@tinycloud/node-sdk 2.2.0-beta.5 → 2.2.0-beta.7

package/dist/core.cjs

@@ -20,70 +20,71 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/core.ts
 var core_exports = {};
 __export(core_exports, {
-  ACCOUNT_REGISTRY_PATH: () => import_sdk_core8.ACCOUNT_REGISTRY_PATH,
-  ACCOUNT_REGISTRY_SPACE: () => import_sdk_core8.ACCOUNT_REGISTRY_SPACE,
-  AutoApproveSpaceCreationHandler: () => import_sdk_core7.AutoApproveSpaceCreationHandler,
-  CapabilityKeyRegistry: () => import_sdk_core14.CapabilityKeyRegistry,
-  CapabilityKeyRegistryErrorCodes: () => import_sdk_core14.CapabilityKeyRegistryErrorCodes,
-  DEFAULT_MANIFEST_SPACE: () => import_sdk_core8.DEFAULT_MANIFEST_SPACE,
-  DEFAULT_MANIFEST_VERSION: () => import_sdk_core8.DEFAULT_MANIFEST_VERSION,
-  DataVaultService: () => import_sdk_core12.DataVaultService,
-  DatabaseHandle: () => import_sdk_core10.DatabaseHandle,
+  ACCOUNT_REGISTRY_PATH: () => import_sdk_core9.ACCOUNT_REGISTRY_PATH,
+  ACCOUNT_REGISTRY_SPACE: () => import_sdk_core9.ACCOUNT_REGISTRY_SPACE,
+  AutoApproveSpaceCreationHandler: () => import_sdk_core8.AutoApproveSpaceCreationHandler,
+  CapabilityKeyRegistry: () => import_sdk_core15.CapabilityKeyRegistry,
+  CapabilityKeyRegistryErrorCodes: () => import_sdk_core15.CapabilityKeyRegistryErrorCodes,
+  DEFAULT_MANIFEST_SPACE: () => import_sdk_core9.DEFAULT_MANIFEST_SPACE,
+  DEFAULT_MANIFEST_VERSION: () => import_sdk_core9.DEFAULT_MANIFEST_VERSION,
+  DataVaultService: () => import_sdk_core13.DataVaultService,
+  DatabaseHandle: () => import_sdk_core11.DatabaseHandle,
   DelegatedAccess: () => DelegatedAccess,
-  DelegationErrorCodes: () => import_sdk_core13.DelegationErrorCodes,
-  DelegationManager: () => import_sdk_core13.DelegationManager,
-  DuckDbAction: () => import_sdk_core11.DuckDbAction,
-  DuckDbDatabaseHandle: () => import_sdk_core11.DuckDbDatabaseHandle,
-  DuckDbService: () => import_sdk_core11.DuckDbService,
+  DelegationErrorCodes: () => import_sdk_core14.DelegationErrorCodes,
+  DelegationManager: () => import_sdk_core14.DelegationManager,
+  DuckDbAction: () => import_sdk_core12.DuckDbAction,
+  DuckDbDatabaseHandle: () => import_sdk_core12.DuckDbDatabaseHandle,
+  DuckDbService: () => import_sdk_core12.DuckDbService,
   FileSessionStorage: () => FileSessionStorage,
-  KVService: () => import_sdk_core9.KVService,
-  ManifestValidationError: () => import_sdk_core8.ManifestValidationError,
+  KVService: () => import_sdk_core10.KVService,
+  ManifestValidationError: () => import_sdk_core9.ManifestValidationError,
   MemorySessionStorage: () => MemorySessionStorage,
   NodeUserAuthorization: () => NodeUserAuthorization,
-  PermissionNotInManifestError: () => import_sdk_core8.PermissionNotInManifestError,
-  PrefixedKVService: () => import_sdk_core9.PrefixedKVService,
-  ProtocolMismatchError: () => import_sdk_core16.ProtocolMismatchError,
-  SQLAction: () => import_sdk_core10.SQLAction,
-  SQLService: () => import_sdk_core10.SQLService,
-  ServiceContext: () => import_sdk_core17.ServiceContext,
-  SessionExpiredError: () => import_sdk_core8.SessionExpiredError,
-  SharingService: () => import_sdk_core13.SharingService,
-  SilentNotificationHandler: () => import_sdk_core7.SilentNotificationHandler,
-  Space: () => import_sdk_core15.Space,
-  SpaceErrorCodes: () => import_sdk_core15.SpaceErrorCodes,
-  SpaceService: () => import_sdk_core15.SpaceService,
-  TinyCloud: () => import_sdk_core6.TinyCloud,
+  PermissionNotInManifestError: () => import_sdk_core9.PermissionNotInManifestError,
+  PrefixedKVService: () => import_sdk_core10.PrefixedKVService,
+  ProtocolMismatchError: () => import_sdk_core17.ProtocolMismatchError,
+  SQLAction: () => import_sdk_core11.SQLAction,
+  SQLService: () => import_sdk_core11.SQLService,
+  SecretsService: () => import_sdk_core13.SecretsService,
+  ServiceContext: () => import_sdk_core18.ServiceContext,
+  SessionExpiredError: () => import_sdk_core9.SessionExpiredError,
+  SharingService: () => import_sdk_core14.SharingService,
+  SilentNotificationHandler: () => import_sdk_core8.SilentNotificationHandler,
+  Space: () => import_sdk_core16.Space,
+  SpaceErrorCodes: () => import_sdk_core16.SpaceErrorCodes,
+  SpaceService: () => import_sdk_core16.SpaceService,
