@tinycloud/cli 0.8.1 → 0.8.2-beta.1

package/dist/index.js

@@ -99,10 +99,10 @@ import ora from "ora";
 function outputJson(data) {
   process.stdout.write(JSON.stringify(data, null, 2) + "\n");
 }
-function outputError(code2, message, hint) {
+function outputError(code, message, hint) {
   if (isInteractive()) {
     process.stderr.write(
-      `${theme.error("\u2717")} ${theme.label(code2)}: ${message}
+      `${theme.error("\u2717")} ${theme.label(code)}: ${message}
 `
     );
     if (hint) {
@@ -113,7 +113,7 @@ function outputError(code2, message, hint) {
     }
   } else {
     const payload = {
-      error: { code: code2, message }
+      error: { code, message }
     };
     if (hint) payload.error.hint = hint;
     process.stderr.write(JSON.stringify(payload, null, 2) + "\n");
@@ -300,9 +300,9 @@ var init_errors = __esm({
     init_constants();
     init_formatter();
     CLIError = class extends Error {
-      constructor(code2, message, exitCode = ExitCode.ERROR, metadata) {
+      constructor(code, message, exitCode = ExitCode.ERROR, metadata) {
         super(message);
-        this.code = code2;
+        this.code = code;
         this.exitCode = exitCode;
         this.metadata = metadata;
         this.name = "CLIError";
@@ -10372,6 +10372,123 @@ var init_ed25519 = __esm({
   }
 });
 
+// ../../node_modules/ms/index.js
+var require_ms = __commonJS({
+  "../../node_modules/ms/index.js"(exports, module) {
+    "use strict";
+    var s = 1e3;
+    var m = s * 60;
+    var h = m * 60;
+    var d = h * 24;
+    var w = d * 7;
+    var y = d * 365.25;
+    module.exports = function(val, options) {
+      options = options || {};
+      var type = typeof val;
+      if (type === "string" && val.length > 0) {
+        return parse(val);
+      } else if (type === "number" && isFinite(val)) {
+        return options.long ? fmtLong(val) : fmtShort(val);
+      }
+      throw new Error(
+        "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
+      );
+    };
+    function parse(str) {
+      str = String(str);
+      if (str.length > 100) {
+        return;
+      }
+      var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
+        str
+      );
+      if (!match) {
+        return;
+      }
+      var n = parseFloat(match[1]);
+      var type = (match[2] || "ms").toLowerCase();
+      switch (type) {
+        case "years":
+        case "year":
+        case "yrs":
+        case "yr":
+        case "y":
+          return n * y;
+        case "weeks":
+        case "week":
+        case "w":
+          return n * w;
+        case "days":
+        case "day":
+        case "d":
+          return n * d;
+        case "hours":
+        case "hour":
+        case "hrs":
+        case "hr":
+        case "h":
+          return n * h;
+        case "minutes":
+        case "minute":
+        case "mins":
+        case "min":
+        case "m":
+          return n * m;
+        case "seconds":
+        case "second":
+        case "secs":
+        case "sec":
+        case "s":
+          return n * s;
+        case "milliseconds":
+        case "millisecond":
+        case "msecs":
+        case "msec":
+        case "ms":
+          return n;
+        default:
+          return void 0;
+      }
+    }
+    function fmtShort(ms3) {
+      var msAbs = Math.abs(ms3);
+      if (msAbs >= d) {
+        return Math.round(ms3 / d) + "d";
+      }
+      if (msAbs >= h) {
+        return Math.round(ms3 / h) + "h";
+      }
+      if (msAbs >= m) {
+        return Math.round(ms3 / m) + "m";
+      }
+      if (msAbs >= s) {
+        return Math.round(ms3 / s) + "s";
+      }
+      return ms3 + "ms";
+    }
+    function fmtLong(ms3) {
+      var msAbs = Math.abs(ms3);
+      if (msAbs >= d) {
+        return plural2(ms3, msAbs, d, "day");
+      }
+      if (msAbs >= h) {
+        return plural2(ms3, msAbs, h, "hour");
+      }
+      if (msAbs >= m) {
+        return plural2(ms3, msAbs, m, "minute");
+      }
+      if (msAbs >= s) {
+        return plural2(ms3, msAbs, s, "second");
+      }
+      return ms3 + " ms";
+    }
+    function plural2(ms3, msAbs, n, name2) {
+      var isPlural = msAbs >= n * 1.5;
+      return Math.round(ms3 / n) + " " + name2 + (isPlural ? "s" : "");
+    }
+  }
+});
+
 // ../sdk-services/dist/internal/decrypt-transport-response-error.cjs
 var require_decrypt_transport_response_error = __commonJS({
   "../sdk-services/dist/internal/decrypt-transport-response-error.cjs"(exports, module) {
@@ -10416,9 +10533,9 @@ function ok(data) {
 function err(error) {
   return { ok: false, error };
 }
-function serviceError(code2, message, service, options) {
+function serviceError(code, message, service, options) {
   return {
-    code: code2,
+    code,
     message,
     service,
     cause: options?.cause,
@@ -11647,16 +11764,16 @@ function ensureNetworkUsableForDecrypt(descriptor) {
     })
   };
 }
-function encryptToNetwork(crypto22, input) {
+function encryptToNetwork(crypto23, input) {
   parseNetworkId(input.networkId);
   const alg = input.alg ?? DEFAULT_ENCRYPTION_ALG;
   const keyVersion = input.keyVersion ?? DEFAULT_KEY_VERSION;
-  const symmetricKey = crypto22.randomBytes(32);
-  const ciphertext = crypto22.authEncrypt(symmetricKey, input.plaintext, input.aad);
-  const wrapped = crypto22.sealToNetworkKey(input.networkPublicKey, symmetricKey);
+  const symmetricKey = crypto23.randomBytes(32);
+  const ciphertext = crypto23.authEncrypt(symmetricKey, input.plaintext, input.aad);
+  const wrapped = crypto23.sealToNetworkKey(input.networkPublicKey, symmetricKey);
   const encryptedSymmetricKey = base64Encode2(wrapped);
   const encryptedSymmetricKeyHash = canonicalHashHex(
-    crypto22.sha256,
+    crypto23.sha256,
     encryptedSymmetricKey
   );
   const envelope = {
@@ -11672,7 +11789,7 @@ function encryptToNetwork(crypto22, input) {
   };
   return { envelope, symmetricKey };
 }
-function validateEnvelope(crypto22, envelope) {
+function validateEnvelope(crypto23, envelope) {
   if (envelope === null || typeof envelope !== "object") {
     return {
       ok: false,
@@ -11728,7 +11845,7 @@ function validateEnvelope(crypto22, envelope) {
       })
     };
   }
-  const expectedHash = canonicalHashHex(crypto22.sha256, e.encryptedSymmetricKey);
+  const expectedHash = canonicalHashHex(crypto23.sha256, e.encryptedSymmetricKey);
   if (expectedHash !== e.encryptedSymmetricKeyHash) {
     return {
       ok: false,
@@ -11740,10 +11857,10 @@ function validateEnvelope(crypto22, envelope) {
   }
   return { ok: true, data: e };
 }
-function decryptEnvelopeWithKey(crypto22, envelope, symmetricKey) {
+function decryptEnvelopeWithKey(crypto23, envelope, symmetricKey) {
   const ciphertext = base64Decode2(envelope.ciphertext);
   const aad = envelope.aad !== void 0 ? base64Decode2(envelope.aad) : void 0;
-  return crypto22.authDecrypt(symmetricKey, ciphertext, aad);
+  return crypto23.authDecrypt(symmetricKey, ciphertext, aad);
 }
 function buildCanonicalDecryptRequest(input) {
   const canonicalBody = canonicalize(input.body);
@@ -11777,7 +11894,7 @@ function buildDecryptFacts(input) {
     keyVersion: input.body.keyVersion
   };
 }
-function checkDecryptInvocationInput(crypto22, input) {
+function checkDecryptInvocationInput(crypto23, input) {
   if (input.body.type !== DECRYPT_FACT_TYPE) {
     return {
       ok: false,
@@ -11882,7 +11999,7 @@ function checkDecryptInvocationInput(crypto22, input) {
   const canonicalBody = canonicalize(
     input.body
   );
-  const expectedBodyHash = canonicalHashHex(crypto22.sha256, input.body);
+  const expectedBodyHash = canonicalHashHex(crypto23.sha256, input.body);
   if (expectedBodyHash !== input.facts.bodyHash) {
     return {
       ok: false,
@@ -11894,8 +12011,8 @@ function checkDecryptInvocationInput(crypto22, input) {
   }
   return { ok: true, data: input, canonicalBody };
 }
-async function buildDecryptInvocation(crypto22, signer, input) {
-  const checked = checkDecryptInvocationInput(crypto22, input);
+async function buildDecryptInvocation(crypto23, signer, input) {
+  const checked = checkDecryptInvocationInput(crypto23, input);
   if (!checked.ok) {
     return checked;
   }
@@ -11940,7 +12057,7 @@ function canonicalSignedResponse(response) {
   return canonicalize(rest);
 }
 function verifyDecryptResponse(input) {
-  const { crypto: crypto22, request, facts, invocationCid, requestBodyHash, response } = input;
+  const { crypto: crypto23, request, facts, invocationCid, requestBodyHash, response } = input;
   if (response.type !== DECRYPT_RESULT_TYPE) {
     return {
       ok: false,
@@ -12023,7 +12140,7 @@ function verifyDecryptResponse(input) {
     };
   }
   const expectedRequestHash = hexEncode2(
-    crypto22.sha256(utf8Encode(`${invocationCid}${requestBodyHash}`))
+    crypto23.sha256(utf8Encode(`${invocationCid}${requestBodyHash}`))
   );
   if (response.requestHash !== expectedRequestHash) {
     return {
@@ -12047,7 +12164,7 @@ function verifyDecryptResponse(input) {
     canonicalSignedResponse(response)
   );
   const signatureBytes = base64Decode2(response.nodeSignature);
-  if (!crypto22.verifyNodeSignature(response.nodeId, signedBytes, signatureBytes)) {
+  if (!crypto23.verifyNodeSignature(response.nodeId, signedBytes, signatureBytes)) {
     return {
       ok: false,
       error: encryptionError({
@@ -12057,9 +12174,9 @@ function verifyDecryptResponse(input) {
   }
   return { ok: true, data: response };
 }
-function openWrappedKey(crypto22, receiverPrivateKey, response) {
+function openWrappedKey(crypto23, receiverPrivateKey, response) {
   const wrapped = base64Decode2(response.wrappedKey);
-  return crypto22.openWithReceiverKey(receiverPrivateKey, wrapped);
+  return crypto23.openWithReceiverKey(receiverPrivateKey, wrapped);
 }
 function encOk(data) {
   return { ok: true, data };
@@ -12067,7 +12184,7 @@ function encOk(data) {
 function encErr(error) {
   return { ok: false, error };
 }
-var import_decrypt_transport_response_error, import_decrypt_transport_response_error2, import_decrypt_transport_response_error3, ErrorCodes, defaultRetryPolicy, TelemetryEvents, REDACTED, SAFE_NUMBER_FIELDS, SAFE_BOOLEAN_FIELDS, DEBUG_FLAG, MAX_EVENTS, TinyCloudDebugLogger, tinyCloudDebugLogger, ServiceErrorSchema, GenericResultSchema, KVResponseHeadersSchema, GenericKVResponseSchema, KVListResponseSchema, KVListResultSchema, ServiceRequestEventSchema, ServiceResponseEventSchema, ServiceErrorEventSchema, ServiceRetryEventSchema, TelemetrySpanEventSchema, RetryPolicySchema, ServiceSessionSchema, BaseService, PrefixedKVService, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, KVAction, KVService, SQLMigrations, DatabaseHandle, SQLAction, DDL_TOKENS, MIGRATIONS_TABLE, MIGRATIONS_SCHEMA, MIGRATIONS_META_NAMESPACE, MIGRATIONS_META_ID, SQLService, DuckDbDatabaseHandle, DuckDbAction, DuckDbService, AsyncQueue, HooksService, VaultVersionConfig, CURRENT_VAULT_VERSION, VaultHeaders, DB_NAME, DB_VERSION, STORE_NAME, WRAP_KEY_ID, DataVaultService, SECRET_NAME_RE, SECRET_PREFIX, SCOPED_SECRET_PREFIX, RESERVED_SECRET_SCOPES, HEX, URN_PREFIX, NETWORK_NAME_RE, PKH_EIP155_DID_RE, NetworkIdError, DEFAULT_ENCRYPTION_ALG, ENVELOPE_VERSION, DEFAULT_KEY_VERSION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, EncryptionService;
+var import_decrypt_transport_response_error, import_decrypt_transport_response_error2, import_decrypt_transport_response_error3, ErrorCodes, defaultRetryPolicy, TelemetryEvents, REDACTED, SAFE_NUMBER_FIELDS, SAFE_BOOLEAN_FIELDS, DEBUG_FLAG, MAX_EVENTS, TinyCloudDebugLogger, tinyCloudDebugLogger, ServiceErrorSchema, GenericResultSchema, KVResponseHeadersSchema, GenericKVResponseSchema, KVListResponseSchema, KVListResultSchema, ServiceRequestEventSchema, ServiceResponseEventSchema, ServiceErrorEventSchema, ServiceRetryEventSchema, TelemetrySpanEventSchema, RetryPolicySchema, ServiceSessionSchema, BaseService, PrefixedKVService, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, KVAction, MAX_KV_BATCH_READ_ITEMS, KVService, SQLMigrations, DatabaseHandle, SQLAction, DDL_TOKENS, MIGRATIONS_TABLE, MIGRATIONS_SCHEMA, MIGRATIONS_META_NAMESPACE, MIGRATIONS_META_ID, SQLService, DuckDbDatabaseHandle, DuckDbAction, DuckDbService, AsyncQueue, HooksService, VaultVersionConfig, CURRENT_VAULT_VERSION, VaultHeaders, DB_NAME, DB_VERSION, STORE_NAME, WRAP_KEY_ID, DataVaultService, SECRET_NAME_RE, SECRET_PREFIX, SCOPED_SECRET_PREFIX, RESERVED_SECRET_SCOPES, HEX, URN_PREFIX, NETWORK_NAME_RE, PKH_EIP155_DID_RE, NetworkIdError, DEFAULT_ENCRYPTION_ALG, ENVELOPE_VERSION, DEFAULT_KEY_VERSION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, EncryptionService;
 var init_dist2 = __esm({
   "../sdk-services/dist/index.js"() {
     "use strict";
@@ -12285,7 +12402,9 @@ var init_dist2 = __esm({
     GenericKVResponseSchema = createKVResponseSchema(external_exports.unknown());
     KVListResponseSchema = external_exports.object({
       /** Array of keys matching the list criteria */
-      keys: external_exports.array(external_exports.string())
+      keys: external_exports.array(external_exports.string()),
+      truncated: external_exports.boolean().optional(),
+      nextCursor: external_exports.string().optional()
     });
     KVListResultSchema = createResultSchema(KVListResponseSchema);
     ServiceRequestEventSchema = external_exports.object({
@@ -12585,6 +12704,20 @@ var init_dist2 = __esm({
         const fullKey = this.getFullKey(key);
         return this._kv.get(fullKey, { ...options, prefix: "" });
       }
+      async batchGet(keys, options) {
+        const response = await this._kv.batchGet(
+          keys.map((key) => this.getFullKey(key)),
+          { ...options, prefix: "" }
+        );
+        if (!response.ok) return response;
+        return ok({
+          ...response.data,
+          results: response.data.results.map((item, index) => ({
+            ...item,
+            key: keys[index]
+          }))
+        });
+      }
       /**
        * Store a value at a key.
