareBytesAsync, br as delegatePortablePolicySession, bs as encodeInlineShareUrl, bt as encodeShareArtifact, bu as encodeShareUrl, bv as encryptShareBytes, bw as encryptShareBytesAsync, bx as importPortableDelegation, by as intersectShareCapabilities, bz as isV2ShareLink, bA as normalizeShareActions, bB as normalizeShareRecipientTarget, bC as normalizeShareResource, bD as parsePortableDelegation, bE as parseShareArtifact, bF as parseShareUrl, bG as restoreDelegatedShareKey, bH as serializePortableDelegation, bI as shareCapabilityAllows, bJ as signShareEnvelope, bK as validateOwnerSharePolicyRegistration, bL as validateOwnerSharePolicyRegistrationBytes, bM as validateShareDeliveryAuthorizationV3Bytes, bN as verifyShareCid, bO as verifyShareEnvelope } from './recipient-types.schema-lAKNQlxx.cjs';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.cjs';
 export { SiweMessage } from 'siwe';

package/dist/index.d.ts

@@ -4,8 +4,8 @@ export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3I
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, parseSecretCatalogKey, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
-import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aE as ShareLink, be as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-Cz5zJzED.js';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bP as CapabilityKeyRegistry, bQ as CapabilityKeyRegistryErrorCode, bR as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDeliveryAuthorizationV3Receipt, ay as ShareDeliveryAuthorizationV3Request, az as ShareDetachedProof, aA as ShareEnvelopeError, aB as ShareEnvelopeV2, aC as ShareExpiryBounds, aD as ShareKvContentSource, aF as ShareLinkData, aG as ShareLinkLocation, aH as ShareListEntry, aI as ShareListResult, aJ as ShareNativeAction, aK as ShareNativeInvokeEnvelopeV1, aL as ShareNativeInvokeErrorResult, aM as ShareNativeInvokeInput, aN as ShareNativeInvokeResult, aO as ShareNativeInvokeSuccessResult, aP as ShareNativeResponse, aQ as ShareNativeResponseSchema, aR as SharePolicy, aS as SharePolicyBinding, aT as SharePolicySession, aU as SharePolicySessionV1, aV as SharePolicySessionWireV1, aW as SharePortableDelegation, aX as ShareReadInvocationV1, aY as ShareReadResult, aZ as ShareRecipientClient, a_ as ShareRecipientClientOptions, b0 as ShareRecipientPolicy, b2 as ShareRecipientResult, b3 as ShareRecipientTarget, b5 as ShareResource, b7 as ShareSaveOptions, b8 as ShareSchema, b9 as ShareSqlContentSource, ba as ShareWireAction, bb as SharingService, bc as SharingServiceConfig, bd as SignedDelegation, bf as SpaceOwnership, bS as StoredDelegationChain, bg as VerifyShareEnvelopeOptions, bh as canonicalOwnerSharePolicy, bi as computeOwnerShareRegistrationCid, bj as computeShareCid, bT as createCapabilityKeyRegistry, bk as createDelegatedShareKey, bl as createPolicyEnforcementDelegation, bm as createShareArtifact, bn as createShareArtifactAsync, bo as createSharePolicy, bp as createSharingService, bq as decryptShareBytesAsync, br as delegatePortablePolicySession, bs as encodeInlineShareUrl, bt as encodeShareArtifact, bu as encodeShareUrl, bv as encryptShareBytes, bw as encryptShareBytesAsync, bx as importPortableDelegation, by as intersectShareCapabilities, bz as isV2ShareLink, bA as normalizeShareActions, bB as normalizeShareRecipientTarget, bC as normalizeShareResource, bD as parsePortableDelegation, bE as parseShareArtifact, bF as parseShareUrl, bG as restoreDelegatedShareKey, bH as serializePortableDelegation, bI as shareCapabilityAllows, bJ as signShareEnvelope, bK as validateOwnerSharePolicyRegistration, bL as validateOwnerSharePolicyRegistrationBytes, bM as validateShareDeliveryAuthorizationV3Bytes, bN as verifyShareCid, bO as verifyShareEnvelope } from './recipient-types.schema-Cz5zJzED.js';
+import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aE as ShareLink, be as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-lAKNQlxx.js';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bP as CapabilityKeyRegistry, bQ as CapabilityKeyRegistryErrorCode, bR as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDeliveryAuthorizationV3Receipt, ay as ShareDeliveryAuthorizationV3Request, az as ShareDetachedProof, aA as ShareEnvelopeError, aB as ShareEnvelopeV2, aC as ShareExpiryBounds, aD as ShareKvContentSource, aF as ShareLinkData, aG as ShareLinkLocation, aH as ShareListEntry, aI as ShareListResult, aJ as ShareNativeAction, aK as ShareNativeInvokeEnvelopeV1, aL as ShareNativeInvokeErrorResult, aM as ShareNativeInvokeInput, aN as ShareNativeInvokeResult, aO as ShareNativeInvokeSuccessResult, aP as ShareNativeResponse, aQ as ShareNativeResponseSchema, aR as SharePolicy, aS as SharePolicyBinding, aT as SharePolicySession, aU as SharePolicySessionV1, aV as SharePolicySessionWireV1, aW as SharePortableDelegation, aX as ShareReadInvocationV1, aY as ShareReadResult, aZ as ShareRecipientClient, a_ as ShareRecipientClientOptions, b0 as ShareRecipientPolicy, b2 as ShareRecipientResult, b3 as ShareRecipientTarget, b5 as ShareResource, b7 as ShareSaveOptions, b8 as ShareSchema, b9 as ShareSqlContentSource, ba as ShareWireAction, bb as SharingService, bc as SharingServiceConfig, bd as SignedDelegation, bf as SpaceOwnership, bS as StoredDelegationChain, bg as VerifyShareEnvelopeOptions, bh as canonicalOwnerSharePolicy, bi as computeOwnerShareRegistrationCid, bj as computeShareCid, bT as createCapabilityKeyRegistry, bk as createDelegatedShareKey, bl as createPolicyEnforcementDelegation, bm as createShareArtifact, bn as createShareArtifactAsync, bo as createSharePolicy, bp as createSharingService, bq as decryptShareBytesAsync, br as delegatePortablePolicySession, bs as encodeInlineShareUrl, bt as encodeShareArtifact, bu as encodeShareUrl, bv as encryptShareBytes, bw as encryptShareBytesAsync, bx as importPortableDelegation, by as intersectShareCapabilities, bz as isV2ShareLink, bA as normalizeShareActions, bB as normalizeShareRecipientTarget, bC as normalizeShareResource, bD as parsePortableDelegation, bE as parseShareArtifact, bF as parseShareUrl, bG as restoreDelegatedShareKey, bH as serializePortableDelegation, bI as shareCapabilityAllows, bJ as signShareEnvelope, bK as validateOwnerSharePolicyRegistration, bL as validateOwnerSharePolicyRegistrationBytes, bM as validateShareDeliveryAuthorizationV3Bytes, bN as verifyShareCid, bO as verifyShareEnvelope } from './recipient-types.schema-lAKNQlxx.js';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';
 export { SiweMessage } from 'siwe';