+  TinyCloud: () => import_sdk_core7.TinyCloud,
   TinyCloudNode: () => TinyCloudNode,
-  UnsupportedFeatureError: () => import_sdk_core16.UnsupportedFeatureError,
-  VaultHeaders: () => import_sdk_core12.VaultHeaders,
-  VaultPublicSpaceKVActions: () => import_sdk_core12.VaultPublicSpaceKVActions,
-  VersionCheckError: () => import_sdk_core16.VersionCheckError,
+  UnsupportedFeatureError: () => import_sdk_core17.UnsupportedFeatureError,
+  VaultHeaders: () => import_sdk_core13.VaultHeaders,
+  VaultPublicSpaceKVActions: () => import_sdk_core13.VaultPublicSpaceKVActions,
+  VersionCheckError: () => import_sdk_core17.VersionCheckError,
   WasmKeyProvider: () => WasmKeyProvider,
-  buildSpaceUri: () => import_sdk_core15.buildSpaceUri,
-  checkNodeInfo: () => import_sdk_core16.checkNodeInfo,
-  composeManifestRequest: () => import_sdk_core8.composeManifestRequest,
-  createCapabilityKeyRegistry: () => import_sdk_core14.createCapabilityKeyRegistry,
-  createSharingService: () => import_sdk_core13.createSharingService,
-  createSpaceService: () => import_sdk_core15.createSpaceService,
-  createVaultCrypto: () => import_sdk_core12.createVaultCrypto,
+  buildSpaceUri: () => import_sdk_core16.buildSpaceUri,
+  checkNodeInfo: () => import_sdk_core17.checkNodeInfo,
+  composeManifestRequest: () => import_sdk_core9.composeManifestRequest,
+  createCapabilityKeyRegistry: () => import_sdk_core15.createCapabilityKeyRegistry,
+  createSharingService: () => import_sdk_core14.createSharingService,
+  createSpaceService: () => import_sdk_core16.createSpaceService,
+  createVaultCrypto: () => import_sdk_core13.createVaultCrypto,
   createWasmKeyProvider: () => createWasmKeyProvider,
   defaultSignStrategy: () => defaultSignStrategy,
-  defaultSpaceCreationHandler: () => import_sdk_core7.defaultSpaceCreationHandler,
+  defaultSpaceCreationHandler: () => import_sdk_core8.defaultSpaceCreationHandler,
   deserializeDelegation: () => deserializeDelegation,
-  expandActionShortNames: () => import_sdk_core8.expandActionShortNames,
-  isCapabilitySubset: () => import_sdk_core8.isCapabilitySubset,
-  loadManifest: () => import_sdk_core8.loadManifest,
-  makePublicSpaceId: () => import_sdk_core15.makePublicSpaceId,
-  parseExpiry: () => import_sdk_core8.parseExpiry,
-  parseSpaceUri: () => import_sdk_core15.parseSpaceUri,
-  resolveManifest: () => import_sdk_core8.resolveManifest,
-  resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core8.resourceCapabilitiesToSpaceAbilitiesMap,
+  expandActionShortNames: () => import_sdk_core9.expandActionShortNames,
+  isCapabilitySubset: () => import_sdk_core9.isCapabilitySubset,
+  loadManifest: () => import_sdk_core9.loadManifest,
+  makePublicSpaceId: () => import_sdk_core16.makePublicSpaceId,
+  parseExpiry: () => import_sdk_core9.parseExpiry,
+  parseSpaceUri: () => import_sdk_core16.parseSpaceUri,
+  resolveManifest: () => import_sdk_core9.resolveManifest,
+  resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core9.resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation: () => serializeDelegation,
-  validateManifest: () => import_sdk_core8.validateManifest
+  validateManifest: () => import_sdk_core9.validateManifest
 });
 module.exports = __toCommonJS(core_exports);
-var import_sdk_core6 = require("@tinycloud/sdk-core");
 var import_sdk_core7 = require("@tinycloud/sdk-core");
+var import_sdk_core8 = require("@tinycloud/sdk-core");
 
 // src/storage/MemorySessionStorage.ts
 var MemorySessionStorage = class {
@@ -1019,7 +1020,7 @@ var NodeUserAuthorization = class {
 };
 
 // src/TinyCloudNode.ts
-var import_sdk_core5 = require("@tinycloud/sdk-core");
+var import_sdk_core6 = require("@tinycloud/sdk-core");
 
 // src/DelegatedAccess.ts
 var import_sdk_core3 = require("@tinycloud/sdk-core");
@@ -1252,6 +1253,176 @@ function extractSiweExpiration(siwe) {
   return d;
 }
 
+// src/NodeSecretsService.ts
+var import_sdk_core5 = require("@tinycloud/sdk-core");
+var SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
+var SECRET_PREFIX = "secrets/";
+var SECRETS_SPACE = "secrets";
+function ok() {
+  return { ok: true, data: void 0 };
+}
+function secretsError(code, message, cause) {
+  return {
+    ok: false,
+    error: {
+      code,
+      service: "secrets",