        */
@@ -12629,6 +12762,20 @@ var init_dist2 = __esm({
         const fullKey = this.getFullKey(key);
         return this._kv.head(fullKey, { ...options, prefix: "" });
       }
+      async batchHead(keys, options) {
+        const response = await this._kv.batchHead(
+          keys.map((key) => this.getFullKey(key)),
+          { ...options, prefix: "" }
+        );
+        if (!response.ok) return response;
+        return ok({
+          ...response.data,
+          results: response.data.results.map((item, index) => ({
+            ...item,
+            key: keys[index]
+          }))
+        });
+      }
       /**
        * Create a short-lived signed URL for reading a KV object.
        */
@@ -12653,6 +12800,7 @@ var init_dist2 = __esm({
       DELETE: "tinycloud.kv/del",
       HEAD: "tinycloud.kv/metadata"
     };
+    MAX_KV_BATCH_READ_ITEMS = 100;
     KVService = class extends BaseService {
       /**
        * Create a new KVService instance.
@@ -12881,6 +13029,173 @@ var init_dist2 = __esm({
           get: (name2) => headers.get(name2)
         };
       }
+      createBatchResponseHeaders(values) {
+        const normalized = new Map(
+          Object.entries(values).map(([name2, value]) => [name2.toLowerCase(), value])
+        );
+        return this.createResponseHeaders({
+          get: (name2) => normalized.get(name2.toLowerCase()) ?? null
+        });
+      }
+      parseBatchValue(dataBase64, headers, raw = false, binary = false) {
+        const encoded = globalThis.atob(dataBase64);
+        const bytes = Uint8Array.from(encoded, (character) => character.charCodeAt(0));
+        if (binary) return bytes;
+        const text = new TextDecoder().decode(bytes);
+        if (raw) return text;
+        const contentType = Object.entries(headers).find(
+          ([name2]) => name2.toLowerCase() === "content-type"
+        )?.[1];
+        return contentType?.includes("application/json") ? JSON.parse(text) : text;
+      }
+      normalizeBatchReadResponse(data, paths, requireData) {
+        if (!data || typeof data !== "object") return void 0;
+        const response = data;
+        if (!Array.isArray(response.results) || response.results.length !== paths.length) {
+          return void 0;
+        }
+        for (let index = 0; index < response.results.length; index++) {
+          const item = response.results[index];
+          if (!item || typeof item !== "object" || item.key !== paths[index] || typeof item.ok !== "boolean") {
+            return void 0;
+          }
+          if (item.ok && (!item.headers || typeof item.headers !== "object" || Object.values(item.headers).some((value) => typeof value !== "string") || requireData && typeof item.dataBase64 !== "string")) {
+            return void 0;
+          }
+          if (!item.ok && (!item.error || typeof item.error.code !== "string" || typeof item.error.message !== "string")) {
+            return void 0;
+          }
+        }
+        return response;
+      }
+      async batchRead(keys, action, options) {
+        if (!this.requireAuth()) return err(authRequiredError("kv"));
+        if (keys.length === 0) return ok({ results: [], count: 0 });
+        if (keys.length > MAX_KV_BATCH_READ_ITEMS) {
+          return err(serviceError(
+            ErrorCodes.INVALID_INPUT,
+            `KV batch reads accept at most ${MAX_KV_BATCH_READ_ITEMS} keys`,
+            "kv"
+          ));
+        }
+        if (keys.length === 1) {
+          const key = keys[0];
+          const result = action === KVAction.GET ? await this.get(key, options) : await this.head(key, options);
+          return ok({
+            results: [{ key, result }],
+            count: 1
+          });
+        }
+        if (!this.context.invokeAny) {
+          return err(serviceError(
+            ErrorCodes.INVALID_INPUT,
+            "KV batch reads require SDK runtime support for multi-resource invocations",
+            "kv"
+          ));
+        }
+        const getOptions = action === KVAction.GET ? options : void 0;
+        if (getOptions?.maxResponseBytes !== void 0 && (!Number.isSafeInteger(getOptions.maxResponseBytes) || getOptions.maxResponseBytes <= 0)) {
+          return err(serviceError(
+            ErrorCodes.INVALID_INPUT,
+            "KV maxResponseBytes must be a positive safe integer",
+            "kv"
+          ));
+        }
+        const paths = keys.map((key) => this.getFullPath(key, options?.prefix));
+        if (new Set(paths).size !== paths.length) {
+          return err(serviceError(
+            ErrorCodes.INVALID_INPUT,
+            "KV batch read received duplicate keys after prefix resolution",
+            "kv"
+          ));
+        }
+        try {
+          const session = this.context.session;
+          const invocationHeaders = this.context.invokeAny(
+            session,
+            paths.map((path) => ({
+              spaceId: session.spaceId,
+              service: "kv",
+              path,
+              action
+            }))
+          );
+          const limitHeaders = {};
+          if (getOptions?.maxResponseBytes !== void 0) {
+            limitHeaders["x-tinycloud-max-response-bytes"] = String(
+              getOptions.maxResponseBytes
+            );
+          }
+          const headers = Array.isArray(invocationHeaders) ? [...invocationHeaders, ...Object.entries(limitHeaders)] : { ...invocationHeaders, ...limitHeaders };
+          const response = await this.context.fetch(`${this.host}/invoke`, {
+            method: "POST",
+            headers,
+            signal: this.combineSignals(options?.signal)
+          });
+          if (!response.ok) {
+            const errorText = await response.text();
+            if (response.status === 401 || response.status === 403) {
+              const { resource, action: requiredAction } = parseAuthError(errorText);
+              return err(authUnauthorizedError("kv", errorText, {
+                status: response.status,
+                ...requiredAction && { requiredAction },
+                ...resource && { resource }
+              }));
+            }
+            if (response.status === 413) {
+              return err(serviceError(
+                ErrorCodes.KV_RESPONSE_TOO_LARGE,
+                "A KV batch value exceeds the requested response limit",
+                "kv",
+                { meta: { status: response.status, statusText: response.statusText } }
+              ));
+            }
+            return err(serviceError(
+              ErrorCodes.NETWORK_ERROR,
+              `Failed to batch read ${keys.length} key(s): ${response.status} - ${errorText}`,
+              "kv",
+              { meta: { status: response.status, statusText: response.statusText } }
+            ));
+          }
+          const payload = this.normalizeBatchReadResponse(
+            await response.json(),
+            paths,
+            action === KVAction.GET
+          );
+          if (!payload) {
+            return err(serviceError(
+              ErrorCodes.NETWORK_ERROR,
+              "KV batch read response did not match the requested keys",
+              "kv"
+            ));
+          }
+          const results = payload.results.map((item, index) => {
+            if (!item.ok) {
+              return {
+                key: keys[index],
+                result: err(serviceError(item.error.code, item.error.message, "kv"))
+              };
+            }
+            const headers2 = item.headers;
+            const data = action === KVAction.HEAD ? void 0 : this.parseBatchValue(
+              item.dataBase64,
+              headers2,
+              getOptions?.raw,
+              getOptions?.binary
+            );
+            return {
+              key: keys[index],
+              result: ok({
+                data,
+                headers: this.createBatchResponseHeaders(headers2)
+              })
+            };
+          });
+          return ok({ results, count: results.length });
+        } catch (error) {
+          return err(wrapError2("kv", error));
+        }
+      }
       /**
        * Parse response body based on content type.
        *
@@ -12931,10 +13246,10 @@ var init_dist2 = __esm({
             ...resource && { resource }
           }));
         }
-        const code2 = response.status === 400 ? ErrorCodes.INVALID_INPUT : ErrorCodes.NETWORK_ERROR;
+        const code = response.status === 400 ? ErrorCodes.INVALID_INPUT : ErrorCodes.NETWORK_ERROR;
         return err(
           serviceError(
-            code2,
+            code,
             `Failed to create signed read URL for key "${key}": ${response.status} - ${errorText}`,
             "kv",
             { meta: { status: response.status, statusText: response.statusText } }
@@ -13027,6 +13342,13 @@ var init_dist2 = __esm({
           }
         });
       }
+      async batchGet(keys, options) {
+        return this.withTelemetry(
+          "batchGet",
+          String(keys.length),
+          () => this.batchRead(keys, KVAction.GET, options)
+        );
+      }
       /**
        * Store a value at a key.
