@tinycloud/sdk-core 3.2.2 → 3.2.3

package/dist/index.d.cts

@@ -1,12 +1,12 @@
 import { z } from 'zod';
-import { br as CredentialHolderBinding, bs as CredentialFlowDescriptor, bt as CredentialRequirement, bu as StoredCredentialRecord, bv as VerifiedCredential, bw as CredentialStorageReceipt, bx as IssuedCredentialEnvelope, by as CredentialIssuerMetadata } from './credential-admission-1EOQgdzY.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bz as CREDENTIAL_ACQUISITION_PROTOCOL, bA as CREDENTIAL_CONTRACT_VERSION, bB as CREDENTIAL_FORMAT, bz as CREDENTIAL_PROTOCOL, bC as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bD as CredentialClaimDescriptor, bE as CredentialEndpointId, bF as CredentialInputDescriptor, bG as CredentialProgressEvent, bH as CredentialStepDescriptor, bI as CredentialStepType, bJ as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bK as HOLDER_BINDING_DOMAIN, bL as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from './credential-admission-1EOQgdzY.cjs';
+import { br as CredentialHolderBinding, bs as CredentialFlowDescriptor, bt as CredentialRequirement, bu as StoredCredentialRecord, bv as VerifiedCredential, bw as CredentialStorageReceipt, bx as IssuedCredentialEnvelope, by as CredentialIssuerMetadata } from './credential-admission-CaWVn8yO.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bz as CREDENTIAL_ACQUISITION_PROTOCOL, bA as CREDENTIAL_CONTRACT_VERSION, bB as CREDENTIAL_FORMAT, bz as CREDENTIAL_PROTOCOL, bC as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bD as CredentialClaimDescriptor, bE as CredentialEndpointId, bF as CredentialInputDescriptor, bG as CredentialProgressEvent, bH as CredentialStepDescriptor, bI as CredentialStepType, bJ as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bK as HOLDER_BINDING_DOMAIN, bL as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from './credential-admission-CaWVn8yO.cjs';
 export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { AuthorityRefusal, AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, IStorageService, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListPage, KVListResponse, KVPutOptions, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PinnedKey, PrefixedKVService, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGrantInfo, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedReplicationOptions, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageFullHandler, StorageFullMonitor, StorageRejectionDetails, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, appSecretScope, authorizationVerdictOf, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, isStorageFullError, networkDiscoveryKey, ok, openWrappedKey, parseCapabilityResource, parseNetworkId, parseSecretCatalogKey, parseStorageRejection, parseStorageStatus, resolveSecretListPrefix, resolveSecretPath, serviceError, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validatedCapabilityOf, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
-import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-D-IMys0b.cjs';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-D-IMys0b.cjs';
+import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-D7YiY246.cjs';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-D7YiY246.cjs';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.cjs';
 export { SiweMessage } from 'siwe';
@@ -110,23 +110,23 @@ declare const ClientSessionSchema: z.ZodObject<{
         avatarUrl?: string | null | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
+    signature: string;
     chainId: number;
     address: string;
     walletAddress: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
     ens?: {
         domain?: string | null | undefined;
         avatarUrl?: string | null | undefined;
     } | undefined;
 }, {
+    signature: string;
     chainId: number;
     address: string;
     walletAddress: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
     ens?: {
         domain?: string | null | undefined;
         avatarUrl?: string | null | undefined;
@@ -1046,6 +1046,32 @@ declare function principalDidEquals(a: string, b: string): boolean;
 declare function didCacheKey(input: string, options?: DidCacheKeyOptions): string;
 declare function makePkhSpaceId(address: string, chainId: number, name: string): string;
 