+      message,
+      ...cause ? { cause } : {}
+    }
+  };
+}
+function actionUrn(action) {
+  return `tinycloud.kv/${action}`;
+}
+function secretResourcePath(base, name) {
+  return `${base}/${SECRET_PREFIX}${name}`;
+}
+function secretPermissionEntries(name, action) {
+  return [
+    {
+      service: "tinycloud.kv",
+      space: SECRETS_SPACE,
+      path: secretResourcePath("keys", name),
+      actions: [action],
+      skipPrefix: true
+    },
+    {
+      service: "tinycloud.kv",
+      space: SECRETS_SPACE,
+      path: secretResourcePath("vault", name),
+      actions: [action],
+      skipPrefix: true
+    }
+  ];
+}
+function isSecretsSpace(space) {
+  return space === SECRETS_SPACE || space.endsWith(`:${SECRETS_SPACE}`);
+}
+function composeEscalatedManifest(manifest, additional) {
+  if (Array.isArray(manifest)) {
+    const [primary, ...rest] = manifest;
+    return [
+      {
+        ...primary,
+        permissions: [...primary.permissions ?? [], ...additional]
+      },
+      ...rest
+    ];
+  }
+  return {
+    ...manifest,
+    permissions: [...manifest.permissions ?? [], ...additional]
+  };
+}
+var NodeSecretsService = class {
+  constructor(config) {
+    this.config = config;
+    this.shouldRestoreUnlock = false;
+  }
+  get vault() {
+    return this.service.vault;
+  }
+  get isUnlocked() {
+    return this.service.isUnlocked;
+  }
+  async unlock(signer) {
+    if (signer !== void 0) {
+      this.unlockSigner = signer;
+    }
+    const result = await this.service.unlock(signer);
+    if (result.ok) {
+      this.shouldRestoreUnlock = true;
+    }
+    return result;
+  }
+  lock() {
+    this.shouldRestoreUnlock = false;
+    this.service.lock();
+  }
+  get(name) {
+    return this.service.get(name);
+  }
+  async put(name, value) {
+    const permission = await this.ensureMutationPermission(name, "put");
+    if (!permission.ok) return permission;
+    return this.service.put(name, value);
+  }
+  async delete(name) {
+    const permission = await this.ensureMutationPermission(name, "del");
+    if (!permission.ok) return permission;
+    return this.service.delete(name);
+  }
+  list() {
+    return this.service.list();
+  }
+  get service() {
+    return this.config.getService();
+  }
+  async ensureMutationPermission(name, action) {
+    if (!SECRET_NAME_RE.test(name)) {
+      return secretsError(
+        import_sdk_core5.ErrorCodes.INVALID_INPUT,
+        `Invalid secret name ${JSON.stringify(name)}. Secret names must match ${SECRET_NAME_RE.source}.`
+      );
+    }
+    if (this.hasMutationPermission(name, action)) {
+      return ok();
+    }
+    if (!this.config.canEscalate()) {
+      return secretsError(
+        import_sdk_core5.ErrorCodes.PERMISSION_DENIED,
+        `Cannot autosign ${actionUrn(action)} for ${name}; TinyCloudNode needs wallet mode with a signer or privateKey.`
+      );
+    }
+    const manifest = this.config.getManifest();
+    if (manifest === void 0) {
+      return secretsError(
+        import_sdk_core5.ErrorCodes.PERMISSION_DENIED,
+        `Cannot autosign ${actionUrn(action)} for ${name}; set a manifest before mutating secrets.`
+      );
+    }
+    try {
+      this.config.setManifest(
+        composeEscalatedManifest(
+          manifest,
+          secretPermissionEntries(name, action)
+        )
+      );
+      await this.config.signIn();
+      return this.restoreUnlockAfterEscalation();
+    } catch (error) {
+      return secretsError(
+        import_sdk_core5.ErrorCodes.PERMISSION_DENIED,
+        error instanceof Error ? error.message : `Autosign escalation for ${actionUrn(action)} on ${name} failed.`,
+        error instanceof Error ? error : void 0
+      );
+    }
+  }
+  async restoreUnlockAfterEscalation() {
+    if (!this.shouldRestoreUnlock) {
+      return ok();
+    }
+    return this.service.unlock(this.unlockSigner);
+  }
+  hasMutationPermission(name, action) {
+    const manifest = this.config.getManifest();
+    if (manifest === void 0) {
+      return false;
+    }
+    const manifests = Array.isArray(manifest) ? manifest : [manifest];
+    const requiredAction = actionUrn(action);
+    return manifests.some((entry) => {
+      const resolved = (0, import_sdk_core5.resolveManifest)(entry);
+      return ["keys", "vault"].every(
+        (base) => resolved.resources.some(
+          (resource) => resource.service === "tinycloud.kv" && isSecretsSpace(resource.space) && resource.path === secretResourcePath(base, name) && resource.actions.includes(requiredAction)
+        )
+      );
+    });
+  }
+};
+
 // src/TinyCloudNode.ts
 var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var _TinyCloudNode = class _TinyCloudNode {
@@ -1310,12 +1481,12 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Failed to get session key JWK");
     }
     this.sessionKeyJwk = JSON.parse(jwkStr);
-    this._capabilityRegistry = new import_sdk_core5.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core6.CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({
       sessionManager: this.sessionManager
     });
-    this.notificationHandler = config.notificationHandler ?? new import_sdk_core5.SilentNotificationHandler();
-    this._sharingService = new import_sdk_core5.SharingService({
+    this.notificationHandler = config.notificationHandler ?? new import_sdk_core6.SilentNotificationHandler();
+    this._sharingService = new import_sdk_core6.SharingService({
       hosts: [this.config.host],
       // session: undefined - not needed for receive()
       invoke: this.wasmBindings.invoke,
@@ -1325,8 +1496,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       // delegationManager: undefined - not needed for receive()
       createKVService: (config2) => {
         const prefix = config2.pathPrefix?.replace(/\/$/, "");
-        const kvService = new import_sdk_core5.KVService({ prefix });
-        const kvContext = new import_sdk_core5.ServiceContext({
+        const kvService = new import_sdk_core6.KVService({ prefix });
+        const kvContext = new import_sdk_core6.ServiceContext({
           invoke: config2.invoke,
           fetch: config2.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config2.hosts
@@ -1385,7 +1556,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       capabilityRequest: config.capabilityRequest,
       includeAccountRegistryPermissions: config.includeAccountRegistryPermissions
     });
-    this.tc = new import_sdk_core5.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core6.TinyCloud(this.auth, {
       invokeAny: this.wasmBindings.invokeAny
     });
   }
@@ -1506,6 +1677,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._sql = void 0;
     this._duckdb = void 0;
     this._hooks = void 0;
+    this._vault = void 0;
+    this._baseSecrets = void 0;
+    this._secrets = void 0;
+    this._spaceService = void 0;
     this._serviceContext = void 0;
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
@@ -1527,7 +1702,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.signer) {
       throw new Error("Manifest registry write requires wallet mode");
     }
-    const accountSpaceId = this.ownedSpaceId(import_sdk_core5.ACCOUNT_REGISTRY_SPACE);
+    const accountSpaceId = this.ownedSpaceId(import_sdk_core6.ACCOUNT_REGISTRY_SPACE);
     await this.ensureOwnedSpaceHosted(accountSpaceId);
     const accountKV = this.spaces.get(accountSpaceId).kv;
     for (const record of request.registryRecords) {
@@ -1555,7 +1730,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!host) {
       throw new Error("Owned space hosting requires a TinyCloud host");
     }
-    const activation = await (0, import_sdk_core5.activateSessionWithHost)(host, session.delegationHeader);
+    const activation = await (0, import_sdk_core6.activateSessionWithHost)(host, session.delegationHeader);
     if (activation.success && !activation.skipped?.includes(spaceId)) {
       return;
     }
@@ -1569,7 +1744,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error(`Failed to create owned space: ${spaceId}`);
     }
     await new Promise((resolve) => setTimeout(resolve, 100));
-    const retry = await (0, import_sdk_core5.activateSessionWithHost)(host, session.delegationHeader);
+    const retry = await (0, import_sdk_core6.activateSessionWithHost)(host, session.delegationHeader);
     if (!retry.success || retry.skipped?.includes(spaceId)) {
       throw new Error(
         `Failed to activate session after creating owned space ${spaceId}: ${retry.error ?? "space was skipped"}`
@@ -1591,6 +1766,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._sql = void 0;
     this._duckdb = void 0;
     this._hooks = void 0;
+    this._vault = void 0;
+    this._baseSecrets = void 0;
+    this._secrets = void 0;
+    this._spaceService = void 0;
     this._serviceContext = void 0;
     if (sessionData.address) {
       this._address = sessionData.address;
@@ -1598,22 +1777,22 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (sessionData.chainId) {
       this._chainId = sessionData.chainId;
     }
-    this._serviceContext = new import_sdk_core5.ServiceContext({
+    this._serviceContext = new import_sdk_core6.ServiceContext({
       invoke: this.wasmBindings.invoke,
       invokeAny: this.wasmBindings.invokeAny,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [this.config.host]
     });
-    this._kv = new import_sdk_core5.KVService({});
+    this._kv = new import_sdk_core6.KVService({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
-    this._sql = new import_sdk_core5.SQLService({});
+    this._sql = new import_sdk_core6.SQLService({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
-    this._duckdb = new import_sdk_core5.DuckDbService({});
+    this._duckdb = new import_sdk_core6.DuckDbService({});
     this._duckdb.initialize(this._serviceContext);
     this._serviceContext.registerService("duckdb", this._duckdb);
-    this._hooks = new import_sdk_core5.HooksService({});
+    this._hooks = new import_sdk_core6.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -1624,41 +1803,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       jwk: sessionData.jwk
     };
     this._serviceContext.setSession(serviceSession);
-    const wasm = this.wasmBindings;
-    const vaultCrypto = (0, import_sdk_core5.createVaultCrypto)({
-      vault_encrypt: wasm.vault_encrypt,
-      vault_decrypt: wasm.vault_decrypt,
-      vault_derive_key: wasm.vault_derive_key,
-      vault_x25519_from_seed: wasm.vault_x25519_from_seed,
-      vault_x25519_dh: wasm.vault_x25519_dh,
-      vault_random_bytes: wasm.vault_random_bytes,
-      vault_sha256: wasm.vault_sha256
-    });
-    const self = this;
-    this._vault = new import_sdk_core5.DataVaultService({
-      spaceId: sessionData.spaceId,
-      crypto: vaultCrypto,
-      tc: {
-        kv: this._kv,
-        ensurePublicSpace: async () => {
-          try {
-            await self.ensurePublicSpace();
-            return { ok: true, data: void 0 };
-          } catch (error) {
-            return { ok: false, error: { code: "STORAGE_ERROR", message: error instanceof Error ? error.message : String(error), service: "vault" } };
-          }
-        },
-        get publicKV() {
-          return self._publicKV ?? self.tc.publicKV;
-        },
-        readPublicSpace: (host, spaceId, key) => import_sdk_core5.TinyCloud.readPublicSpace(host, spaceId, key),
-        makePublicSpaceId: import_sdk_core5.TinyCloud.makePublicSpaceId,
-        did: this.did,
-        address: sessionData.address ?? this._address ?? "",
-        chainId: sessionData.chainId ?? this._chainId,
-        hosts: [this.config.host]
-      }
-    });
+    this._vault = this.createVaultService(sessionData.spaceId, this._kv);
     this._vault.initialize(this._serviceContext);
     this._serviceContext.registerService("vault", this._vault);
     this.initializeV2Services(serviceSession);
@@ -1719,7 +1864,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       capabilityRequest: this.config.capabilityRequest,
       includeAccountRegistryPermissions: this.config.includeAccountRegistryPermissions
     });
-    this.tc = new import_sdk_core5.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core6.TinyCloud(this.auth, {
       invokeAny: this.wasmBindings.invokeAny
     });
     this.config.prefix = prefix;
@@ -1763,7 +1908,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       capabilityRequest: this.config.capabilityRequest,
       includeAccountRegistryPermissions: this.config.includeAccountRegistryPermissions
     });
-    this.tc = new import_sdk_core5.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core6.TinyCloud(this.auth, {
       invokeAny: this.wasmBindings.invokeAny
     });
     this.config.prefix = prefix;
@@ -1778,27 +1923,27 @@ var _TinyCloudNode = class _TinyCloudNode {
       return;
     }
     this.tc.initializeServices(this.wasmBindings.invoke, [this.config.host]);
-    this._serviceContext = new import_sdk_core5.ServiceContext({
+    this._serviceContext = new import_sdk_core6.ServiceContext({
       invoke: this.wasmBindings.invoke,
       invokeAny: this.wasmBindings.invokeAny,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [this.config.host]
     });
-    this._kv = new import_sdk_core5.KVService({});
+    this._kv = new import_sdk_core6.KVService({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
     const features = this.nodeFeatures;
     if (features.length === 0 || features.includes("sql")) {
-      this._sql = new import_sdk_core5.SQLService({});
+      this._sql = new import_sdk_core6.SQLService({});
       this._sql.initialize(this._serviceContext);
       this._serviceContext.registerService("sql", this._sql);
     }
     if (features.length === 0 || features.includes("duckdb")) {
-      this._duckdb = new import_sdk_core5.DuckDbService({});
+      this._duckdb = new import_sdk_core6.DuckDbService({});
       this._duckdb.initialize(this._serviceContext);
       this._serviceContext.registerService("duckdb", this._duckdb);
     }
-    this._hooks = new import_sdk_core5.HooksService({});
+    this._hooks = new import_sdk_core6.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -1810,8 +1955,30 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     this._serviceContext.setSession(serviceSession);
     this.tc.serviceContext.setSession(serviceSession);
+    this._vault = this.createVaultService(session.spaceId, this._kv);
+    this._vault.initialize(this._serviceContext);
+    this._serviceContext.registerService("vault", this._vault);
+    this.initializeV2Services(serviceSession);
+  }
+  createSpaceScopedKVService(spaceId) {
+    const kvService = new import_sdk_core6.KVService({});
+    if (this._serviceContext) {
+      const spaceScopedContext = new import_sdk_core6.ServiceContext({
+        invoke: this._serviceContext.invoke,
+        fetch: this._serviceContext.fetch,
+        hosts: this._serviceContext.hosts
+      });
+      const session = this._serviceContext.session;
+      if (session) {
+        spaceScopedContext.setSession({ ...session, spaceId });
+      }
+      kvService.initialize(spaceScopedContext);
+    }
+    return kvService;
+  }
+  createVaultService(spaceId, kv) {
     const wasm = this.wasmBindings;
-    const vaultCrypto = (0, import_sdk_core5.createVaultCrypto)({
+    const vaultCrypto = (0, import_sdk_core6.createVaultCrypto)({
       vault_encrypt: wasm.vault_encrypt,
       vault_decrypt: wasm.vault_decrypt,
       vault_derive_key: wasm.vault_derive_key,
@@ -1821,11 +1988,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       vault_sha256: wasm.vault_sha256
     });
     const self = this;
-    this._vault = new import_sdk_core5.DataVaultService({
-      spaceId: session.spaceId,
+    return new import_sdk_core6.DataVaultService({
+      spaceId,
       crypto: vaultCrypto,
       tc: {
-        kv: this._kv,
+        kv,
         ensurePublicSpace: async () => {
           try {
             await self.ensurePublicSpace();
@@ -1837,24 +2004,21 @@ var _TinyCloudNode = class _TinyCloudNode {
         get publicKV() {
           return self._publicKV ?? self.tc.publicKV;
         },
-        readPublicSpace: (host, spaceId, key) => import_sdk_core5.TinyCloud.readPublicSpace(host, spaceId, key),
-        makePublicSpaceId: import_sdk_core5.TinyCloud.makePublicSpaceId,
+        readPublicSpace: (host, targetSpaceId, key) => import_sdk_core6.TinyCloud.readPublicSpace(host, targetSpaceId, key),
+        makePublicSpaceId: import_sdk_core6.TinyCloud.makePublicSpaceId,
         did: this.did,
-        address: this._address,
+        address: this._address ?? "",
         chainId: this._chainId,
         hosts: [this.config.host]
       }
     });
-    this._vault.initialize(this._serviceContext);
-    this._serviceContext.registerService("vault", this._vault);
-    this.initializeV2Services(serviceSession);
   }
   /**
    * Initialize the v2 delegation system services.
    * @internal
    */
   initializeV2Services(serviceSession) {
-    this._capabilityRegistry = new import_sdk_core5.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core6.CapabilityKeyRegistry();
     const tcSession = this.auth?.tinyCloudSession;
     if (tcSession && this._address) {
       const sessionKey = {
@@ -1928,13 +2092,13 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       this._capabilityRegistry.registerKey(sessionKey, delegations);
     }
-    this._delegationManager = new import_sdk_core5.DelegationManager({
+    this._delegationManager = new import_sdk_core6.DelegationManager({
       hosts: [this.config.host],
       session: serviceSession,
       invoke: this.wasmBindings.invoke,
       fetch: globalThis.fetch.bind(globalThis)
     });
-    this._spaceService = new import_sdk_core5.SpaceService({
+    this._spaceService = new import_sdk_core6.SpaceService({
       hosts: [this.config.host],
       session: serviceSession,
       invoke: this.wasmBindings.invoke,
@@ -1942,20 +2106,15 @@ var _TinyCloudNode = class _TinyCloudNode {
       capabilityRegistry: this._capabilityRegistry,
       userDid: this.did,
       createKVService: (spaceId) => {
-        const kvService = new import_sdk_core5.KVService({});
+        return this.createSpaceScopedKVService(spaceId);
+      },
+      createVaultService: (spaceId) => {
+        const kvService = this.createSpaceScopedKVService(spaceId);
+        const vaultService = this.createVaultService(spaceId, kvService);
         if (this._serviceContext) {
-          const spaceScopedContext = new import_sdk_core5.ServiceContext({
-            invoke: this._serviceContext.invoke,
-            fetch: this._serviceContext.fetch,
-            hosts: this._serviceContext.hosts
-          });
-          const session = this._serviceContext.session;
-          if (session) {
-            spaceScopedContext.setSession({ ...session, spaceId });
-          }
-          kvService.initialize(spaceScopedContext);
+          vaultService.initialize(this._serviceContext);
         }
-        return kvService;
+        return vaultService;
       },
       // Enable space.delegations.create() via SIWE-based delegation
       createDelegation: async (params) => {
@@ -2096,7 +2255,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...prepared,
         signature
       });
-      const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+      const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
         host,
         delegationSession.delegationHeader
       );
@@ -2163,7 +2322,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._sql) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("sql")) {
-        throw new import_sdk_core5.UnsupportedFeatureError("sql", this.config.host, features);
+        throw new import_sdk_core6.UnsupportedFeatureError("sql", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -2176,7 +2335,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._duckdb) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("duckdb")) {
-        throw new import_sdk_core5.UnsupportedFeatureError("duckdb", this.config.host, features);
+        throw new import_sdk_core6.UnsupportedFeatureError("duckdb", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -2192,6 +2351,33 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return this._vault;
   }
+  /**
+   * App-facing secrets API backed by the `secrets` space vault.
+   */
+  get secrets() {
+    if (!this._spaceService) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    if (!this._secrets) {
+      this._secrets = new NodeSecretsService({
+        getService: () => this.getBaseSecrets(),
+        getManifest: () => this.manifest,
+        setManifest: (manifest) => this.setManifest(manifest),
+        signIn: () => this.signIn(),
+        canEscalate: () => this.signer !== void 0 && this.tc !== void 0
+      });
+    }
+    return this._secrets;
+  }
+  getBaseSecrets() {
+    if (!this._spaceService) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    if (!this._baseSecrets) {
+      this._baseSecrets = new import_sdk_core6.SecretsService(() => this.space("secrets").vault);
+    }
+    return this._baseSecrets;
+  }
   /**
    * Hooks write stream subscription API.
    */
@@ -2330,6 +2516,12 @@ var _TinyCloudNode = class _TinyCloudNode {
   get spaceService() {
     return this.spaces;
   }
+  /**
+   * Get a Space object by short name or full URI.
+   */
+  space(nameOrUri) {
+    return this.spaces.get(nameOrUri);
+  }
   /**
    * Get the SharingService for creating and receiving v2 sharing links.
    *
@@ -2415,7 +2607,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature
     });
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       this.config.host,
       delegationSession.delegationHeader
     );
@@ -2442,8 +2634,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       }]);
     }
     if (this._serviceContext) {
-      const publicKV = new import_sdk_core5.KVService({ prefix: "" });
-      const publicContext = new import_sdk_core5.ServiceContext({
+      const publicKV = new import_sdk_core6.KVService({ prefix: "" });
+      const publicContext = new import_sdk_core6.ServiceContext({
         invoke: this.wasmBindings.invoke,
         fetch: this._serviceContext.fetch,
         hosts: this._serviceContext.hosts
@@ -2568,14 +2760,14 @@ var _TinyCloudNode = class _TinyCloudNode {
   async delegateTo(did, permissions, options) {
     const session = this.auth?.tinyCloudSession;
     if (!session) {
-      throw new import_sdk_core5.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core6.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     const sessionExpiry = extractSiweExpiration(session.siwe);
     if (sessionExpiry !== void 0) {
       const now2 = Date.now();
       const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
       if (sessionExpiry.getTime() <= now2 + marginMs) {
-        throw new import_sdk_core5.SessionExpiredError(sessionExpiry);
+        throw new import_sdk_core6.SessionExpiredError(sessionExpiry);
       }
     }
     if (!Array.isArray(permissions) || permissions.length === 0) {
@@ -2585,7 +2777,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const expandedEntries = permissions.map((entry) => ({
       ...entry,
-      actions: (0, import_sdk_core5.expandActionShortNames)(entry.service, entry.actions)
+      actions: (0, import_sdk_core6.expandActionShortNames)(entry.service, entry.actions)
     }));
     const now = /* @__PURE__ */ new Date();
     const expiryMs = resolveExpiryMs(options?.expiry);
@@ -2607,13 +2799,13 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return { delegation: delegation2, prompted: true };
     }
-    const granted = (0, import_sdk_core5.parseRecapCapabilities)(
+    const granted = (0, import_sdk_core6.parseRecapCapabilities)(
       (siwe) => this.wasmBindings.parseRecapFromSiwe(siwe),
       session.siwe
     );
-    const { subset, missing } = (0, import_sdk_core5.isCapabilitySubset)(expandedEntries, granted);
+    const { subset, missing } = (0, import_sdk_core6.isCapabilitySubset)(expandedEntries, granted);
     if (!subset) {
-      throw new import_sdk_core5.PermissionNotInManifestError(missing, granted);
+      throw new import_sdk_core6.PermissionNotInManifestError(missing, granted);
     }
     const delegation = await this.createDelegationViaWasmPath(
       did,
@@ -2693,7 +2885,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const spaceId = [...resolvedSpaces][0];
     const abilities = {};
     for (const entry of entries) {
-      const shortService = import_sdk_core5.SERVICE_LONG_TO_SHORT[entry.service];
+      const shortService = import_sdk_core6.SERVICE_LONG_TO_SHORT[entry.service];
       if (shortService === void 0) {
         throw new Error(
           `delegateTo: unknown service '${entry.service}' \u2014 no short-form mapping`
@@ -2733,7 +2925,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     const primary = result.resources[0];
     const delegationHeader = { Authorization: result.delegation };
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       this.config.host,
       delegationHeader
     );
@@ -2829,7 +3021,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return result.delegation;
     } catch (err) {
-      if (err instanceof import_sdk_core5.PermissionNotInManifestError) {
+      if (err instanceof import_sdk_core6.PermissionNotInManifestError) {
       } else {
         throw err;
       }
@@ -2886,7 +3078,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature
     });
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       this.config.host,
       delegationSession.delegationHeader
     );
@@ -2908,7 +3100,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     const hasKvActions = params.actions.some((a) => a.startsWith("tinycloud.kv/"));
     if (hasKvActions && params.includePublicSpace !== false) {
-      const publicSpaceId = (0, import_sdk_core5.makePublicSpaceId)(
+      const publicSpaceId = (0, import_sdk_core6.makePublicSpaceId)(
         this.wasmBindings.ensureEip55(session.address),
         session.chainId
       );
@@ -2931,7 +3123,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...publicPrepared,
         signature: publicSignature
       });
-      const publicActivateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+      const publicActivateResult = await (0, import_sdk_core6.activateSessionWithHost)(
         this.config.host,
         publicSession.delegationHeader
       );
@@ -3030,7 +3222,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature
     });
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       targetHost,
       invokerSession.delegationHeader
     );
@@ -3119,7 +3311,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature
     });
-    const activateResult = await (0, import_sdk_core5.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
       targetHost,
       subDelegationSession.delegationHeader
     );
@@ -3155,7 +3347,7 @@ _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS = 6e4;
 var TinyCloudNode = _TinyCloudNode;
 
 // src/core.ts
-var import_sdk_core8 = require("@tinycloud/sdk-core");
+var import_sdk_core9 = require("@tinycloud/sdk-core");
 
 // src/delegation.ts
 function serializeDelegation(delegation) {
@@ -3174,7 +3366,6 @@ function deserializeDelegation(data) {
 }
 
 // src/core.ts
-var import_sdk_core9 = require("@tinycloud/sdk-core");
 var import_sdk_core10 = require("@tinycloud/sdk-core");
 var import_sdk_core11 = require("@tinycloud/sdk-core");
 var import_sdk_core12 = require("@tinycloud/sdk-core");
@@ -3183,6 +3374,7 @@ var import_sdk_core14 = require("@tinycloud/sdk-core");
 var import_sdk_core15 = require("@tinycloud/sdk-core");
 var import_sdk_core16 = require("@tinycloud/sdk-core");
 var import_sdk_core17 = require("@tinycloud/sdk-core");
+var import_sdk_core18 = require("@tinycloud/sdk-core");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACCOUNT_REGISTRY_PATH,
@@ -3210,6 +3402,7 @@ var import_sdk_core17 = require("@tinycloud/sdk-core");
   ProtocolMismatchError,
   SQLAction,
   SQLService,
+  SecretsService,
   ServiceContext,
   SessionExpiredError,
   SharingService,