        */
@@ -13234,7 +13556,10 @@ var init_dist2 = __esm({
               KVAction.LIST,
               void 0,
               options?.signal,
-              options?.limit === void 0 ? void 0 : { "x-tinycloud-limit": String(options.limit) }
+              options?.limit === void 0 && options?.cursor === void 0 ? void 0 : {
+                ...options?.limit === void 0 ? {} : { "x-tinycloud-limit": String(options.limit) },
+                ...options?.cursor === void 0 ? {} : { "x-tinycloud-cursor": options.cursor }
+              }
             );
             if (!response.ok) {
               if (response.status === 401) {
@@ -13266,7 +13591,8 @@ var init_dist2 = __esm({
             }
             return ok({
               keys,
-              ...response.headers.get("x-tinycloud-truncated") === null ? {} : { truncated: response.headers.get("x-tinycloud-truncated") === "true" }
+              ...response.headers.get("x-tinycloud-truncated") === null ? {} : { truncated: response.headers.get("x-tinycloud-truncated") === "true" },
+              ...response.headers.get("x-tinycloud-next-cursor") === null ? {} : { nextCursor: response.headers.get("x-tinycloud-next-cursor") ?? void 0 }
             });
           } catch (error) {
             return err(wrapError2("kv", error));
@@ -13386,6 +13712,13 @@ var init_dist2 = __esm({
           }
         });
       }
+      async batchHead(keys, options) {
+        return this.withTelemetry(
+          "batchHead",
+          String(keys.length),
+          () => this.batchRead(keys, KVAction.HEAD, options)
+        );
+      }
       /**
        * Create a short-lived signed URL for reading a KV object.
        */
@@ -15325,6 +15658,10 @@ var init_dist2 = __esm({
        * @returns Result with array of key names (vault/ prefix stripped)
        */
       async list(options) {
+        const page = await this.listPage(options);
+        return page.ok ? { ok: true, data: page.data.keys } : page;
+      }
+      async listPage(options) {
         return this.withTelemetry("list", options?.prefix, async () => {
           if (!this.isUnlocked) {
             return vaultError({
@@ -15342,7 +15679,9 @@ var init_dist2 = __esm({
             const listPrefix = options?.prefix ? `vault/${options.prefix}` : "vault/";
             const listResult = await this.tc.kv.list({
               prefix: listPrefix,
-              removePrefix: true
+              removePrefix: true,
+              ...options?.limit === void 0 ? {} : { limit: options.limit },
+              ...options?.cursor === void 0 ? {} : { cursor: options.cursor }
             });
             if (!listResult.ok) {
               return vaultError({
@@ -15359,7 +15698,11 @@ var init_dist2 = __esm({
                 (k) => k.startsWith(userPrefix) ? k.slice(userPrefix.length) : k
               );
             }
-            return ok(keys);
+            return ok({
+              keys,
+              truncated: listResult.data.truncated === true,
+              ...listResult.data.nextCursor === void 0 ? {} : { nextCursor: listResult.data.nextCursor }
+            });
           } catch (error) {
             return vaultError({
               code: "STORAGE_ERROR",
@@ -16138,126 +16481,9 @@ var init_dist2 = __esm({
   }
 });
 
-// ../../node_modules/ms/index.js
-var require_ms = __commonJS({
-  "../../node_modules/ms/index.js"(exports, module) {
-    "use strict";
-    var s = 1e3;
-    var m = s * 60;
-    var h = m * 60;
-    var d = h * 24;
-    var w = d * 7;
-    var y = d * 365.25;
-    module.exports = function(val, options) {
-      options = options || {};
-      var type = typeof val;
-      if (type === "string" && val.length > 0) {
-        return parse(val);
-      } else if (type === "number" && isFinite(val)) {
-        return options.long ? fmtLong(val) : fmtShort(val);
-      }
-      throw new Error(
-        "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
-      );
-    };
-    function parse(str) {
-      str = String(str);
-      if (str.length > 100) {
-        return;
-      }
-      var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
-        str
-      );
-      if (!match) {
-        return;
-      }
-      var n = parseFloat(match[1]);
-      var type = (match[2] || "ms").toLowerCase();
-      switch (type) {
-        case "years":
-        case "year":
-        case "yrs":
-        case "yr":
-        case "y":
-          return n * y;
-        case "weeks":
-        case "week":
-        case "w":
-          return n * w;
-        case "days":
-        case "day":
-        case "d":
-          return n * d;
-        case "hours":
-        case "hour":
-        case "hrs":
-        case "hr":
-        case "h":
-          return n * h;
-        case "minutes":
-        case "minute":
-        case "mins":
-        case "min":
-        case "m":
-          return n * m;
-        case "seconds":
-        case "second":
-        case "secs":
-        case "sec":
-        case "s":
-          return n * s;
-        case "milliseconds":
-        case "millisecond":
-        case "msecs":
-        case "msec":
-        case "ms":
-          return n;
-        default:
-          return void 0;
-      }
-    }
-    function fmtShort(ms3) {
-      var msAbs = Math.abs(ms3);
-      if (msAbs >= d) {
-        return Math.round(ms3 / d) + "d";
-      }
-      if (msAbs >= h) {
-        return Math.round(ms3 / h) + "h";
-      }
-      if (msAbs >= m) {
-        return Math.round(ms3 / m) + "m";
-      }
-      if (msAbs >= s) {
-        return Math.round(ms3 / s) + "s";
-      }
-      return ms3 + "ms";
-    }
-    function fmtLong(ms3) {
-      var msAbs = Math.abs(ms3);
-      if (msAbs >= d) {
-        return plural2(ms3, msAbs, d, "day");
-      }
-      if (msAbs >= h) {
-        return plural2(ms3, msAbs, h, "hour");
-      }
-      if (msAbs >= m) {
-        return plural2(ms3, msAbs, m, "minute");
-      }
-      if (msAbs >= s) {
-        return plural2(ms3, msAbs, s, "second");
-      }
-      return ms3 + " ms";
-    }
-    function plural2(ms3, msAbs, n, name2) {
-      var isPlural = msAbs >= n * 1.5;
-      return Math.round(ms3 / n) + " " + name2 + (isPlural ? "s" : "");
-    }
-  }
-});
-
 // ../sdk-core/dist/index.js
 import { SiweMessage } from "siwe";
-import crypto3 from "crypto";
+import crypto22 from "crypto";
 import { Buffer as Buffer2 } from "buffer";
 import { Buffer as Buffer3 } from "buffer";
 import { Buffer as Buffer4 } from "buffer";
@@ -16545,8 +16771,8 @@ function read2(buf, offset) {
   return res;
 }
 function decode3(data, offset = 0) {
-  const code2 = varint_default.decode(data, offset);
-  return [code2, varint_default.decode.bytes];
+  const code3 = varint_default.decode(data, offset);
+  return [code3, varint_default.decode.bytes];
 }
 function encodeTo(int, target, offset = 0) {
   varint_default.encode(int, target, offset);
@@ -16555,25 +16781,25 @@ function encodeTo(int, target, offset = 0) {
 function encodingLength(int) {
   return varint_default.encodingLength(int);
 }
-function create(code2, digest2) {
-  const size2 = digest2.byteLength;
-  const sizeOffset = encodingLength(code2);
+function create(code3, digest4) {
+  const size2 = digest4.byteLength;
+  const sizeOffset = encodingLength(code3);
   const digestOffset = sizeOffset + encodingLength(size2);
-  const bytes = new Uint8Array(digestOffset + size2);
-  encodeTo(code2, bytes, 0);
-  encodeTo(size2, bytes, sizeOffset);
-  bytes.set(digest2, digestOffset);
-  return new Digest(code2, size2, digest2, bytes);
+  const bytes2 = new Uint8Array(digestOffset + size2);
+  encodeTo(code3, bytes2, 0);
+  encodeTo(size2, bytes2, sizeOffset);
+  bytes2.set(digest4, digestOffset);
+  return new Digest(code3, size2, digest4, bytes2);
 }
 function decode4(multihash) {
-  const bytes = coerce2(multihash);
-  const [code2, sizeOffset] = decode3(bytes);
-  const [size2, digestOffset] = decode3(bytes.subarray(sizeOffset));
-  const digest2 = bytes.subarray(sizeOffset + digestOffset);
-  if (digest2.byteLength !== size2) {
+  const bytes2 = coerce2(multihash);
+  const [code3, sizeOffset] = decode3(bytes2);
+  const [size2, digestOffset] = decode3(bytes2.subarray(sizeOffset));
+  const digest4 = bytes2.subarray(sizeOffset + digestOffset);
+  if (digest4.byteLength !== size2) {
     throw new Error("Incorrect length");
   }
-  return new Digest(code2, size2, digest2, bytes);
+  return new Digest(code3, size2, digest4, bytes2);
 }
 function equals2(a, b) {
   if (a === b) {
@@ -16584,19 +16810,19 @@ function equals2(a, b) {
   }
 }
 function format(link, base3) {
-  const { bytes, version: version3 } = link;
+  const { bytes: bytes2, version: version3 } = link;
   switch (version3) {
     case 0:
-      return toStringV0(bytes, baseCache(link), base3 ?? base58btc.encoder);
+      return toStringV0(bytes2, baseCache(link), base3 ?? base58btc.encoder);
     default:
-      return toStringV1(bytes, baseCache(link), base3 ?? base32.encoder);
+      return toStringV1(bytes2, baseCache(link), base3 ?? base32.encoder);
   }
 }
-function baseCache(cid) {
-  const baseCache2 = cache.get(cid);
+function baseCache(cid2) {
+  const baseCache2 = cache.get(cid2);
   if (baseCache2 == null) {
     const baseCache3 = /* @__PURE__ */ new Map();
-    cache.set(cid, baseCache3);
+    cache.set(cid2, baseCache3);
     return baseCache3;
   }
   return baseCache2;
@@ -16631,39 +16857,39 @@ function parseCIDtoBytes(source, base3) {
     }
   }
 }
-function toStringV0(bytes, cache2, base3) {
+function toStringV0(bytes2, cache2, base3) {
   const { prefix } = base3;
   if (prefix !== base58btc.prefix) {
     throw Error(`Cannot string encode V0 in ${base3.name} encoding`);
   }
-  const cid = cache2.get(prefix);
-  if (cid == null) {
-    const cid2 = base3.encode(bytes).slice(1);
-    cache2.set(prefix, cid2);
-    return cid2;
+  const cid2 = cache2.get(prefix);
+  if (cid2 == null) {
+    const cid3 = base3.encode(bytes2).slice(1);
+    cache2.set(prefix, cid3);
+    return cid3;
   } else {
-    return cid;
+    return cid2;
   }
 }
-function toStringV1(bytes, cache2, base3) {
+function toStringV1(bytes2, cache2, base3) {
   const { prefix } = base3;
-  const cid = cache2.get(prefix);
-  if (cid == null) {
-    const cid2 = base3.encode(bytes);
-    cache2.set(prefix, cid2);
-    return cid2;
+  const cid2 = cache2.get(prefix);
+  if (cid2 == null) {
+    const cid3 = base3.encode(bytes2);
+    cache2.set(prefix, cid3);
+    return cid3;
   } else {
-    return cid;
+    return cid2;
   }
 }
-function encodeCID(version3, code2, multihash) {
+function encodeCID(version3, code3, multihash) {
   const codeOffset = encodingLength(version3);
-  const hashOffset = codeOffset + encodingLength(code2);
-  const bytes = new Uint8Array(hashOffset + multihash.byteLength);
-  encodeTo(version3, bytes, 0);
-  encodeTo(code2, bytes, codeOffset);
-  bytes.set(multihash, hashOffset);
-  return bytes;
+  const hashOffset = codeOffset + encodingLength(code3);
+  const bytes2 = new Uint8Array(hashOffset + multihash.byteLength);
+  encodeTo(version3, bytes2, 0);
+  encodeTo(code3, bytes2, codeOffset);
+  bytes2.set(multihash, hashOffset);
+  return bytes2;
 }
 function encode3(data) {
   return data.reduce((p, c) => {
@@ -16693,19 +16919,19 @@ function digest(input, options2) {
     }
     input = input.subarray(0, options2.truncate);
   }
-  return create(code, encode4(input));
+  return create(code2, encode4(input));
 }
-function from2({ name: name2, code: code2, encode: encode5, minDigestLength, maxDigestLength }) {
-  return new Hasher(name2, code2, encode5, minDigestLength, maxDigestLength);
+function from2({ name: name2, code: code3, encode: encode5, minDigestLength, maxDigestLength }) {
+  return new Hasher(name2, code3, encode5, minDigestLength, maxDigestLength);
 }
-function createDigest(digest2, code2, truncate) {
-  if (truncate != null && truncate !== digest2.byteLength) {
-    if (truncate > digest2.byteLength) {
-      throw new Error(`Invalid truncate option, must be less than or equal to ${digest2.byteLength}`);
+function createDigest(digest4, code3, truncate) {
+  if (truncate != null && truncate !== digest4.byteLength) {
+    if (truncate > digest4.byteLength) {
+      throw new Error(`Invalid truncate option, must be less than or equal to ${digest4.byteLength}`);
     }
-    digest2 = digest2.subarray(0, truncate);
+    digest4 = digest4.subarray(0, truncate);
   }
-  return create(code2, digest2);
+  return create(code3, digest4);
 }
 function parseStrictRfc33392(value) {
   if (!/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d+)?(Z|[+-]\d{2}:\d{2})$/.test(
@@ -17071,27 +17297,27 @@ function validate(...funcs) {
     }
   };
 }
-function bytesToComponents(bytes) {
+function bytesToComponents(bytes2) {
   const components = [];
   let i = 0;
-  while (i < bytes.length) {
-    const code2 = decode6(bytes, i);
-    const codec = registry.getProtocol(code2);
-    const codeLength = encodingLength2(code2);
-    const size2 = sizeForAddr(codec, bytes, i + codeLength);
+  while (i < bytes2.length) {
+    const code3 = decode6(bytes2, i);
+    const codec = registry.getProtocol(code3);
+    const codeLength = encodingLength2(code3);
+    const size2 = sizeForAddr(codec, bytes2, i + codeLength);
     let sizeLength = 0;
     if (size2 > 0 && codec.size === V) {
       sizeLength = encodingLength2(size2);
     }
     const componentLength = codeLength + sizeLength + size2;
     const component = {
-      code: code2,
+      code: code3,
       name: codec.name,
-      bytes: bytes.subarray(i, i + componentLength)
+      bytes: bytes2.subarray(i, i + componentLength)
     };
     if (size2 > 0) {
       const valueOffset = i + codeLength + sizeLength;
-      const valueBytes = bytes.subarray(valueOffset, valueOffset + size2);
+      const valueBytes = bytes2.subarray(valueOffset, valueOffset + size2);
       component.value = codec.bytesToValue?.(valueBytes) ?? toString2(valueBytes);
     }
     components.push(component);
@@ -17101,7 +17327,7 @@ function bytesToComponents(bytes) {
 }
 function componentsToBytes(components) {
   let length2 = 0;
-  const bytes = [];
+  const bytes2 = [];
   for (const component of components) {
     if (component.bytes == null) {
       const codec = registry.getProtocol(component.code);
@@ -17116,23 +17342,23 @@ function componentsToBytes(components) {
           valueLengthLength = encodingLength2(valueLength);
         }
       }
-      const bytes2 = new Uint8Array(codecLength + valueLengthLength + valueLength);
+      const bytes3 = new Uint8Array(codecLength + valueLengthLength + valueLength);
       let offset = 0;
-      encodeUint8Array(component.code, bytes2, offset);
+      encodeUint8Array(component.code, bytes3, offset);
       offset += codecLength;
       if (valueBytes != null) {
         if (codec.size === V) {
-          encodeUint8Array(valueLength, bytes2, offset);
+          encodeUint8Array(valueLength, bytes3, offset);
           offset += valueLengthLength;
         }
-        bytes2.set(valueBytes, offset);
+        bytes3.set(valueBytes, offset);
       }
-      component.bytes = bytes2;
+      component.bytes = bytes3;
     }
-    bytes.push(component.bytes);
+    bytes2.push(component.bytes);
     length2 += component.bytes.byteLength;
   }
-  return concat2(bytes, length2);
+  return concat2(bytes2, length2);
 }
 function stringToComponents(string2) {
   if (string2.charAt(0) !== "/") {
@@ -17206,14 +17432,14 @@ function componentsToString(components) {
     ];
   }).join("/")}`;
 }
-function sizeForAddr(codec, bytes, offset) {
+function sizeForAddr(codec, bytes2, offset) {
   if (codec.size == null || codec.size === 0) {
     return 0;
   }
   if (codec.size > 0) {
     return codec.size / 8;
   }
-  return decode6(bytes, offset);
+  return decode6(bytes2, offset);
 }
 function toComponents(addr) {
   if (addr == null) {
@@ -17266,7 +17492,7 @@ function extractTuple(name2, ma) {
   return ma.find((component) => component.name === name2);
 }
 function hasTLS(ma) {
-  return ma.some(({ code: code2 }) => code2 === CODE_TLS);
+  return ma.some(({ code: code3 }) => code3 === CODE_TLS);
 }
 function interpretNext(head, rest) {
   const interpreter = interpreters[head.name];
@@ -17633,12 +17859,12 @@ function ed25519PublicKeyFromDidKey2(did) {
       "did:key must use base58btc multibase"
     );
   }
-  const bytes = bases.base58btc.decode(identifier);
-  if (bytes.length === 34 && bytes[0] === 237 && bytes[1] === 1) {
-    return bytes.slice(2);
+  const bytes2 = bases.base58btc.decode(identifier);
+  if (bytes2.length === 34 && bytes2[0] === 237 && bytes2[1] === 1) {
+    return bytes2.slice(2);
   }
-  if (bytes.length === 33 && bytes[0] === 237) {
-    return bytes.slice(1);
+  if (bytes2.length === 33 && bytes2[0] === 237) {
+    return bytes2.slice(1);
   }
   throw new LocationRecordValidationError(
     "did:key must be an Ed25519 public key"
@@ -17646,7 +17872,7 @@ function ed25519PublicKeyFromDidKey2(did) {
 }
 function decodeBase64Url(value) {
   const alphabet2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-  const bytes = [];
+  const bytes2 = [];
   let buffer = 0;
   let bits = 0;
   for (const char of value) {
@@ -17660,30 +17886,32 @@ function decodeBase64Url(value) {
     bits += 6;
     if (bits >= 8) {
       bits -= 8;
-      bytes.push(buffer >> bits & 255);
+      bytes2.push(buffer >> bits & 255);
     }
   }
-  return Uint8Array.from(bytes);
+  return Uint8Array.from(bytes2);
 }
-var import_ms, __defProp2, __typeError, __defNormalProp, __export2, __publicField, __accessCheck, __privateGet, __privateAdd, __privateSet, EnsDataSchema, SiweConfigSchema, ClientSessionSchema, base32_exports, empty, src, _brrp__multiformats_scope_baseX, base_x_default, Encoder, Decoder, ComposedDecoder, Codec, base32, base32upper, base32pad, base32padupper, base32hex, base32hexupper, base32hexpad, base32hexpadupper, base32z, base36_exports, base36, base36upper, base58_exports, base58btc, base58flickr, encode_1, MSB, REST, MSBALL, INT, decode2, MSB$1, REST$1, N1, N2, N3, N4, N5, N6, N7, N8, N9, length, varint, _brrp_varint, varint_default, Digest, cache, _a, CID, DAG_PB_CODE, SHA_256_CODE, cidSymbol, objectHasOwn, textEncoder, objectHasOwn2, CEILING_SERVICES, GRANTABLE_ACTIONS, base10_exports, base10, base16_exports, base16, base16upper, base2_exports, base2, base256emoji_exports, alphabet, alphabetBytesToChars, alphabetCharsToBytes, base256emoji, base64_exports, base64, base64pad, base64url, base64urlpad, base8_exports, base8, identity_exports, identity, textEncoder2, textDecoder, identity_exports2, code, name, encode4, identity2, sha2_exports, DEFAULT_MIN_DIGEST_LENGTH, Hasher, sha2562, sha5122, bases, hashes, textEncoder3, objectHasOwn3, TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA, OWNER_NODE_ENDPOINT_SCHEMA, W3C_VC_CREDENTIAL_VERIFIER, objectHasOwn4, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, JsonValueSchema, Rfc3339Schema, SignedRecordSchema, PolicyEngineSchema, OwnerNodeSchema, ResourceHintSchema, BootstrapSchema, SignatureSchema, ChallengeSchema, ChallengeResponseSchema, DenialSchema, ErrorEnvelopeDenialSchema, WireDelegationSchema, ResolveResponseSchema, DelegateReceiptSchema, SqlReadResponseSchema, KvReadResponseSchema, LISTEN_SQL_STATEMENT_CATALOG, LISTEN_SQL_STATEMENT_BY_NAME, ethereumAddressPattern, EnsDataSchema2, PersistedTinyCloudSessionSchema, PersistedSessionDataSchema, TinyCloudSessionSchema, JWKSchema, KeyTypeSchema, KeyInfoSchema, DelegationErrorSchema, DelegationSchema, DelegationStatusSchema, DelegationRevocationReceiptSchema, AccountDelegationResourceSchema, AccountDelegationDateSchema, AccountDelegationRecordSchema, AccountDelegationPageSchema, AccountDelegationQueryOptionsSchema, CapabilityEntrySchema, DelegationRecordSchema, CreateDelegationParamsSchema, DelegationChainSchema, DelegationChainV2Schema, DelegationDirectionSchema, DelegationFiltersSchema, SpaceOwnershipSchema, SpaceInfoSchema, ShareSchemaSchema, ShareLinkSchema, ShareLinkDataSchema, IngestOptionsSchema, GenerateShareParamsSchema, DelegationManagerConfigSchema, KeyProviderSchema, DelegationApiResponseSchema, DelegatedResourceSchema, CreateDelegationWasmParamsSchema, CreateDelegationWasmResultSchema, SpaceConfigSchema, SpaceServiceConfigSchema, SpaceDelegationParamsSchema, ServerDelegationInfoSchema, ServerDelegationsResponseSchema, ServerOwnedSpaceSchema, ServerOwnedSpacesResponseSchema, ServerCreateSpaceResponseSchema, ServerSpaceInfoResponseSchema, EPHEMERAL_MS, SIGNED_READ_URL_MS, SESSION_MS, SHARE_MS, APP_MS, MAX_MS, EXPIRY, DEFAULT_SIGNED_READ_URL_EXPIRY_MS2, DEFAULT_KNOWLEDGE_ROOT, ManifestValidationError, SERVICE_SHORT_TO_LONG, SERVICE_LONG_TO_SHORT, EncodedShareDataSchema, ReceiveOptionsSchema, SharingServiceConfigSchema, DEFAULT_EXPIRY_MS2, AutoApproveSpaceCreationHandler, defaultSpaceCreationHandler, N12, N22, N32, N42, N52, N62, N72, MSB2, REST2, string, ascii, BASES, bases_default, InvalidMultiaddrError, ValidationError, InvalidParametersError, UnknownProtocolError, CODE_IP4, CODE_TCP, CODE_UDP, CODE_DCCP, CODE_IP6, CODE_IP6ZONE, CODE_IPCIDR, CODE_DNS, CODE_DNS4, CODE_DNS6, CODE_DNSADDR, CODE_SCTP, CODE_UDT, CODE_UTP, CODE_UNIX, CODE_P2P, CODE_ONION, CODE_ONION3, CODE_GARLIC64, CODE_GARLIC32, CODE_TLS, CODE_SNI, CODE_NOISE, CODE_QUIC, CODE_QUIC_V1, CODE_WEBTRANSPORT, CODE_CERTHASH, CODE_HTTP, CODE_HTTP_PATH, CODE_HTTPS, CODE_WS, CODE_WSS, CODE_P2P_WEBSOCKET_STAR, CODE_P2P_STARDUST, CODE_P2P_WEBRTC_STAR, CODE_P2P_WEBRTC_DIRECT, CODE_WEBRTC_DIRECT, CODE_WEBRTC, CODE_P2P_CIRCUIT, CODE_MEMORY, ip4ToBytes, ip6ToBytes, ip4ToString, ip6ToString, decoders, anybaseDecoder, validatePort, V, Registry, registry, codecs, inspect, symbol, _a2, _components, _string, _bytes, _Multiaddr, Multiaddr, ASSUME_HTTP_CODES, interpreters, word, boundry, v4, v6segment, v6, v46Exact, v4exact, v6exact, ipRegex, toString3, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, DEFAULT_LOCAL_NODE_URL, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LINK_HOST_SUFFIX, LocationRecordValidationError, defaultLocalNodeIdentityStore, DNS_LABEL_REGEX;
+var import_ms, __defProp2, __typeError, __defNormalProp, __export2, __publicField, __accessCheck, __privateGet, __privateAdd, __privateSet, EnsDataSchema, SiweConfigSchema, ClientSessionSchema, base32_exports, empty, src, _brrp__multiformats_scope_baseX, base_x_default, Encoder, Decoder, ComposedDecoder, Codec, base32, base32upper, base32pad, base32padupper, base32hex, base32hexupper, base32hexpad, base32hexpadupper, base32z, base36_exports, base36, base36upper, base58_exports, base58btc, base58flickr, encode_1, MSB, REST, MSBALL, INT, decode2, MSB$1, REST$1, N1, N2, N3, N4, N5, N6, N7, N8, N9, length, varint, _brrp_varint, varint_default, Digest, cache, _a, CID, DAG_PB_CODE, SHA_256_CODE, cidSymbol, objectHasOwn, textEncoder, objectHasOwn2, CEILING_SERVICES, GRANTABLE_ACTIONS, base10_exports, base10, base16_exports, base16, base16upper, base2_exports, base2, base256emoji_exports, alphabet, alphabetBytesToChars, alphabetCharsToBytes, base256emoji, base64_exports, base64, base64pad, base64url, base64urlpad, base8_exports, base8, identity_exports, identity, textEncoder2, textDecoder, identity_exports2, code2, name, encode4, identity2, sha2_exports, DEFAULT_MIN_DIGEST_LENGTH, Hasher, sha2562, sha5122, bases, hashes, textEncoder3, objectHasOwn3, TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA, OWNER_NODE_ENDPOINT_SCHEMA, W3C_VC_CREDENTIAL_VERIFIER, objectHasOwn4, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, JsonValueSchema, Rfc3339Schema, SignedRecordSchema, PolicyEngineSchema, OwnerNodeSchema, ResourceHintSchema, BootstrapSchema, SignatureSchema, ChallengeSchema, ChallengeResponseSchema, DenialSchema, ErrorEnvelopeDenialSchema, WireDelegationSchema, ResolveResponseSchema, DelegateReceiptSchema, SqlReadResponseSchema, KvReadResponseSchema, LISTEN_SQL_STATEMENT_CATALOG, LISTEN_SQL_STATEMENT_BY_NAME, JWKSchema, KeyTypeSchema, KeyInfoSchema, DelegationErrorSchema, DelegationSchema, DelegationStatusSchema, DelegationRevocationReceiptSchema, AccountDelegationResourceSchema, AccountDelegationDateSchema, AccountDelegationRecordSchema, AccountDelegationPageSchema, AccountDelegationQueryOptionsSchema, CapabilityEntrySchema, DelegationRecordSchema, CreateDelegationParamsSchema, DelegationChainSchema, DelegationChainV2Schema, DelegationDirectionSchema, DelegationFiltersSchema, SpaceOwnershipSchema, SpaceInfoSchema, ShareSchemaSchema, ShareLinkSchema, ShareLinkDataSchema, IngestOptionsSchema, GenerateShareParamsSchema, DelegationManagerConfigSchema, KeyProviderSchema, DelegationApiResponseSchema, DelegatedResourceSchema, CreateDelegationWasmParamsSchema, CreateDelegationWasmResultSchema, EPHEMERAL_MS, SIGNED_READ_URL_MS, SESSION_MS, SHARE_MS, APP_MS, MAX_MS, EXPIRY, DEFAULT_SIGNED_READ_URL_EXPIRY_MS2, EncodedShareDataSchema, ReceiveOptionsSchema, SharingServiceConfigSchema, DEFAULT_KNOWLEDGE_ROOT, ManifestValidationError, SERVICE_SHORT_TO_LONG, SERVICE_LONG_TO_SHORT, DEFAULT_MAX_INLINE_BYTES, MAX_SHARE_CONTENT_BYTES, MAX_SEALED_SHARE_CONTENT_BYTES, MAX_SHARE_ARTIFACT_BYTES, PUBLISHED_AAD, ShareRecipientTargetSchema, ShareResourceSchema, ShareActionSchema, ShareRecipientPolicySchema, ShareRecipientClientOptionsSchema, ShareNativeActionSchema, ShareWireActionSchema, ShareContentSourceSchema, ShareAddressedRecipientSchema, ShareAddressedDelegationRequestV2Schema, ShareAddressedDelegationEnvelopeV2Schema, ShareAddressedDelegationResponseV2Schema, ShareNativeResponseEntrySchema, ShareNativeResponseBase, ShareNativeResponseSchema, MAX_NATIVE_CURSOR_BYTES, DEFAULT_EXPIRY_MS2, MAX_CONTENT_BYTES, ethereumAddressPattern, EnsDataSchema2, PersistedTinyCloudSessionSchema, PersistedSessionDataSchema, TinyCloudSessionSchema, SpaceConfigSchema, SpaceServiceConfigSchema, SpaceDelegationParamsSchema, ServerDelegationInfoSchema, ServerDelegationsResponseSchema, ServerOwnedSpaceSchema, ServerOwnedSpacesResponseSchema, ServerCreateSpaceResponseSchema, ServerSpaceInfoResponseSchema, AutoApproveSpaceCreationHandler, defaultSpaceCreationHandler, N12, N22, N32, N42, N52, N62, N72, MSB2, REST2, string, ascii, BASES, bases_default, InvalidMultiaddrError, ValidationError, InvalidParametersError, UnknownProtocolError, CODE_IP4, CODE_TCP, CODE_UDP, CODE_DCCP, CODE_IP6, CODE_IP6ZONE, CODE_IPCIDR, CODE_DNS, CODE_DNS4, CODE_DNS6, CODE_DNSADDR, CODE_SCTP, CODE_UDT, CODE_UTP, CODE_UNIX, CODE_P2P, CODE_ONION, CODE_ONION3, CODE_GARLIC64, CODE_GARLIC32, CODE_TLS, CODE_SNI, CODE_NOISE, CODE_QUIC, CODE_QUIC_V1, CODE_WEBTRANSPORT, CODE_CERTHASH, CODE_HTTP, CODE_HTTP_PATH, CODE_HTTPS, CODE_WS, CODE_WSS, CODE_P2P_WEBSOCKET_STAR, CODE_P2P_STARDUST, CODE_P2P_WEBRTC_STAR, CODE_P2P_WEBRTC_DIRECT, CODE_WEBRTC_DIRECT, CODE_WEBRTC, CODE_P2P_CIRCUIT, CODE_MEMORY, ip4ToBytes, ip6ToBytes, ip4ToString, ip6ToString, decoders, anybaseDecoder, validatePort, V, Registry, registry, codecs, inspect, symbol, _a2, _components, _string, _bytes, _Multiaddr, Multiaddr, ASSUME_HTTP_CODES, interpreters, word, boundry, v4, v6segment, v6, v46Exact, v4exact, v6exact, ipRegex, toString3, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, DEFAULT_LOCAL_NODE_URL, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LINK_HOST_SUFFIX, LocationRecordValidationError, defaultLocalNodeIdentityStore, DNS_LABEL_REGEX;
 var init_dist3 = __esm({
   "../sdk-core/dist/index.js"() {
     "use strict";
     init_zod();
     init_zod();
     init_dist();
-    init_dist2();
     init_zod();
+    init_zod();
+    import_ms = __toESM(require_ms(), 1);
     init_dist2();
     init_dist2();
     init_zod();
+    init_dist2();
     init_zod();
     init_dist2();
-    import_ms = __toESM(require_ms(), 1);
+    init_dist2();
+    init_zod();
     init_dist2();
     init_dist();
     init_dist2();
-    init_zod();
     init_dist2();
     init_dist();
     init_ed25519();
@@ -17751,9 +17979,9 @@ var init_dist3 = __esm({
         this.prefix = prefix;
         this.baseEncode = baseEncode;
       }
-      encode(bytes) {
-        if (bytes instanceof Uint8Array) {
-          return `${this.prefix}${this.baseEncode(bytes)}`;
+      encode(bytes2) {
+        if (bytes2 instanceof Uint8Array) {
+          return `${this.prefix}${this.baseEncode(bytes2)}`;
         } else {
           throw Error("Unknown type, must be binary type");
         }
@@ -17943,15 +18171,15 @@ var init_dist3 = __esm({
       /**
        * Creates a multihash digest.
        */
-      constructor(code2, size2, digest2, bytes) {
+      constructor(code3, size2, digest4, bytes2) {
         __publicField(this, "code");
         __publicField(this, "size");
         __publicField(this, "digest");
         __publicField(this, "bytes");
-        this.code = code2;
+        this.code = code3;
         this.size = size2;
-        this.digest = digest2;
-        this.bytes = bytes;
+        this.digest = digest4;
+        this.bytes = bytes2;
       }
     };
     cache = /* @__PURE__ */ new WeakMap();
@@ -17961,18 +18189,18 @@ var init_dist3 = __esm({
        * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
        * @param multihash - (Multi)hash of the of the content.
        */
-      constructor(version3, code2, multihash, bytes) {
+      constructor(version3, code3, multihash, bytes2) {
         __publicField(this, "code");
         __publicField(this, "version");
         __publicField(this, "multihash");
         __publicField(this, "bytes");
         __publicField(this, "/");
         __publicField(this, _a, "CID");
-        this.code = code2;
+        this.code = code3;
         this.version = version3;
         this.multihash = multihash;
-        this.bytes = bytes;
-        this["/"] = bytes;
+        this.bytes = bytes2;
+        this["/"] = bytes2;
       }
       /**
        * Signalling `cid.asCID === cid` has been replaced with `cid['/'] === cid.bytes`
@@ -17997,8 +18225,8 @@ var init_dist3 = __esm({
             return this;
           }
           case 1: {
-            const { code: code2, multihash } = this;
-            if (code2 !== DAG_PB_CODE) {
+            const { code: code3, multihash } = this;
+            if (code3 !== DAG_PB_CODE) {
               throw new Error("Cannot convert a non dag-pb CID to CIDv0");
             }
             if (multihash.code !== SHA_256_CODE) {
@@ -18014,8 +18242,8 @@ var init_dist3 = __esm({
       toV1() {
         switch (this.version) {
           case 0: {
-            const { code: code2, digest: digest2 } = this.multihash;
-            const multihash = create(code2, digest2);
+            const { code: code3, digest: digest4 } = this.multihash;
+            const multihash = create(code3, digest4);
             return _CID.createV1(this.code, multihash);
           }
           case 1: {
@@ -18064,12 +18292,12 @@ var init_dist3 = __esm({
         if (value instanceof _CID) {
           return value;
         } else if (value["/"] != null && value["/"] === value.bytes || value.asCID === value) {
-          const { version: version3, code: code2, multihash, bytes } = value;
-          return new _CID(version3, code2, multihash, bytes ?? encodeCID(version3, code2, multihash.bytes));
+          const { version: version3, code: code3, multihash, bytes: bytes2 } = value;
+          return new _CID(version3, code3, multihash, bytes2 ?? encodeCID(version3, code3, multihash.bytes));
         } else if (value[cidSymbol] === true) {
-          const { version: version3, multihash, code: code2 } = value;
-          const digest2 = decode4(multihash);
-          return _CID.create(version3, code2, digest2);
+          const { version: version3, multihash, code: code3 } = value;
+          const digest4 = decode4(multihash);
+          return _CID.create(version3, code3, digest4);
         } else {
           return null;
         }
@@ -18079,24 +18307,24 @@ var init_dist3 = __esm({
        * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
        * @param digest - (Multi)hash of the of the content.
        */
-      static create(version3, code2, digest2) {
-        if (typeof code2 !== "number") {
+      static create(version3, code3, digest4) {
+        if (typeof code3 !== "number") {
           throw new Error("String codecs are no longer supported");
         }
-        if (!(digest2.bytes instanceof Uint8Array)) {
+        if (!(digest4.bytes instanceof Uint8Array)) {
           throw new Error("Invalid digest");
         }
         switch (version3) {
           case 0: {
-            if (code2 !== DAG_PB_CODE) {
+            if (code3 !== DAG_PB_CODE) {
               throw new Error(`Version 0 CID must use dag-pb (code: ${DAG_PB_CODE}) block encoding`);
             } else {
-              return new _CID(version3, code2, digest2, digest2.bytes);
+              return new _CID(version3, code3, digest4, digest4.bytes);
             }
           }
           case 1: {
-            const bytes = encodeCID(version3, code2, digest2.bytes);
-            return new _CID(version3, code2, digest2, bytes);
+            const bytes2 = encodeCID(version3, code3, digest4.bytes);
+            return new _CID(version3, code3, digest4, bytes2);
           }
           default: {
             throw new Error("Invalid version");
@@ -18106,8 +18334,8 @@ var init_dist3 = __esm({
       /**
        * Simplified version of `create` for CIDv0.
        */
-      static createV0(digest2) {
-        return _CID.create(0, DAG_PB_CODE, digest2);
+      static createV0(digest4) {
+        return _CID.create(0, DAG_PB_CODE, digest4);
       }
       /**
        * Simplified version of `create` for CIDv1.
@@ -18115,8 +18343,8 @@ var init_dist3 = __esm({
        * @param code - Content encoding format code.
        * @param digest - Multihash of the content.
        */
-      static createV1(code2, digest2) {
-        return _CID.create(1, code2, digest2);
+      static createV1(code3, digest4) {
+        return _CID.create(1, code3, digest4);
       }
       /**
        * Decoded a CID from its binary representation. The byte array must contain
@@ -18125,12 +18353,12 @@ var init_dist3 = __esm({
        * An error will be thrown if the bytes provided do not contain a valid
        * binary representation of a CID.
        */
-      static decode(bytes) {
-        const [cid, remainder] = _CID.decodeFirst(bytes);
+      static decode(bytes2) {
+        const [cid2, remainder] = _CID.decodeFirst(bytes2);
         if (remainder.length !== 0) {
           throw new Error("Incorrect length");
         }
-        return cid;
+        return cid2;
       }
       /**
        * Decoded a CID from its binary representation at the beginning of a byte
@@ -18141,17 +18369,17 @@ var init_dist3 = __esm({
        * will be a zero-length byte array if the provided bytes only contained a
        * binary CID representation.
        */
-      static decodeFirst(bytes) {
-        const specs = _CID.inspectBytes(bytes);
+      static decodeFirst(bytes2) {
+        const specs = _CID.inspectBytes(bytes2);
         const prefixSize = specs.size - specs.multihashSize;
-        const multihashBytes = coerce2(bytes.subarray(prefixSize, prefixSize + specs.multihashSize));
+        const multihashBytes = coerce2(bytes2.subarray(prefixSize, prefixSize + specs.multihashSize));
         if (multihashBytes.byteLength !== specs.multihashSize) {
           throw new Error("Incorrect length");
         }
         const digestBytes = multihashBytes.subarray(specs.multihashSize - specs.digestSize);
-        const digest2 = new Digest(specs.multihashCode, specs.digestSize, digestBytes, multihashBytes);
-        const cid = specs.version === 0 ? _CID.createV0(digest2) : _CID.createV1(specs.codec, digest2);
-        return [cid, bytes.subarray(specs.size)];
+        const digest4 = new Digest(specs.multihashCode, specs.digestSize, digestBytes, multihashBytes);
+        const cid2 = specs.version === 0 ? _CID.createV0(digest4) : _CID.createV1(specs.codec, digest4);
+        return [cid2, bytes2.subarray(specs.size)];
       }
       /**
        * Inspect the initial bytes of a CID to determine its properties.
@@ -18194,13 +18422,13 @@ var init_dist3 = __esm({
        * a default decoder).
        */
       static parse(source, base3) {
-        const [prefix, bytes] = parseCIDtoBytes(source, base3);
-        const cid = _CID.decode(bytes);
-        if (cid.version === 0 && source[0] !== "Q") {
+        const [prefix, bytes2] = parseCIDtoBytes(source, base3);
+        const cid2 = _CID.decode(bytes2);
+        if (cid2.version === 0 && source[0] !== "Q") {
           throw Error("Version 0 CID string must not include multibase prefix");
         }
-        baseCache(cid).set(prefix, source);
-        return cid;
+        baseCache(cid2).set(prefix, source);
+        return cid2;
       }
     };
     DAG_PB_CODE = 112;
@@ -18345,10 +18573,10 @@ var init_dist3 = __esm({
     __export2(identity_exports2, {
       identity: () => identity2
     });
-    code = 0;
+    code2 = 0;
     name = "identity";
     encode4 = coerce2;
-    identity2 = { code, name, encode: encode4, digest };
+    identity2 = { code: code2, name, encode: encode4, digest };
     sha2_exports = {};
     __export2(sha2_exports, {
       sha256: () => sha2562,
@@ -18356,14 +18584,14 @@ var init_dist3 = __esm({
     });
     DEFAULT_MIN_DIGEST_LENGTH = 20;
     Hasher = class {
-      constructor(name2, code2, encode5, minDigestLength, maxDigestLength) {
+      constructor(name2, code3, encode5, minDigestLength, maxDigestLength) {
         __publicField(this, "name");
         __publicField(this, "code");
         __publicField(this, "encode");
         __publicField(this, "minDigestLength");
         __publicField(this, "maxDigestLength");
         this.name = name2;
-        this.code = code2;
+        this.code = code3;
         this.encode = encode5;
         this.minDigestLength = minDigestLength ?? DEFAULT_MIN_DIGEST_LENGTH;
         this.maxDigestLength = maxDigestLength;
@@ -18382,7 +18610,7 @@ var init_dist3 = __esm({
           if (result instanceof Uint8Array) {
             return createDigest(result, this.code, options2?.truncate);
           }
-          return result.then((digest2) => createDigest(digest2, this.code, options2?.truncate));
+          return result.then((digest4) => createDigest(digest4, this.code, options2?.truncate));
         } else {
           throw Error("Unknown type, must be binary type");
         }
@@ -18391,12 +18619,12 @@ var init_dist3 = __esm({
     sha2562 = from2({
       name: "sha2-256",
       code: 18,
-      encode: (input) => coerce2(crypto3.createHash("sha256").update(input).digest())
+      encode: (input) => coerce2(crypto22.createHash("sha256").update(input).digest())
     });
     sha5122 = from2({
       name: "sha2-512",
       code: 19,
-      encode: (input) => coerce2(crypto3.createHash("sha512").update(input).digest())
+      encode: (input) => coerce2(crypto22.createHash("sha512").update(input).digest())
     });
     bases = { ...identity_exports, ...base2_exports, ...base8_exports, ...base10_exports, ...base16_exports, ...base32_exports, ...base36_exports, ...base58_exports, ...base64_exports, ...base256emoji_exports };
     hashes = { ...sha2_exports, ...identity_exports2 };
@@ -18589,83 +18817,6 @@ var init_dist3 = __esm({
         statement
       ])
     );
-    ethereumAddressPattern = /^0x[a-fA-F0-9]{40}$/;
-    EnsDataSchema2 = external_exports.object({
-      /** ENS name/domain. */
-      domain: external_exports.string().nullable().optional(),
-      /** ENS avatar URL. */
-      avatarUrl: external_exports.string().nullable().optional()
-    });
-    PersistedTinyCloudSessionSchema = external_exports.object({
-      /** The delegation header containing the UCAN */
-      delegationHeader: external_exports.object({
-        Authorization: external_exports.string()
-      }),
-      /** The delegation CID */
-      delegationCid: external_exports.string(),
-      /** The space ID for this session */
-      spaceId: external_exports.string(),
-      /** Additional spaces included in this session's capabilities. Key is logical name, value is full spaceId URI */
-      spaces: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-      /** The verification method DID */
-      verificationMethod: external_exports.string()
-    });
-    PersistedSessionDataSchema = external_exports.object({
-      /** User's Ethereum address */
-      address: external_exports.string().regex(ethereumAddressPattern, "Invalid Ethereum address"),
-      /** EIP-155 Chain ID */
-      chainId: external_exports.number().int().positive(),
-      /** Session key in JWK format (stringified) */
-      sessionKey: external_exports.string(),
-      /** The signed SIWE message */
-      siwe: external_exports.string(),
-      /** User's signature of the SIWE message */
-      signature: external_exports.string(),
-      /** TinyCloud delegation data if available */
-      tinycloudSession: PersistedTinyCloudSessionSchema.optional(),
-      /** Session expiration timestamp (ISO 8601 with timezone offset) */
-      expiresAt: external_exports.string().datetime({ offset: true }),
-      /** Session creation timestamp (ISO 8601 with timezone offset) */
-      createdAt: external_exports.string().datetime({ offset: true }),
-      /** Schema version for migrations */
-      version: external_exports.string(),
-      /** Optional ENS data */
-      ens: EnsDataSchema2.optional(),
-      /**
-       * TinyCloud hosts this session was created against. Persisted so a
-       * restored session resolves to the same node without re-running the
-       * registry/fallback resolution (or the wallet sign-in flow). Optional
-       * for backward compatibility with sessions persisted before this field
-       * existed — those restore and lazily re-resolve their hosts.
-       */
-      tinycloudHosts: external_exports.array(external_exports.string()).optional()
-    });
-    TinyCloudSessionSchema = external_exports.object({
-      /** User's Ethereum address */
-      address: external_exports.string().regex(ethereumAddressPattern, "Invalid Ethereum address"),
-      /** EIP-155 Chain ID */
-      chainId: external_exports.number().int().positive(),
-      /** Session key ID */
-      sessionKey: external_exports.string(),
-      /** The space ID for this session */
-      spaceId: external_exports.string(),
-      /** Additional spaces included in this session's capabilities. Key is logical name, value is full spaceId URI */
-      spaces: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-      /** The delegation CID */
-      delegationCid: external_exports.string(),
-      /** The delegation header for API calls */
-      delegationHeader: external_exports.object({
-        Authorization: external_exports.string()
-      }),
-      /** The verification method DID */
-      verificationMethod: external_exports.string(),
-      /** The session key JWK (required for invoke operations) */
-      jwk: external_exports.object({}).passthrough(),
-      /** The signed SIWE message */
-      siwe: external_exports.string(),
-      /** User's signature of the SIWE message */
-      signature: external_exports.string()
-    });
     JWKSchema = external_exports.object({
       /** Key type (e.g., "EC", "RSA", "OKP") */
       kty: external_exports.string(),
@@ -19047,112 +19198,6 @@ var init_dist3 = __esm({
        */
       resources: external_exports.array(DelegatedResourceSchema)
     });
-    SpaceConfigSchema = external_exports.object({
-      /** The space identifier (full URI) */
-      id: external_exports.string(),
-      /** The short name of the space */
-      name: external_exports.string(),
-      /** Factory function to create a space-scoped KV service */
-      createKV: external_exports.function(),
-      /** Factory function to create a space-scoped Data Vault service */
-      createVault: external_exports.function(),
-      /** Optional factory function to create a space-scoped secrets service */
-      createSecrets: external_exports.function().optional(),
-      /** Factory function to create space-scoped delegations */
-      createDelegations: external_exports.function(),
-      /** Factory function to create space-scoped sharing */
-      createSharing: external_exports.function(),
-      /** Function to get space info */
-      getInfo: external_exports.function()
-    });
-    SpaceServiceConfigSchema = external_exports.object({
-      /** TinyCloud host URLs */
-      hosts: external_exports.array(external_exports.string()),
-      /** Active session for authentication */
-      session: external_exports.unknown(),
-      /** Platform-specific invoke function */
-      invoke: external_exports.function(),
-      /** Optional custom fetch implementation */
-      fetch: external_exports.function().optional(),
-      /** Optional capability key registry for delegated space discovery */
-      capabilityRegistry: external_exports.unknown().optional(),
-      /** Factory function to create a space-scoped KV service */
-      createKVService: external_exports.function().optional(),
-      /** Factory function to create a space-scoped Data Vault service */
-      createVaultService: external_exports.function().optional(),
-      /** Factory function to create a space-scoped secrets service */
-      createSecretsService: external_exports.function().optional(),
-      /** User's PKH DID (derived from address or provided explicitly) */
-      userDid: external_exports.string().optional(),
-      /** Optional SharingService for v2 sharing links (client-side) */
-      sharingService: external_exports.unknown().optional(),
-      /** Factory function to create delegations using SIWE-based flow */
-      createDelegation: external_exports.function().optional()
-    });
-    SpaceDelegationParamsSchema = CreateDelegationParamsSchema.extend({
-      /** The space ID to create the delegation for */
-      spaceId: external_exports.string()
-    });
-    ServerDelegationInfoSchema = external_exports.object({
-      /** DID of the delegator */
-      delegator: external_exports.string(),
-      /** DID of the delegate */
-      delegate: external_exports.string(),
-      /** Parent delegation CIDs - accepts string or byte array format from server */
-      parents: external_exports.array(external_exports.union([external_exports.string(), external_exports.array(external_exports.number())])),
-      /** Expiration time (ISO8601 string) */
-      expiry: external_exports.string().optional(),
-      /** Not-before time (ISO8601 string) */
-      not_before: external_exports.string().optional(),
-      /** Issued-at time (ISO8601 string) */
-      issued_at: external_exports.string().optional(),
-      /** Capabilities granted by this delegation */
-      capabilities: external_exports.array(
-        external_exports.object({
-          resource: external_exports.string(),
-          ability: external_exports.string()
-        })
-      )
-    });
-    ServerDelegationsResponseSchema = external_exports.record(
-      external_exports.string(),
-      ServerDelegationInfoSchema
-    );
-    ServerOwnedSpaceSchema = external_exports.object({
-      /** Space identifier */
-      id: external_exports.string(),
-      /** Space name (optional, can be derived from id) */
-      name: external_exports.string().optional(),
-      /** Owner DID */
-      owner: external_exports.string(),
-      /** Creation timestamp */
-      createdAt: external_exports.string().optional()
-    });
-    ServerOwnedSpacesResponseSchema = external_exports.array(ServerOwnedSpaceSchema);
-    ServerCreateSpaceResponseSchema = external_exports.object({
-      /** Space identifier */
-      id: external_exports.string(),
-      /** Space name */
-      name: external_exports.string(),
-      /** Owner DID */
-      owner: external_exports.string(),
-      /** Creation timestamp */
-      createdAt: external_exports.string().optional()
-    });
-    ServerSpaceInfoResponseSchema = external_exports.object({
-      /** Space identifier */
-      id: external_exports.string(),
-      /** Space name (optional) */
-      name: external_exports.string().optional(),
-      /** Owner DID */
-      owner: external_exports.string(),
-      /** Ownership type */
-      type: external_exports.enum(["owned", "delegated"]).optional(),
-      /** Permissions the user has in this space */
-      permissions: external_exports.array(external_exports.string()).optional(),
-      /** Expiration for delegated access */
-      expiresAt: external_exports.string().optional()
-    });
     EPHEMERAL_MS = 60 * 60 * 1e3;
     SIGNED_READ_URL_MS = 5 * 60 * 1e3;
     SESSION_MS = 7 * 24 * 60 * 60 * 1e3;
@@ -19168,27 +19213,6 @@ var init_dist3 = __esm({
       MAX_MS
     };
     DEFAULT_SIGNED_READ_URL_EXPIRY_MS2 = EXPIRY.SIGNED_READ_URL_MS;
-    DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
-    ManifestValidationError = class extends Error {
-      constructor(message) {
-        super(`Manifest validation failed: ${message}`);
-        this.name = "ManifestValidationError";
-      }
-    };
-    SERVICE_SHORT_TO_LONG = Object.freeze({
-      kv: "tinycloud.kv",
-      sql: "tinycloud.sql",
-      duckdb: "tinycloud.duckdb",
-      capabilities: "tinycloud.capabilities",
-      hooks: "tinycloud.hooks",
-      encryption: "tinycloud.encryption",
-      delegation: "tinycloud.delegation"
-    });
-    SERVICE_LONG_TO_SHORT = Object.freeze(
-      Object.fromEntries(
-        Object.entries(SERVICE_SHORT_TO_LONG).map(([s, l]) => [l, s])
-      )
-    );
     EncodedShareDataSchema = external_exports.object({
       /** Private key in JWK format (must include d parameter) */
       key: JWKSchema.refine(
@@ -19299,7 +19323,346 @@ var init_dist3 = __esm({
         message: "Expected an onRootDelegationNeeded function or undefined"
       }).optional()
     });
+    DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
+    ManifestValidationError = class extends Error {
+      constructor(message) {
+        super(`Manifest validation failed: ${message}`);
+        this.name = "ManifestValidationError";
+      }
+    };
+    SERVICE_SHORT_TO_LONG = Object.freeze({
+      kv: "tinycloud.kv",
+      sql: "tinycloud.sql",
+      duckdb: "tinycloud.duckdb",
+      capabilities: "tinycloud.capabilities",
+      hooks: "tinycloud.hooks",
+      encryption: "tinycloud.encryption",
+      delegation: "tinycloud.delegation"
+    });
+    SERVICE_LONG_TO_SHORT = Object.freeze(
+      Object.fromEntries(
+        Object.entries(SERVICE_SHORT_TO_LONG).map(([s, l]) => [l, s])
+      )
+    );
+    DEFAULT_MAX_INLINE_BYTES = 256 * 1024;
+    MAX_SHARE_CONTENT_BYTES = 100 * 1024 * 1024;
+    MAX_SEALED_SHARE_CONTENT_BYTES = MAX_SHARE_CONTENT_BYTES + 29;
+    MAX_SHARE_ARTIFACT_BYTES = Math.ceil(MAX_SEALED_SHARE_CONTENT_BYTES * 4 / 3) + 2 * 1024 * 1024;
+    PUBLISHED_AAD = new TextEncoder().encode("tinycloud-share-envelope-v1");
+    ShareRecipientTargetSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("exactEmail"), value: external_exports.string().min(1) }).strict(),
+      external_exports.object({ kind: external_exports.literal("emailDomain"), value: external_exports.string().min(1) }).strict(),
+      external_exports.object({ kind: external_exports.literal("bearer") }).strict()
+    ]);
+    ShareResourceSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("exact"), path: external_exports.string().min(1) }).strict(),
+      external_exports.object({ kind: external_exports.literal("prefix"), path: external_exports.string().min(1) }).strict()
+    ]);
+    ShareActionSchema = external_exports.enum(["read", "list", "edit"]);
+    ShareRecipientPolicySchema = external_exports.object({
+      recipientMatcher: ShareRecipientTargetSchema,
+      spaceId: external_exports.string().min(1),
+      resource: ShareResourceSchema,
+      actions: external_exports.array(ShareActionSchema).min(1),
+      expiresAt: external_exports.date()
+    }).strict();
+    ShareRecipientClientOptionsSchema = external_exports.object({
+      trustedOrigins: external_exports.array(external_exports.string().url()).min(1),
+      maxInlineBytes: external_exports.number().int().positive().optional(),
+      maxArtifactBytes: external_exports.number().int().positive().optional(),
+      maxContentBytes: external_exports.number().int().positive().optional(),
+      maxSealedContentBytes: external_exports.number().int().positive().optional()
+    }).strict();
+    ShareNativeActionSchema = external_exports.enum(["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put"]);
+    ShareWireActionSchema = external_exports.enum(["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put", "tinycloud.sql/read"]);
+    ShareContentSourceSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({
+        kind: external_exports.literal("kv"),
+        action: ShareNativeActionSchema,
+        space: external_exports.string().min(1),
+        path: external_exports.string().min(1)
+      }).strict(),
+      external_exports.object({
+        kind: external_exports.literal("sql"),
+        action: external_exports.literal("tinycloud.sql/read"),
+        space: external_exports.string().min(1),
+        database: external_exports.string().min(1),
+        path: external_exports.string().min(1),
+        statement: external_exports.string().min(1),
+        arguments: external_exports.record(external_exports.number().int().safe()),
+        argumentsDigest: external_exports.string().min(1)
+      }).strict()
+    ]);
+    ShareAddressedRecipientSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("exactEmail"), value: external_exports.string().min(1) }).strict(),
+      external_exports.object({ kind: external_exports.literal("emailDomain"), value: external_exports.string().min(1) }).strict()
+    ]);
+    ShareAddressedDelegationRequestV2Schema = external_exports.object({
+      version: external_exports.literal(2),
+      nonce: external_exports.string().min(1),
+      jti: external_exports.string().min(1),
+      senderDid: external_exports.string().min(1),
+      recipientMatcher: ShareAddressedRecipientSchema,
+      targetOrigin: external_exports.string().url(),
+      nodeAudience: external_exports.string().min(1),
+      shareCid: external_exports.string().min(1),
+      shareId: external_exports.string().min(1),
+      delegationCid: external_exports.string().min(1),
+      authorityMaterialHandle: external_exports.string().min(1),
+      authorityMaterialDigest: external_exports.string().min(1),
+      contentSource: ShareContentSourceSchema,
+      contentSourceDigest: external_exports.string().min(1),
+      actions: external_exports.array(ShareWireActionSchema).min(1).refine((actions) => new Set(actions).size === actions.length),
+      resource: external_exports.object({ kind: external_exports.enum(["exact", "prefix"]), value: external_exports.string().min(1) }).strict(),
+      expiresAt: external_exports.string().datetime({ offset: true }),
+      requestBodyDigest: external_exports.string().min(1)
+    }).strict();
+    ShareAddressedDelegationEnvelopeV2Schema = external_exports.object({
+      request: ShareAddressedDelegationRequestV2Schema,
+      proof: external_exports.object({ alg: external_exports.literal("EdDSA"), kid: external_exports.string().min(1), signature: external_exports.string().min(1) }).strict()
+    }).strict();
+    ShareAddressedDelegationResponseV2Schema = external_exports.object({
+      type: external_exports.literal("TinyCloudShareAddressedDelegation"),
+      version: external_exports.literal(2),
+      nonce: external_exports.string().min(1),
+      jti: external_exports.string().min(1),
+      policyCid: external_exports.string().min(1),
+      policyBytes: external_exports.string().min(1),
+      policyDigest: external_exports.string().min(1),
+      delegationCid: external_exports.string().min(1),
+      delegationBytes: external_exports.string().min(1),
+      delegationDigest: external_exports.string().min(1),
+      authorityMaterialHandle: external_exports.string().min(1),
+      authorityMaterialDigest: external_exports.string().min(1),
+      actions: external_exports.array(ShareWireActionSchema).min(1).refine((actions) => new Set(actions).size === actions.length),
+      resource: external_exports.object({ kind: external_exports.enum(["exact", "prefix"]), value: external_exports.string().min(1) }).strict(),
+      expiresAt: external_exports.string().datetime({ offset: true }),
+      proof: external_exports.object({ alg: external_exports.literal("EdDSA"), kid: external_exports.string().min(1), signature: external_exports.string().min(1) }).strict()
+    }).strict();
+    ShareNativeResponseEntrySchema = external_exports.object({
+      path: external_exports.string().min(1),
+      kind: external_exports.enum(["file", "folder"])
+    }).strict();
+    ShareNativeResponseBase = {
+      type: external_exports.literal("TinyCloudShareInvokeResponse"),
+      version: external_exports.literal(2),
+      resource: external_exports.string().min(1)
+    };
+    ShareNativeResponseSchema = external_exports.discriminatedUnion("action", [
+      external_exports.object({
+        ...ShareNativeResponseBase,
+        action: external_exports.literal("tinycloud.kv/metadata"),
+        metadata: external_exports.record(external_exports.string()),
+        etag: external_exports.string().min(1).nullable()
+      }).strict(),
+      external_exports.object({
+        ...ShareNativeResponseBase,
+        action: external_exports.literal("tinycloud.kv/get"),
+        mediaType: external_exports.string().min(1),
+        content: external_exports.string(),
+        bodyDigest: external_exports.string().min(1),
+        etag: external_exports.string().min(1).nullable()
+      }).strict(),
+      external_exports.object({
+        ...ShareNativeResponseBase,
+        action: external_exports.literal("tinycloud.kv/list"),
+        entries: external_exports.array(ShareNativeResponseEntrySchema),
+        nextCursor: external_exports.string().min(1).nullable()
+      }).strict(),
+      external_exports.object({
+        ...ShareNativeResponseBase,
+        action: external_exports.literal("tinycloud.kv/put"),
+        etag: external_exports.string().min(1),
+        bodyDigest: external_exports.string().min(1),
+        contentType: external_exports.string().min(1)
+      }).strict()
+    ]);
+    MAX_NATIVE_CURSOR_BYTES = 8 * 1024;
     DEFAULT_EXPIRY_MS2 = EXPIRY.SHARE_MS;
+    MAX_CONTENT_BYTES = 100 * 1024 * 1024;
+    ethereumAddressPattern = /^0x[a-fA-F0-9]{40}$/;
+    EnsDataSchema2 = external_exports.object({
+      /** ENS name/domain. */
+      domain: external_exports.string().nullable().optional(),
+      /** ENS avatar URL. */
+      avatarUrl: external_exports.string().nullable().optional()
+    });
+    PersistedTinyCloudSessionSchema = external_exports.object({
+      /** The delegation header containing the UCAN */
+      delegationHeader: external_exports.object({
+        Authorization: external_exports.string()
+      }),
+      /** The delegation CID */
+      delegationCid: external_exports.string(),
+      /** The space ID for this session */
+      spaceId: external_exports.string(),
+      /** Additional spaces included in this session's capabilities. Key is logical name, value is full spaceId URI */
+      spaces: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+      /** The verification method DID */
+      verificationMethod: external_exports.string()
+    });
+    PersistedSessionDataSchema = external_exports.object({
+      /** User's Ethereum address */
+      address: external_exports.string().regex(ethereumAddressPattern, "Invalid Ethereum address"),
+      /** EIP-155 Chain ID */
+      chainId: external_exports.number().int().positive(),
+      /** Session key in JWK format (stringified) */
+      sessionKey: external_exports.string(),
+      /** The signed SIWE message */
+      siwe: external_exports.string(),
+      /** User's signature of the SIWE message */
+      signature: external_exports.string(),
+      /** TinyCloud delegation data if available */
+      tinycloudSession: PersistedTinyCloudSessionSchema.optional(),
+      /** Session expiration timestamp (ISO 8601 with timezone offset) */
+      expiresAt: external_exports.string().datetime({ offset: true }),
+      /** Session creation timestamp (ISO 8601 with timezone offset) */
+      createdAt: external_exports.string().datetime({ offset: true }),
+      /** Schema version for migrations */
+      version: external_exports.string(),
+      /** Optional ENS data */
+      ens: EnsDataSchema2.optional(),
+      /**
+       * TinyCloud hosts this session was created against. Persisted so a
+       * restored session resolves to the same node without re-running the
+       * registry/fallback resolution (or the wallet sign-in flow). Optional
+       * for backward compatibility with sessions persisted before this field
+       * existed — those restore and lazily re-resolve their hosts.
+       */
+      tinycloudHosts: external_exports.array(external_exports.string()).optional()
+    });
+    TinyCloudSessionSchema = external_exports.object({
+      /** User's Ethereum address */
+      address: external_exports.string().regex(ethereumAddressPattern, "Invalid Ethereum address"),
+      /** EIP-155 Chain ID */
+      chainId: external_exports.number().int().positive(),
+      /** Session key ID */
+      sessionKey: external_exports.string(),
+      /** The space ID for this session */
+      spaceId: external_exports.string(),
+      /** Additional spaces included in this session's capabilities. Key is logical name, value is full spaceId URI */
+      spaces: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+      /** The delegation CID */
+      delegationCid: external_exports.string(),
+      /** The delegation header for API calls */
+      delegationHeader: external_exports.object({
+        Authorization: external_exports.string()
+      }),
+      /** The verification method DID */
+      verificationMethod: external_exports.string(),
+      /** The session key JWK (required for invoke operations) */
+      jwk: external_exports.object({}).passthrough(),
+      /** The signed SIWE message */
+      siwe: external_exports.string(),
+      /** User's signature of the SIWE message */
+      signature: external_exports.string()
+    });
+    SpaceConfigSchema = external_exports.object({
+      /** The space identifier (full URI) */
+      id: external_exports.string(),
+      /** The short name of the space */
+      name: external_exports.string(),
+      /** Factory function to create a space-scoped KV service */
+      createKV: external_exports.function(),
+      /** Factory function to create a space-scoped Data Vault service */
+      createVault: external_exports.function(),
+      /** Optional factory function to create a space-scoped secrets service */
+      createSecrets: external_exports.function().optional(),
+      /** Factory function to create space-scoped delegations */
+      createDelegations: external_exports.function(),
+      /** Factory function to create space-scoped sharing */
+      createSharing: external_exports.function(),
+      /** Function to get space info */
+      getInfo: external_exports.function()
+    });
+    SpaceServiceConfigSchema = external_exports.object({
+      /** TinyCloud host URLs */
+      hosts: external_exports.array(external_exports.string()),
+      /** Active session for authentication */
+      session: external_exports.unknown(),
+      /** Platform-specific invoke function */
+      invoke: external_exports.function(),
+      /** Optional custom fetch implementation */
+      fetch: external_exports.function().optional(),
+      /** Optional capability key registry for delegated space discovery */
+      capabilityRegistry: external_exports.unknown().optional(),
+      /** Factory function to create a space-scoped KV service */
+      createKVService: external_exports.function().optional(),
+      /** Factory function to create a space-scoped Data Vault service */
+      createVaultService: external_exports.function().optional(),
+      /** Factory function to create a space-scoped secrets service */
+      createSecretsService: external_exports.function().optional(),
+      /** User's PKH DID (derived from address or provided explicitly) */
+      userDid: external_exports.string().optional(),
+      /** Optional SharingService for v2 sharing links (client-side) */
+      sharingService: external_exports.unknown().optional(),
+      /** Factory function to create delegations using SIWE-based flow */
+      createDelegation: external_exports.function().optional()
+    });
+    SpaceDelegationParamsSchema = CreateDelegationParamsSchema.extend({
+      /** The space ID to create the delegation for */
+      spaceId: external_exports.string()
+    });
+    ServerDelegationInfoSchema = external_exports.object({
+      /** DID of the delegator */
+      delegator: external_exports.string(),
+      /** DID of the delegate */
+      delegate: external_exports.string(),
+      /** Parent delegation CIDs - accepts string or byte array format from server */
+      parents: external_exports.array(external_exports.union([external_exports.string(), external_exports.array(external_exports.number())])),
+      /** Expiration time (ISO8601 string) */
+      expiry: external_exports.string().optional(),
+      /** Not-before time (ISO8601 string) */
+      not_before: external_exports.string().optional(),
+      /** Issued-at time (ISO8601 string) */
+      issued_at: external_exports.string().optional(),
+      /** Capabilities granted by this delegation */
+      capabilities: external_exports.array(
+        external_exports.object({
+          resource: external_exports.string(),
+          ability: external_exports.string()
+        })
+      )
+    });
+    ServerDelegationsResponseSchema = external_exports.record(
+      external_exports.string(),
+      ServerDelegationInfoSchema
+    );
+    ServerOwnedSpaceSchema = external_exports.object({
+      /** Space identifier */
+      id: external_exports.string(),
+      /** Space name (optional, can be derived from id) */
+      name: external_exports.string().optional(),
+      /** Owner DID */
+      owner: external_exports.string(),
+      /** Creation timestamp */
+      createdAt: external_exports.string().optional()
+    });
+    ServerOwnedSpacesResponseSchema = external_exports.array(ServerOwnedSpaceSchema);
+    ServerCreateSpaceResponseSchema = external_exports.object({
+      /** Space identifier */
+      id: external_exports.string(),
+      /** Space name */
+      name: external_exports.string(),
+      /** Owner DID */
+      owner: external_exports.string(),
+      /** Creation timestamp */
+      createdAt: external_exports.string().optional()
+    });
+    ServerSpaceInfoResponseSchema = external_exports.object({
+      /** Space identifier */
+      id: external_exports.string(),
+      /** Space name (optional) */
+      name: external_exports.string().optional(),
+      /** Owner DID */
+      owner: external_exports.string(),
+      /** Ownership type */
+      type: external_exports.enum(["owned", "delegated"]).optional(),
+      /** Permissions the user has in this space */
+      permissions: external_exports.array(external_exports.string()).optional(),
+      /** Expiration for delegated access */
+      expiresAt: external_exports.string().optional()
+    });
     AutoApproveSpaceCreationHandler = class {
       /**
        * Always returns true to auto-approve space creation.
@@ -19419,15 +19782,15 @@ var init_dist3 = __esm({
     CODE_MEMORY = 777;
     ip4ToBytes = function(ip) {
       ip = ip.toString().trim();
-      const bytes = new Uint8Array(4);
+      const bytes2 = new Uint8Array(4);
       ip.split(/\./g).forEach((byte, index) => {
         const value = parseInt(byte, 10);
         if (isNaN(value) || value < 0 || value > 255) {
           throw new InvalidMultiaddrError("Invalid byte value in IP address");
         }
-        bytes[index] = value;
+        bytes2[index] = value;
       });
-      return bytes;
+      return bytes2;
     };
     ip6ToBytes = function(ip) {
       let offset = 0;
@@ -19462,7 +19825,7 @@ var init_dist3 = __esm({
         }
         sections.splice.apply(sections, argv);
       }
-      const bytes = new Uint8Array(offset + 16);
+      const bytes2 = new Uint8Array(offset + 16);
       for (i = 0; i < sections.length; i++) {
         if (sections[i] === "") {
           sections[i] = "0";
@@ -19471,10 +19834,10 @@ var init_dist3 = __esm({
         if (isNaN(word2) || word2 < 0 || word2 > 65535) {
           throw new InvalidMultiaddrError("Invalid byte value in IP address");
         }
-        bytes[offset++] = word2 >> 8 & 255;
-        bytes[offset++] = word2 & 255;
+        bytes2[offset++] = word2 >> 8 & 255;
+        bytes2[offset++] = word2 & 255;
       }
-      return bytes;
+      return bytes2;
     };
     ip4ToString = function(buf) {
       if (buf.byteLength !== 4) {
@@ -19537,8 +19900,8 @@ var init_dist3 = __esm({
           this.protocolsByName.set(alias, codec);
         });
       }
-      removeProtocol(code2) {
-        const codec = this.protocolsByCode.get(code2);
+      removeProtocol(code3) {
+        const codec = this.protocolsByCode.get(code3);
         if (codec == null) {
           return;
         }
@@ -19796,10 +20159,10 @@ var init_dist3 = __esm({
           validate: false
         });
       }
-      decapsulateCode(code2) {
+      decapsulateCode(code3) {
         let index;
         for (let i = __privateGet(this, _components).length - 1; i > -1; i--) {
-          if (__privateGet(this, _components)[i].code === code2) {
+          if (__privateGet(this, _components)[i].code === code3) {
             index = i;
             break;
           }
@@ -23025,7 +23388,7 @@ function execCapturedCommand(command) {
       stdio: "inherit"
     });
     child.on("error", reject);
-    child.on("exit", (code2, signal) => {
+    child.on("exit", (code, signal) => {
       if (signal) {
         reject(new CLIError(
           "COMMAND_SIGNAL",
@@ -23034,8 +23397,8 @@ function execCapturedCommand(command) {
         ));
         return;
       }
-      if (code2 && code2 !== 0) {
-        process.exitCode = code2;
+      if (code && code !== 0) {
+        process.exitCode = code;
       }
       resolve3();
     });
@@ -24935,8 +25298,8 @@ function shouldRequestSecretPermissions(error) {
 function thrownPermissionError(error) {
   const record = error;
   const message = typeof record?.message === "string" ? record.message : String(error);
-  const code2 = typeof record?.code === "string" ? record.code : "PERMISSION_DENIED";
-  if (code2 !== "PERMISSION_DENIED" && !/permission|session expired|autosign|capabilit/i.test(message)) {
+  const code = typeof record?.code === "string" ? record.code : "PERMISSION_DENIED";
+  if (code !== "PERMISSION_DENIED" && !/permission|session expired|autosign|capabilit/i.test(message)) {
     return null;
   }
   return {
@@ -25144,9 +25507,9 @@ async function resolveDelegatedSecretSource(source, secretPath, space = SECRETS_
   return { ...selected, source };
 }
 function mapEncryptionResultError(error) {
-  const code2 = error.code || "DECRYPTION_FAILED";
-  const exitCode = code2 === "PERMISSION_DENIED" ? ExitCode.PERMISSION_DENIED : code2 === "NOT_FOUND" ? ExitCode.NOT_FOUND : code2 === "NETWORK_ERROR" || code2 === "TRANSPORT_ERROR" ? ExitCode.NETWORK_ERROR : ExitCode.ERROR;
-  return new CLIError(code2, error.message, exitCode);
+  const code = error.code || "DECRYPTION_FAILED";
+  const exitCode = code === "PERMISSION_DENIED" ? ExitCode.PERMISSION_DENIED : code === "NOT_FOUND" ? ExitCode.NOT_FOUND : code === "NETWORK_ERROR" || code === "TRANSPORT_ERROR" ? ExitCode.NETWORK_ERROR : ExitCode.ERROR;
+  return new CLIError(code, error.message, exitCode);
 }
 function parseDecryptedSecretPayload(data, secretPath) {
   const text = new TextDecoder().decode(data);