+type ReCapAttenuation = Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;
+/** A wallet-signed SIWE CACAO whose encoding, signature and exact-bytes CID were verified. */
+interface SignedSiweCacao {
+    readonly cid: string;
+    /** Signer, `did:pkh:eip155:<chain>:<address>`. */
+    readonly issuer: string;
+    /** SIWE `uri`: the delegate DID, or `ucan:<cid>` for a revocation. */
+    readonly audience: string;
+    /** The ReCap (last SIWE resource) attenuation, checked against the statement. Null-prototype maps. */
+    readonly attenuation: ReCapAttenuation;
+    /** SIWE `Expiration Time` as signed. Reported only: the caller decides whether it matters. */
+    readonly expiresAt?: string;
+}
+/**
+ * Verify a base64url DAG-CBOR SIWE CACAO (a wallet-signed delegation or
+ * revocation) and return what it signs. Checks: size and nesting limits, the
+ * exact-bytes CID, canonical DAG-CBOR (so one signature has one CID), the
+ * CACAO shape, the ReCap statement, and the EIP-191 signature over the
+ * EIP-4361 message rebuilt from the payload, against the `did:pkh` issuer.
+ * Throws when any check fails.
+ *
+ * Validity times are not checked: `expiresAt` is reported for the caller to
+ * judge, and `Not Before` is only covered by the signature.
+ */
+declare function parseSignedSiweCacao(authorization: string, expectedCid?: string): Promise<SignedSiweCacao>;
+
 interface CanonicalParsedNetworkId extends ParsedNetworkId {
     /** Owner DID canonicalized with TinyCloud identity rules. */
     ownerDid: string;
@@ -1187,12 +1213,12 @@ declare const PersistedSessionDataSchema: z.ZodObject<{
      */
     tinycloudHosts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
+    expiresAt: string;
+    signature: string;
     chainId: number;
     address: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
-    expiresAt: string;
     version: string;
     createdAt: string;
     ens?: {
@@ -1210,12 +1236,12 @@ declare const PersistedSessionDataSchema: z.ZodObject<{
     } | undefined;
     tinycloudHosts?: string[] | undefined;
 }, {
+    expiresAt: string;
+    signature: string;
     chainId: number;
     address: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
-    expiresAt: string;
     version: string;
     createdAt: string;
     ens?: {
@@ -1269,15 +1295,15 @@ declare const TinyCloudSessionSchema: z.ZodObject<{
     /** User's signature of the SIWE message */
     signature: z.ZodString;
 }, "strip", z.ZodTypeAny, {
+    signature: string;
+    spaceId: string;
     chainId: number;
     address: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
     jwk: {} & {
         [k: string]: unknown;
     };
-    spaceId: string;
     delegationHeader: {
         Authorization: string;
     };
@@ -1285,15 +1311,15 @@ declare const TinyCloudSessionSchema: z.ZodObject<{
     verificationMethod: string;
     spaces?: Record<string, string> | undefined;
 }, {
+    signature: string;
+    spaceId: string;
     chainId: number;
     address: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
     jwk: {} & {
         [k: string]: unknown;
     };
-    spaceId: string;
     delegationHeader: {
         Authorization: string;
     };
@@ -3543,4 +3569,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, type SignedSiweCacao, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSignedSiweCacao, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };

package/dist/index.d.ts

@@ -1,12 +1,12 @@
 import { z } from 'zod';
-import { br as CredentialHolderBinding, bs as CredentialFlowDescriptor, bt as CredentialRequirement, bu as StoredCredentialRecord, bv as VerifiedCredential, bw as CredentialStorageReceipt, bx as IssuedCredentialEnvelope, by as CredentialIssuerMetadata } from './credential-admission-CJ1ZPqcx.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bz as CREDENTIAL_ACQUISITION_PROTOCOL, bA as CREDENTIAL_CONTRACT_VERSION, bB as CREDENTIAL_FORMAT, bz as CREDENTIAL_PROTOCOL, bC as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bD as CredentialClaimDescriptor, bE as CredentialEndpointId, bF as CredentialInputDescriptor, bG as CredentialProgressEvent, bH as CredentialStepDescriptor, bI as CredentialStepType, bJ as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bK as HOLDER_BINDING_DOMAIN, bL as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from './credential-admission-CJ1ZPqcx.js';
+import { br as CredentialHolderBinding, bs as CredentialFlowDescriptor, bt as CredentialRequirement, bu as StoredCredentialRecord, bv as VerifiedCredential, bw as CredentialStorageReceipt, bx as IssuedCredentialEnvelope, by as CredentialIssuerMetadata } from './credential-admission-CqXwBvDS.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bz as CREDENTIAL_ACQUISITION_PROTOCOL, bA as CREDENTIAL_CONTRACT_VERSION, bB as CREDENTIAL_FORMAT, bz as CREDENTIAL_PROTOCOL, bC as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bD as CredentialClaimDescriptor, bE as CredentialEndpointId, bF as CredentialInputDescriptor, bG as CredentialProgressEvent, bH as CredentialStepDescriptor, bI as CredentialStepType, bJ as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bK as HOLDER_BINDING_DOMAIN, bL as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from './credential-admission-CqXwBvDS.js';
 export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { AuthorityRefusal, AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, IStorageService, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListPage, KVListResponse, KVPutOptions, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PinnedKey, PrefixedKVService, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGrantInfo, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedReplicationOptions, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageFullHandler, StorageFullMonitor, StorageRejectionDetails, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, appSecretScope, authorizationVerdictOf, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, isStorageFullError, networkDiscoveryKey, ok, openWrappedKey, parseCapabilityResource, parseNetworkId, parseSecretCatalogKey, parseStorageRejection, parseStorageStatus, resolveSecretListPrefix, resolveSecretPath, serviceError, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validatedCapabilityOf, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
-import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-D-IMys0b.js';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-D-IMys0b.js';
+import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-D7YiY246.js';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-D7YiY246.js';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';
 export { SiweMessage } from 'siwe';
@@ -110,23 +110,23 @@ declare const ClientSessionSchema: z.ZodObject<{
         avatarUrl?: string | null | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
+    signature: string;
     chainId: number;
     address: string;
     walletAddress: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
     ens?: {
         domain?: string | null | undefined;
         avatarUrl?: string | null | undefined;
     } | undefined;
 }, {
+    signature: string;
     chainId: number;
     address: string;
     walletAddress: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
     ens?: {
         domain?: string | null | undefined;
         avatarUrl?: string | null | undefined;
@@ -1046,6 +1046,32 @@ declare function principalDidEquals(a: string, b: string): boolean;
 declare function didCacheKey(input: string, options?: DidCacheKeyOptions): string;
 declare function makePkhSpaceId(address: string, chainId: number, name: string): string;
 