package/dist/index.js

@@ -6083,6 +6083,7 @@ var DelegationErrorSchema = z4.object({
 });
 var DelegationErrorCodes = {
   AUTH_REQUIRED: "AUTH_REQUIRED",
+  AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
   AUTH_EXPIRED: "AUTH_EXPIRED",
   NOT_INITIALIZED: "NOT_INITIALIZED",
   NOT_FOUND: "NOT_FOUND",
@@ -10469,6 +10470,13 @@ var ShareRecipientClient = class {
 };
 
 // src/delegations/SharingService.ts
+function spaceIdsEqual(left, right) {
+  const normalizeOwnerAddress = (space) => {
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
+  };
+  return normalizeOwnerAddress(left) === normalizeOwnerAddress(right);
+}
 function inferShortServiceFromActionUrns(actions) {
   let short;
   for (const action of actions) {
@@ -10791,7 +10799,7 @@ var SharingService = class {
     for (const key of allKeys) {
       const delegations = this.registry.getDelegationsForKey(key.id);
       for (const delegation of delegations) {
-        if (delegation.spaceId !== this.session?.spaceId) {
+        if (delegation.spaceId === void 0 || !spaceIdsEqual(delegation.spaceId, this.session?.spaceId ?? "")) {
           continue;
         }
         if ((delegation.caveats?.length ?? 0) > 0) {
@@ -10919,11 +10927,23 @@ var SharingService = class {
           const errorText = await registerRes.text();
           const registrationTextActiveError = this.retiredGraphError();
           if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };
+          const message = `Failed to register delegation with server: ${registerRes.status} ${errorText}`;
+          if (registerRes.status === 401 || registerRes.status === 403) {
+            return {
+              ok: false,
+              error: createError2(
+                DelegationErrorCodes.AUTH_UNAUTHORIZED,
+                message,
+                void 0,
+                { status: registerRes.status }
+              )
+            };
+          }
           return {
             ok: false,
             error: createError2(
               DelegationErrorCodes.CREATION_FAILED,
-              `Failed to register delegation with server: ${registerRes.status} ${errorText}`
+              message
             )
           };
         }