+type ReCapAttenuation = Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;
+/** A wallet-signed SIWE CACAO whose encoding, signature and exact-bytes CID were verified. */
+interface SignedSiweCacao {
+    readonly cid: string;
+    /** Signer, `did:pkh:eip155:<chain>:<address>`. */
+    readonly issuer: string;
+    /** SIWE `uri`: the delegate DID, or `ucan:<cid>` for a revocation. */
+    readonly audience: string;
+    /** The ReCap (last SIWE resource) attenuation, checked against the statement. Null-prototype maps. */
+    readonly attenuation: ReCapAttenuation;
+    /** SIWE `Expiration Time` as signed. Reported only: the caller decides whether it matters. */
+    readonly expiresAt?: string;
+}
+/**
+ * Verify a base64url DAG-CBOR SIWE CACAO (a wallet-signed delegation or
+ * revocation) and return what it signs. Checks: size and nesting limits, the
+ * exact-bytes CID, canonical DAG-CBOR (so one signature has one CID), the
+ * CACAO shape, the ReCap statement, and the EIP-191 signature over the
+ * EIP-4361 message rebuilt from the payload, against the `did:pkh` issuer.
+ * Throws when any check fails.
+ *
+ * Validity times are not checked: `expiresAt` is reported for the caller to
+ * judge, and `Not Before` is only covered by the signature.
+ */
+declare function parseSignedSiweCacao(authorization: string, expectedCid?: string): Promise<SignedSiweCacao>;
+
 interface CanonicalParsedNetworkId extends ParsedNetworkId {
     /** Owner DID canonicalized with TinyCloud identity rules. */
     ownerDid: string;
@@ -1187,12 +1213,12 @@ declare const PersistedSessionDataSchema: z.ZodObject<{
      */
     tinycloudHosts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
+    expiresAt: string;
+    signature: string;
     chainId: number;
     address: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
-    expiresAt: string;
     version: string;
     createdAt: string;
     ens?: {
@@ -1210,12 +1236,12 @@ declare const PersistedSessionDataSchema: z.ZodObject<{
     } | undefined;
     tinycloudHosts?: string[] | undefined;
 }, {
+    expiresAt: string;
+    signature: string;
     chainId: number;
     address: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
-    expiresAt: string;
     version: string;
     createdAt: string;
     ens?: {
@@ -1269,15 +1295,15 @@ declare const TinyCloudSessionSchema: z.ZodObject<{
     /** User's signature of the SIWE message */
     signature: z.ZodString;
 }, "strip", z.ZodTypeAny, {
+    signature: string;
+    spaceId: string;
     chainId: number;
     address: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
     jwk: {} & {
         [k: string]: unknown;
     };
-    spaceId: string;
     delegationHeader: {
         Authorization: string;
     };
@@ -1285,15 +1311,15 @@ declare const TinyCloudSessionSchema: z.ZodObject<{
     verificationMethod: string;
     spaces?: Record<string, string> | undefined;
 }, {
+    signature: string;
+    spaceId: string;
     chainId: number;
     address: string;
     sessionKey: string;
     siwe: string;
-    signature: string;
     jwk: {} & {
         [k: string]: unknown;
     };
-    spaceId: string;
     delegationHeader: {
         Authorization: string;
     };
@@ -3543,4 +3569,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, type SignedSiweCacao, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSignedSiweCacao, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };