@tinycloud/node-sdk 3.12.0-beta.3 → 3.12.0-beta.5

package/dist/core.cjs

@@ -30,117 +30,117 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/core.ts
 var core_exports = {};
 __export(core_exports, {
-  ACCOUNT_REGISTRY_PATH: () => import_sdk_core14.ACCOUNT_REGISTRY_PATH,
-  ACCOUNT_REGISTRY_SPACE: () => import_sdk_core14.ACCOUNT_REGISTRY_SPACE,
-  AccountService: () => import_sdk_core7.AccountService,
-  AutoApproveSpaceCreationHandler: () => import_sdk_core13.AutoApproveSpaceCreationHandler,
-  CapabilityKeyRegistry: () => import_sdk_core20.CapabilityKeyRegistry,
-  CapabilityKeyRegistryErrorCodes: () => import_sdk_core20.CapabilityKeyRegistryErrorCodes,
-  CaveatedDelegationUnsupportedError: () => import_sdk_core14.CaveatedDelegationUnsupportedError,
-  DEFAULT_MANIFEST_SPACE: () => import_sdk_core14.DEFAULT_MANIFEST_SPACE,
-  DEFAULT_MANIFEST_VERSION: () => import_sdk_core14.DEFAULT_MANIFEST_VERSION,
-  DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => import_sdk_core15.DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
-  DataVaultService: () => import_sdk_core18.DataVaultService,
-  DatabaseHandle: () => import_sdk_core16.DatabaseHandle,
+  ACCOUNT_REGISTRY_PATH: () => import_sdk_core15.ACCOUNT_REGISTRY_PATH,
+  ACCOUNT_REGISTRY_SPACE: () => import_sdk_core15.ACCOUNT_REGISTRY_SPACE,
+  AccountService: () => import_sdk_core8.AccountService,
+  AutoApproveSpaceCreationHandler: () => import_sdk_core14.AutoApproveSpaceCreationHandler,
+  CapabilityKeyRegistry: () => import_sdk_core21.CapabilityKeyRegistry,
+  CapabilityKeyRegistryErrorCodes: () => import_sdk_core21.CapabilityKeyRegistryErrorCodes,
+  CaveatedDelegationUnsupportedError: () => import_sdk_core15.CaveatedDelegationUnsupportedError,
+  DEFAULT_MANIFEST_SPACE: () => import_sdk_core15.DEFAULT_MANIFEST_SPACE,
+  DEFAULT_MANIFEST_VERSION: () => import_sdk_core15.DEFAULT_MANIFEST_VERSION,
+  DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => import_sdk_core16.DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
+  DataVaultService: () => import_sdk_core19.DataVaultService,
+  DatabaseHandle: () => import_sdk_core17.DatabaseHandle,
   DelegatedAccess: () => DelegatedAccess,
-  DelegationErrorCodes: () => import_sdk_core19.DelegationErrorCodes,
-  DelegationManager: () => import_sdk_core19.DelegationManager,
-  DuckDbAction: () => import_sdk_core17.DuckDbAction,
-  DuckDbDatabaseHandle: () => import_sdk_core17.DuckDbDatabaseHandle,
-  DuckDbService: () => import_sdk_core17.DuckDbService,
+  DelegationErrorCodes: () => import_sdk_core20.DelegationErrorCodes,
+  DelegationManager: () => import_sdk_core20.DelegationManager,
+  DuckDbAction: () => import_sdk_core18.DuckDbAction,
+  DuckDbDatabaseHandle: () => import_sdk_core18.DuckDbDatabaseHandle,
+  DuckDbService: () => import_sdk_core18.DuckDbService,
   FileSessionStorage: () => FileSessionStorage,
-  IdentityParseError: () => import_sdk_core13.IdentityParseError,
+  IdentityParseError: () => import_sdk_core14.IdentityParseError,
   InvalidRestoredSessionError: () => InvalidRestoredSessionError,
-  KVService: () => import_sdk_core15.KVService,
-  ManifestValidationError: () => import_sdk_core14.ManifestValidationError,
+  KVService: () => import_sdk_core16.KVService,
+  ManifestValidationError: () => import_sdk_core15.ManifestValidationError,
   MemorySessionStorage: () => MemorySessionStorage,
   NodeIdentityMismatchError: () => import_sdk_services7.NodeIdentityMismatchError,
   NodeNotRespondingError: () => import_sdk_services7.NodeNotRespondingError,
   NodeUserAuthorization: () => NodeUserAuthorization,
   PartialNodeWriteError: () => import_sdk_services7.PartialNodeWriteError,
-  PermissionNotInManifestError: () => import_sdk_core14.PermissionNotInManifestError,
-  PrefixedKVService: () => import_sdk_core15.PrefixedKVService,
-  ProtocolMismatchError: () => import_sdk_core22.ProtocolMismatchError,
+  PermissionNotInManifestError: () => import_sdk_core15.PermissionNotInManifestError,
+  PrefixedKVService: () => import_sdk_core16.PrefixedKVService,
+  ProtocolMismatchError: () => import_sdk_core23.ProtocolMismatchError,
   RuntimeDelegationRejectedError: () => RuntimeDelegationRejectedError,
-  SECRET_NAME_RE: () => import_sdk_core18.SECRET_NAME_RE,
-  SQLAction: () => import_sdk_core16.SQLAction,
-  SQLService: () => import_sdk_core16.SQLService,
-  SecretsService: () => import_sdk_core18.SecretsService,
-  ServiceContext: () => import_sdk_core23.ServiceContext,
-  SessionExpiredError: () => import_sdk_core14.SessionExpiredError,
-  SharingService: () => import_sdk_core19.SharingService,
-  SilentNotificationHandler: () => import_sdk_core13.SilentNotificationHandler,
-  Space: () => import_sdk_core21.Space,
-  SpaceErrorCodes: () => import_sdk_core21.SpaceErrorCodes,
-  SpaceService: () => import_sdk_core21.SpaceService,
-  TinyCloud: () => import_sdk_core12.TinyCloud,
-  TinyCloudDebugLogger: () => import_sdk_core13.TinyCloudDebugLogger,
+  SECRET_NAME_RE: () => import_sdk_core19.SECRET_NAME_RE,
+  SQLAction: () => import_sdk_core17.SQLAction,
+  SQLService: () => import_sdk_core17.SQLService,
+  SecretsService: () => import_sdk_core19.SecretsService,
+  ServiceContext: () => import_sdk_core24.ServiceContext,
+  SessionExpiredError: () => import_sdk_core15.SessionExpiredError,
+  SharingService: () => import_sdk_core20.SharingService,
+  SilentNotificationHandler: () => import_sdk_core14.SilentNotificationHandler,
+  Space: () => import_sdk_core22.Space,
+  SpaceErrorCodes: () => import_sdk_core22.SpaceErrorCodes,
+  SpaceService: () => import_sdk_core22.SpaceService,
+  TinyCloud: () => import_sdk_core13.TinyCloud,
+  TinyCloudDebugLogger: () => import_sdk_core14.TinyCloudDebugLogger,
   TinyCloudNode: () => TinyCloudNode,
-  UnsupportedFeatureError: () => import_sdk_core22.UnsupportedFeatureError,
+  UnsupportedFeatureError: () => import_sdk_core23.UnsupportedFeatureError,
   UnsupportedSessionRestoreError: () => UnsupportedSessionRestoreError,
-  VAULT_PERMISSION_SERVICE: () => import_sdk_core14.VAULT_PERMISSION_SERVICE,
-  VaultHeaders: () => import_sdk_core18.VaultHeaders,
-  VaultPublicSpaceKVActions: () => import_sdk_core18.VaultPublicSpaceKVActions,
-  VersionCheckError: () => import_sdk_core22.VersionCheckError,
+  VAULT_PERMISSION_SERVICE: () => import_sdk_core15.VAULT_PERMISSION_SERVICE,
+  VaultHeaders: () => import_sdk_core19.VaultHeaders,
+  VaultPublicSpaceKVActions: () => import_sdk_core19.VaultPublicSpaceKVActions,
+  VersionCheckError: () => import_sdk_core23.VersionCheckError,
   WasmKeyProvider: () => WasmKeyProvider,
   activateCompactRuntimeDelegation: () => activateCompactRuntimeDelegation,
   activateValidatedRuntimeDelegation: () => activateValidatedRuntimeDelegation,
-  addressStorageKey: () => import_sdk_core13.addressStorageKey,
-  buildSpaceUri: () => import_sdk_core21.buildSpaceUri,
-  canonicalizeAddress: () => import_sdk_core13.canonicalizeAddress,
-  canonicalizeDid: () => import_sdk_core13.canonicalizeDid,
-  canonicalizeDidUrl: () => import_sdk_core13.canonicalizeDidUrl,
-  canonicalizeNetworkId: () => import_sdk_core13.canonicalizeNetworkId,
-  canonicalizeSecretScope: () => import_sdk_core18.canonicalizeSecretScope,
-  checkNodeInfo: () => import_sdk_core22.checkNodeInfo,
-  clearTinyCloudDebugLogs: () => import_sdk_core13.clearTinyCloudDebugLogs,
-  composeManifestRequest: () => import_sdk_core14.composeManifestRequest,
-  createCapabilityKeyRegistry: () => import_sdk_core20.createCapabilityKeyRegistry,
+  addressStorageKey: () => import_sdk_core14.addressStorageKey,
+  buildSpaceUri: () => import_sdk_core22.buildSpaceUri,
+  canonicalizeAddress: () => import_sdk_core14.canonicalizeAddress,
+  canonicalizeDid: () => import_sdk_core14.canonicalizeDid,
+  canonicalizeDidUrl: () => import_sdk_core14.canonicalizeDidUrl,
+  canonicalizeNetworkId: () => import_sdk_core14.canonicalizeNetworkId,
+  canonicalizeSecretScope: () => import_sdk_core19.canonicalizeSecretScope,
+  checkNodeInfo: () => import_sdk_core23.checkNodeInfo,
+  clearTinyCloudDebugLogs: () => import_sdk_core14.clearTinyCloudDebugLogs,
+  composeManifestRequest: () => import_sdk_core15.composeManifestRequest,
+  createCapabilityKeyRegistry: () => import_sdk_core21.createCapabilityKeyRegistry,
   createOpenKeyCallbackSigningStrategy: () => import_sdk_core4.createOpenKeyCallbackSigningStrategy,
-  createSharingService: () => import_sdk_core19.createSharingService,
-  createSpaceService: () => import_sdk_core21.createSpaceService,
-  createVaultCrypto: () => import_sdk_core18.createVaultCrypto,
+  createSharingService: () => import_sdk_core20.createSharingService,
+  createSpaceService: () => import_sdk_core22.createSpaceService,
+  createVaultCrypto: () => import_sdk_core19.createVaultCrypto,
   createWasmKeyProvider: () => createWasmKeyProvider,
   defaultSignStrategy: () => defaultSignStrategy,
-  defaultSpaceCreationHandler: () => import_sdk_core13.defaultSpaceCreationHandler,
+  defaultSpaceCreationHandler: () => import_sdk_core14.defaultSpaceCreationHandler,
   deserializeDelegation: () => deserializeDelegation,
-  didCacheKey: () => import_sdk_core13.didCacheKey,
-  didEquals: () => import_sdk_core13.didEquals,
-  disableTinyCloudDebug: () => import_sdk_core13.disableTinyCloudDebug,
-  enableTinyCloudDebug: () => import_sdk_core13.enableTinyCloudDebug,
-  expandActionShortNames: () => import_sdk_core14.expandActionShortNames,
-  expandPermissionEntries: () => import_sdk_core14.expandPermissionEntries,
-  expandPermissionEntry: () => import_sdk_core14.expandPermissionEntry,
+  didCacheKey: () => import_sdk_core14.didCacheKey,
+  didEquals: () => import_sdk_core14.didEquals,
+  disableTinyCloudDebug: () => import_sdk_core14.disableTinyCloudDebug,
+  enableTinyCloudDebug: () => import_sdk_core14.enableTinyCloudDebug,
+  expandActionShortNames: () => import_sdk_core15.expandActionShortNames,
+  expandPermissionEntries: () => import_sdk_core15.expandPermissionEntries,
+  expandPermissionEntry: () => import_sdk_core15.expandPermissionEntry,
   getNodeReplicationLoaders: () => getNodeReplicationLoaders,
-  getTinyCloudDebugLogs: () => import_sdk_core13.getTinyCloudDebugLogs,
-  installTinyCloudDebugGlobals: () => import_sdk_core13.installTinyCloudDebugGlobals,
+  getTinyCloudDebugLogs: () => import_sdk_core14.getTinyCloudDebugLogs,
+  installTinyCloudDebugGlobals: () => import_sdk_core14.installTinyCloudDebugGlobals,
   isAppKeyHostBound: () => isAppKeyHostBound,
-  isCapabilitySubset: () => import_sdk_core14.isCapabilitySubset,
-  isEvmAddress: () => import_sdk_core13.isEvmAddress,
-  loadManifest: () => import_sdk_core14.loadManifest,
-  makePkhSpaceId: () => import_sdk_core13.makePkhSpaceId,
-  makePublicSpaceId: () => import_sdk_core21.makePublicSpaceId,
-  parseCanonicalNetworkId: () => import_sdk_core13.parseCanonicalNetworkId,
-  parseExpiry: () => import_sdk_core14.parseExpiry,
-  parsePkhDid: () => import_sdk_core13.parsePkhDid,
-  parseSecretCatalogKey: () => import_sdk_core18.parseSecretCatalogKey,
-  parseSpaceUri: () => import_sdk_core21.parseSpaceUri,
-  pkhDid: () => import_sdk_core13.pkhDid,
-  principalDid: () => import_sdk_core13.principalDid,
-  principalDidEquals: () => import_sdk_core13.principalDidEquals,
+  isCapabilitySubset: () => import_sdk_core15.isCapabilitySubset,
+  isEvmAddress: () => import_sdk_core14.isEvmAddress,
+  loadManifest: () => import_sdk_core15.loadManifest,
+  makePkhSpaceId: () => import_sdk_core14.makePkhSpaceId,
+  makePublicSpaceId: () => import_sdk_core22.makePublicSpaceId,
+  parseCanonicalNetworkId: () => import_sdk_core14.parseCanonicalNetworkId,
+  parseExpiry: () => import_sdk_core15.parseExpiry,
+  parsePkhDid: () => import_sdk_core14.parsePkhDid,
+  parseSecretCatalogKey: () => import_sdk_core19.parseSecretCatalogKey,
+  parseSpaceUri: () => import_sdk_core22.parseSpaceUri,
+  pkhDid: () => import_sdk_core14.pkhDid,
+  principalDid: () => import_sdk_core14.principalDid,
+  principalDidEquals: () => import_sdk_core14.principalDidEquals,
   refuseCaveated: () => refuseCaveated,
   registerReplicationLoaders: () => registerReplicationLoaders,
-  resolveManifest: () => import_sdk_core14.resolveManifest,
-  resolveSecretListPrefix: () => import_sdk_core18.resolveSecretListPrefix,
-  resolveSecretPath: () => import_sdk_core18.resolveSecretPath,
-  resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core14.resourceCapabilitiesToSpaceAbilitiesMap,
+  resolveManifest: () => import_sdk_core15.resolveManifest,
+  resolveSecretListPrefix: () => import_sdk_core19.resolveSecretListPrefix,
+  resolveSecretPath: () => import_sdk_core19.resolveSecretPath,
+  resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core15.resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation: () => serializeDelegation,
-  tinyCloudDebugLogger: () => import_sdk_core13.tinyCloudDebugLogger,
-  validateManifest: () => import_sdk_core14.validateManifest,
+  tinyCloudDebugLogger: () => import_sdk_core14.tinyCloudDebugLogger,
+  validateManifest: () => import_sdk_core15.validateManifest,
   wireOpenKeyAuthorize: () => wireOpenKeyAuthorize
 });
 module.exports = __toCommonJS(core_exports);
-var import_sdk_core12 = require("@tinycloud/sdk-core");
+var import_sdk_core13 = require("@tinycloud/sdk-core");
 var import_sdk_services7 = require("@tinycloud/sdk-services");
 
 // src/replication/module-registry.ts
@@ -156,7 +156,7 @@ function getNodeReplicationLoaders() {
 }
 
 // src/core.ts
-var import_sdk_core13 = require("@tinycloud/sdk-core");
+var import_sdk_core14 = require("@tinycloud/sdk-core");
 
 // src/storage/MemorySessionStorage.ts
 var MemorySessionStorage = class {
@@ -1893,7 +1893,7 @@ var NodeUserAuthorization = class {
     const originalRequest = {
       protocolVersion: 1,
       siwe: prepared.siwe,
-      jwk,
+      jwk: (0, import_sdk_core5.publicJwk)(jwk),
       verificationMethod: prepared.verificationMethod,
       host: hostHint,
       keyId: options?.openkeyKeyId,
@@ -2389,13 +2389,14 @@ var NodeUserAuthorization = class {
 };
 
 // src/authorization/openKeyBridge.ts
+var import_sdk_core6 = require("@tinycloud/sdk-core");
 function wireOpenKeyAuthorize(openkey, opts) {
   return async (input) => {
     const result = await openkey.authorizeTinyCloud({
       protocolVersion: 1,
       siwe: input.siwe,
       keyId: input.keyId,
-      jwk: input.jwk,
+      jwk: (0, import_sdk_core6.publicJwk)(input.jwk),
       host: input.host,
       // Forward the presentation envelope verbatim — the OpenKey SDK
       // validates and size-bounds it before use.
@@ -2596,7 +2597,7 @@ function rememberInvokeAny(invokeAny, sink, pending) {
 }
 
 // src/delegation.ts
-var import_sdk_core6 = require("@tinycloud/sdk-core");
+var import_sdk_core7 = require("@tinycloud/sdk-core");
 var import_sdk_services4 = require("@tinycloud/sdk-services");
 var RuntimeDelegationRejectedError = class extends Error {
   constructor(reason, message) {
@@ -2638,7 +2639,7 @@ function normalizedHost(host) {
 }
 function didPrincipalsMatch(left, right) {
   try {
-    return (0, import_sdk_core6.principalDidEquals)(left, right);
+    return (0, import_sdk_core7.principalDidEquals)(left, right);
   } catch {
     return left === right;
   }
@@ -2653,7 +2654,7 @@ function compactUcanPayload(authorization) {
   }
   try {
     const payload = JSON.parse(
-      new TextDecoder("utf-8", { fatal: true }).decode((0, import_sdk_core6.decodeBase64Url)(parts[1]))
+      new TextDecoder("utf-8", { fatal: true }).decode((0, import_sdk_core7.decodeBase64Url)(parts[1]))
     );
     if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
       throw new Error("payload is not an object");
@@ -2681,7 +2682,7 @@ function canonicalPermissionEntries(permissions) {
     ...permission,
     actions: [...permission.actions].sort()
   })).sort(
-    (left, right) => left.service.localeCompare(right.service) || (left.space ?? "").localeCompare(right.space ?? "") || left.path.localeCompare(right.path) || left.actions.join("\0").localeCompare(right.actions.join("\0")) || (0, import_sdk_core6.canonicalizeRecapCaveats)(left.caveats).localeCompare((0, import_sdk_core6.canonicalizeRecapCaveats)(right.caveats))
+    (left, right) => left.service.localeCompare(right.service) || (left.space ?? "").localeCompare(right.space ?? "") || left.path.localeCompare(right.path) || left.actions.join("\0").localeCompare(right.actions.join("\0")) || (0, import_sdk_core7.canonicalizeRecapCaveats)(left.caveats).localeCompare((0, import_sdk_core7.canonicalizeRecapCaveats)(right.caveats))
   );
 }
 function signedCaveats(value) {
@@ -2691,13 +2692,13 @@ function signedCaveats(value) {
     throw new Error("Validated runtime delegation has malformed signed ReCap caveats.");
   }
   const cloned = JSON.parse(JSON.stringify(value));
-  return (0, import_sdk_core6.canonicalizeRecapCaveats)(cloned) === (0, import_sdk_core6.canonicalizeRecapCaveats)(void 0) ? void 0 : cloned;
+  return (0, import_sdk_core7.canonicalizeRecapCaveats)(cloned) === (0, import_sdk_core7.canonicalizeRecapCaveats)(void 0) ? void 0 : cloned;
 }
 function groupedSignedEntries(service, space, path, abilities) {
   const groups = /* @__PURE__ */ new Map();
   for (const [action, rawCaveats] of Object.entries(abilities)) {
     const caveats = signedCaveats(rawCaveats);
-    const identity = (0, import_sdk_core6.canonicalizeRecapCaveats)(caveats);
+    const identity = (0, import_sdk_core7.canonicalizeRecapCaveats)(caveats);
     const group = groups.get(identity) ?? { actions: [], caveats };
     group.actions.push(action);
     groups.set(identity, group);
@@ -2849,7 +2850,7 @@ function signedAuthorityFromSessionGrant(node, delegation, authorization, cid) {
       reject("authority_invalid", "Runtime delegation has signed authority outside its space.");
     }
     const caveats = signedCaveats(entry.caveats ?? []);
-    const key = JSON.stringify([service, raw ? "" : entry.space, entry.path, (0, import_sdk_core6.canonicalizeRecapCaveats)(caveats)]);
+    const key = JSON.stringify([service, raw ? "" : entry.space, entry.path, (0, import_sdk_core7.canonicalizeRecapCaveats)(caveats)]);
     const group = groups.get(key) ?? {
       service,
       ...raw ? {} : { space: entry.space },
@@ -2873,7 +2874,7 @@ function signedAuthorityFromSessionGrant(node, delegation, authorization, cid) {
 function canonicalResourcesFromPortableDelegation(delegation) {
   if (delegation.resources !== void 0 && delegation.resources.length > 0) {
     return delegation.resources.map((resource) => ({ ...resource, actions: [...resource.actions].sort() })).sort(
-      (left, right) => left.service.localeCompare(right.service) || left.space.localeCompare(right.space) || left.path.localeCompare(right.path) || left.actions.join("\0").localeCompare(right.actions.join("\0")) || (0, import_sdk_core6.canonicalizeRecapCaveats)(left.caveats).localeCompare((0, import_sdk_core6.canonicalizeRecapCaveats)(right.caveats))
+      (left, right) => left.service.localeCompare(right.service) || left.space.localeCompare(right.space) || left.path.localeCompare(right.path) || left.actions.join("\0").localeCompare(right.actions.join("\0")) || (0, import_sdk_core7.canonicalizeRecapCaveats)(left.caveats).localeCompare((0, import_sdk_core7.canonicalizeRecapCaveats)(right.caveats))
     );
   }
   const byService = /* @__PURE__ */ new Map();
@@ -2897,7 +2898,7 @@ function canonicalResourcesFromPortableDelegation(delegation) {
 function resourcesMatch(actual, expected) {
   const comparable = (resource) => ({
     ...resource,
-    caveats: (0, import_sdk_core6.canonicalizeRecapCaveats)(resource.caveats)
+    caveats: (0, import_sdk_core7.canonicalizeRecapCaveats)(resource.caveats)
   });
   return JSON.stringify(actual.map(comparable)) === JSON.stringify(expected.map(comparable));
 }
@@ -2991,7 +2992,7 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
     ...compact ? {} : { siweProof: delegation.siweProof }
   };
   try {
-    if (node.isSessionOnly === true && typeof node.did === "string" && (0, import_sdk_core6.principalDidEquals)(node.did, node.sessionDid) && typeof node.useDelegation === "function") {
+    if (node.isSessionOnly === true && typeof node.did === "string" && (0, import_sdk_core7.principalDidEquals)(node.did, node.sessionDid) && typeof node.useDelegation === "function") {
       await node.useDelegation(installedCandidate);
     } else {
       await node.useRuntimeDelegation(installedCandidate);
@@ -3083,16 +3084,16 @@ function deserializeDelegation(data) {
 var import_sdk_services5 = require("@tinycloud/sdk-services");
 var import_siwe2 = require("siwe");
 var import_share_envelope = require("@tinycloud/share-envelope");
-var import_sdk_core11 = require("@tinycloud/sdk-core");
+var import_sdk_core12 = require("@tinycloud/sdk-core");
 var import_sdk_services6 = require("@tinycloud/sdk-services");
 var import_requestLog2 = require("@tinycloud/sdk-services/telemetry/requestLog");
 var import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
 
 // src/account/AccountService.ts
-var import_sdk_core7 = require("@tinycloud/sdk-core");
+var import_sdk_core8 = require("@tinycloud/sdk-core");
 
 // src/DelegatedAccess.ts
-var import_sdk_core8 = require("@tinycloud/sdk-core");
+var import_sdk_core9 = require("@tinycloud/sdk-core");
 var DelegatedAccess = class {
   /**
    * @param lifetime - Optional owner of this access: its `fetch` is used for
@@ -3114,16 +3115,16 @@ var DelegatedAccess = class {
     });
     this._serviceContext = lifetime ? lifetime.track(context) : context;
     const prefix = this._delegation.path.replace(/\/$/, "");
-    this._kv = new import_sdk_core8.KVService({ prefix });
+    this._kv = new import_sdk_core9.KVService({ prefix });
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
-    this._sql = new import_sdk_core8.SQLService({});
+    this._sql = new import_sdk_core9.SQLService({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
-    this._duckdb = new import_sdk_core8.DuckDbService({});
+    this._duckdb = new import_sdk_core9.DuckDbService({});
     this._duckdb.initialize(this._serviceContext);
     this._serviceContext.registerService("duckdb", this._duckdb);
-    this._hooks = new import_sdk_core8.HooksService({});
+    this._hooks = new import_sdk_core9.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -3273,7 +3274,7 @@ function createWasmKeyProvider(sessionManager) {
 }
 
 // src/delegateToHelpers.ts
-var import_sdk_core9 = require("@tinycloud/sdk-core");
+var import_sdk_core10 = require("@tinycloud/sdk-core");
 function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   const byService = /* @__PURE__ */ new Map();
   for (const a of actions) {
@@ -3304,7 +3305,7 @@ function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   }
   return entries;
 }
-var DEFAULT_DELEGATION_EXPIRY_MS = import_sdk_core9.EXPIRY.SESSION_MS;
+var DEFAULT_DELEGATION_EXPIRY_MS = import_sdk_core10.EXPIRY.SESSION_MS;
 function resolveExpiryMs(expiry) {
   if (expiry === void 0) {
     return DEFAULT_DELEGATION_EXPIRY_MS;
@@ -3317,10 +3318,10 @@ function resolveExpiryMs(expiry) {
     }
     return expiry;
   }
-  return (0, import_sdk_core9.parseExpiry)(expiry);
+  return (0, import_sdk_core10.parseExpiry)(expiry);
 }
 function extractSiweExpiration(siwe) {
-  const parsed = new import_sdk_core9.SiweMessage(siwe);
+  const parsed = new import_sdk_core10.SiweMessage(siwe);
   if (parsed.expirationTime === void 0 || parsed.expirationTime === null) {
     return void 0;
   }
@@ -3334,7 +3335,7 @@ function extractSiweExpiration(siwe) {
 }
 
 // src/NodeSecretsService.ts
-var import_sdk_core10 = require("@tinycloud/sdk-core");
+var import_sdk_core11 = require("@tinycloud/sdk-core");
 var SECRETS_SPACE = "secrets";
 function ok() {
   return { ok: true, data: void 0 };
@@ -3367,7 +3368,7 @@ function secretActionName(action) {
 }
 function secretPermissionEntries(name, options, action, space, encryptionNetworkId) {
   const entries = [];
-  const path = action === "list" ? (0, import_sdk_core10.resolveSecretListPrefix)(options) : (0, import_sdk_core10.resolveSecretPath)(name, options).permissionPaths.vault;
+  const path = action === "list" ? (0, import_sdk_core11.resolveSecretListPrefix)(options) : (0, import_sdk_core11.resolveSecretPath)(name, options).permissionPaths.vault;
   entries.push({
     service: "tinycloud.kv",
     space,
@@ -3464,7 +3465,7 @@ var NodeSecretsService = class {
       );
     } catch (error) {
       return secretsError(
-        import_sdk_core10.ErrorCodes.INVALID_INPUT,
+        import_sdk_core11.ErrorCodes.INVALID_INPUT,
         error instanceof Error ? error.message : String(error),
         error instanceof Error ? error : void 0
       );
@@ -3483,7 +3484,7 @@ var NodeSecretsService = class {
     }
     if (!this.config.canEscalate()) {
       return secretsError(
-        import_sdk_core10.ErrorCodes.PERMISSION_DENIED,
+        import_sdk_core11.ErrorCodes.PERMISSION_DENIED,
         `Cannot autosign ${displayActionUrn(action)} for ${target}; TinyCloudNode needs wallet mode with a signer or privateKey.`
       );
     }
@@ -3496,7 +3497,7 @@ var NodeSecretsService = class {
   }
   escalationError(action, target, error) {
     return secretsError(
-      import_sdk_core10.ErrorCodes.PERMISSION_DENIED,
+      import_sdk_core11.ErrorCodes.PERMISSION_DENIED,
       error instanceof Error ? error.message : `Autosign escalation for ${displayActionUrn(action)} on ${target} failed.`,
       error instanceof Error ? error : void 0
     );
@@ -3516,10 +3517,10 @@ var NodeSecretsService = class {
       return false;
     }
     const manifests = Array.isArray(manifest) ? manifest : [manifest];
-    const requestedEntries = (0, import_sdk_core10.expandPermissionEntries)(permissionEntries);
+    const requestedEntries = (0, import_sdk_core11.expandPermissionEntries)(permissionEntries);
     return requestedEntries.every(
       (entry) => manifests.some((candidate) => {
-        const resolved = (0, import_sdk_core10.resolveManifest)(candidate);
+        const resolved = (0, import_sdk_core11.resolveManifest)(candidate);
         return resolved.resources.some(
           (resource) => resource.service === entry.service && spaceMatches(
             resource.space,
@@ -3535,8 +3536,8 @@ var NodeSecretsService = class {
 // src/TinyCloudNode.ts
 var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
-var NETWORK_CREATE_ACTION2 = import_sdk_core11.ENCRYPTION.NETWORK_CREATE;
-var DECRYPT_ACTION2 = import_sdk_core11.ENCRYPTION.DECRYPT;
+var NETWORK_CREATE_ACTION2 = import_sdk_core12.ENCRYPTION.NETWORK_CREATE;
+var DECRYPT_ACTION2 = import_sdk_core12.ENCRYPTION.DECRYPT;
 var BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
 var BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
 var ACCEPTED_MARKER_VERSIONS = [BOOTSTRAP_COMPLETION_MARKER_VERSION];
@@ -3545,24 +3546,24 @@ function isSecretPayload(value) {
   return typeof value === "object" && value !== null && "value" in value && typeof value.value === "string" && "createdAt" in value && typeof value.createdAt === "string" && "updatedAt" in value && typeof value.updatedAt === "string";
 }
 var ROOT_DELEGATION_ACTIONS = [
-  import_sdk_core11.KV.PUT,
-  import_sdk_core11.KV.GET,
-  import_sdk_core11.KV.DEL,
-  import_sdk_core11.KV.LIST,
-  import_sdk_core11.KV.METADATA,
-  import_sdk_core11.SQL.READ,
-  import_sdk_core11.SQL.WRITE,
-  import_sdk_core11.SQL.ADMIN,
-  import_sdk_core11.SQL.ALL,
-  import_sdk_core11.DUCKDB.READ,
-  import_sdk_core11.DUCKDB.WRITE,
-  import_sdk_core11.DUCKDB.ADMIN,
-  import_sdk_core11.DUCKDB.DESCRIBE,
-  import_sdk_core11.DUCKDB.EXPORT,
-  import_sdk_core11.DUCKDB.IMPORT,
-  import_sdk_core11.DUCKDB.ALL
+  import_sdk_core12.KV.PUT,
+  import_sdk_core12.KV.GET,
+  import_sdk_core12.KV.DEL,
+  import_sdk_core12.KV.LIST,
+  import_sdk_core12.KV.METADATA,
+  import_sdk_core12.SQL.READ,
+  import_sdk_core12.SQL.WRITE,
+  import_sdk_core12.SQL.ADMIN,
+  import_sdk_core12.SQL.ALL,
+  import_sdk_core12.DUCKDB.READ,
+  import_sdk_core12.DUCKDB.WRITE,
+  import_sdk_core12.DUCKDB.ADMIN,
+  import_sdk_core12.DUCKDB.DESCRIBE,
+  import_sdk_core12.DUCKDB.EXPORT,
+  import_sdk_core12.DUCKDB.IMPORT,
+  import_sdk_core12.DUCKDB.ALL
 ];
-var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core11.EXPIRY.SESSION_MS;
+var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core12.EXPIRY.SESSION_MS;
 var OWNER_REVOCATION_WINDOW_MS = 10 * 6e4;
 function unifiedRootAttenuation(capabilities) {
   const attenuation = {};
@@ -3614,7 +3615,7 @@ function spaceOwnerKey(spaceId) {
 }
 function didPrincipalMatches2(actual, expected) {
   try {
-    return (0, import_sdk_core11.principalDidEquals)(actual, expected);
+    return (0, import_sdk_core12.principalDidEquals)(actual, expected);
   } catch {
     return actual === expected;
   }
@@ -3853,7 +3854,7 @@ function ownerDelegationPermissions(params) {
       }
       const slash = action.indexOf("/");
       const service = slash === -1 ? "" : action.slice(0, slash);
-      if (import_sdk_core11.SERVICE_LONG_TO_SHORT[service] === void 0) {
+      if (import_sdk_core12.SERVICE_LONG_TO_SHORT[service] === void 0) {
         throw new Error("Owner delegation capabilities are unsupported");
       }
       const actions = byService.get(service) ?? [];
@@ -3869,7 +3870,7 @@ function ownerDelegationPermissions(params) {
   }
   const resources = /* @__PURE__ */ new Set();
   for (const permission of permissions) {
-    if (typeof permission.service !== "string" || import_sdk_core11.SERVICE_LONG_TO_SHORT[permission.service] === void 0 || typeof permission.path !== "string" || permission.path.length === 0 || permission.path.trim() !== permission.path || /[\u0000-\u001f\u007f\\*]/.test(permission.path) || !Array.isArray(permission.actions) || permission.actions.length === 0 || permission.actions.length > 32) {
+    if (typeof permission.service !== "string" || import_sdk_core12.SERVICE_LONG_TO_SHORT[permission.service] === void 0 || typeof permission.path !== "string" || permission.path.length === 0 || permission.path.trim() !== permission.path || /[\u0000-\u001f\u007f\\*]/.test(permission.path) || !Array.isArray(permission.actions) || permission.actions.length === 0 || permission.actions.length > 32) {
       throw new Error("Owner delegation requires bounded capabilities");
     }
     const resourceKey = `${permission.service}\0${permission.path}`;
@@ -3884,9 +3885,9 @@ function ownerDelegationPermissions(params) {
       }
       actions.add(action);
     }
-    if (permission.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE) {
+    if (permission.service === import_sdk_core12.ENCRYPTION_PERMISSION_SERVICE) {
       try {
-        (0, import_sdk_core11.parseNetworkId)(permission.path);
+        (0, import_sdk_core12.parseNetworkId)(permission.path);
       } catch {
         throw new Error("Owner delegation encryption permission requires a canonical network URN");
       }
@@ -3898,11 +3899,11 @@ function ownerPermissionsToAbilities(permissions) {
   const abilities = {};
   const rawAbilities = {};
   for (const permission of permissions) {
-    if (permission.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE) {
+    if (permission.service === import_sdk_core12.ENCRYPTION_PERMISSION_SERVICE) {
       rawAbilities[permission.path] = [...permission.actions];
       continue;
     }
-    const shortService = import_sdk_core11.SERVICE_LONG_TO_SHORT[permission.service];
+    const shortService = import_sdk_core12.SERVICE_LONG_TO_SHORT[permission.service];
     abilities[shortService] ?? (abilities[shortService] = {});
     abilities[shortService][permission.path] = [...permission.actions];
   }
@@ -4085,7 +4086,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
         const stamp = await establishReplicaSessionStamp(
           replication.storage,
-          (0, import_sdk_core11.pkhDid)(session.address, session.chainId),
+          (0, import_sdk_core12.pkhDid)(session.address, session.chainId),
           anchor
         );
         if (epoch !== this.sessionEpoch || attempt !== this.latestSessionAttempt) return void 0;
@@ -4168,7 +4169,7 @@ var _TinyCloudNode = class _TinyCloudNode {
      * and remembers whose storage is full so sign-in and listing skip their
      * best-effort writes. Lives as long as this instance, across sign-ins.
      */
-    this.storageFull = new import_sdk_core11.StorageFullMonitor(
+    this.storageFull = new import_sdk_core12.StorageFullMonitor(
       (spaceId) => spaceOwnerKey(spaceId) ?? spaceId,
       () => this.currentStorageOwner()
     );
@@ -4212,7 +4213,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         if (!granted?.caveats?.length) {
           return entry;
         }
-        if (entry.caveats !== void 0 && !(0, import_sdk_core11.recapCaveatsEqual)(entry.caveats, granted.caveats)) {
+        if (entry.caveats !== void 0 && !(0, import_sdk_core12.recapCaveatsEqual)(entry.caveats, granted.caveats)) {
           throw new Error("Invocation caveats do not match signed ReCap authority.");
         }
         return { ...entry, caveats: cloneRecapCaveats(granted.caveats) };
@@ -4226,8 +4227,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       host: config.host ?? DEFAULT_HOST,
       registryPolicy: "fail-closed",
       // One store for every authorization this client creates.
-      registrySequenceStore: config.registrySequenceStore ?? (0, import_sdk_core11.createInMemoryRegistrySequenceStore)(),
-      registryCacheStore: config.registryCacheStore ?? (0, import_sdk_core11.createInMemoryRegistryCacheStore)()
+      registrySequenceStore: config.registrySequenceStore ?? (0, import_sdk_core12.createInMemoryRegistrySequenceStore)(),
+      registryCacheStore: config.registryCacheStore ?? (0, import_sdk_core12.createInMemoryRegistryCacheStore)()
     };
     if (this.config.replication?.enabled) {
       const runtime = getNodeReplicationLoaders().runtime().then(({ ReplicationRuntime }) => {
@@ -4297,11 +4298,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.sessionKeyJwk = sessionKey.jwk;
     this._requestLog = config.requestLog === true ? new import_requestLog2.RequestLog() : void 0;
     this._serviceGraph = this.createServiceGraphLifetime();
-    this._capabilityRegistry = new import_sdk_core11.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core12.CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({
       sessionManager: this.sessionManager
     });
-    this.notificationHandler = config.notificationHandler ?? new import_sdk_core11.SilentNotificationHandler();
+    this.notificationHandler = config.notificationHandler ?? new import_sdk_core12.SilentNotificationHandler();
     this._sharingService = this.createReceiveOnlySharing();
     if (config.signer) {
       this.signer = config.signer;
@@ -4393,13 +4394,13 @@ var _TinyCloudNode = class _TinyCloudNode {
   async readStorageStatus(options) {
     const session = this._serviceContext?.session;
     if (!this._serviceContext || !session) {
-      return (0, import_sdk_core11.err)((0, import_sdk_core11.serviceError)(import_sdk_core11.ErrorCodes.AUTH_REQUIRED, "Not signed in. Call signIn() first.", "storage"));
+      return (0, import_sdk_core12.err)((0, import_sdk_core12.serviceError)(import_sdk_core12.ErrorCodes.AUTH_REQUIRED, "Not signed in. Call signIn() first.", "storage"));
     }
     const spaceId = options?.space === void 0 ? session.spaceId : options.space.startsWith("tinycloud:") ? options.space : this.ownedSpaceId(options.space);
     const action = "tinycloud.space/info";
     if (!this.findGrantForOperation({ spaceId, service: "space", path: "", action })) {
-      return (0, import_sdk_core11.err)((0, import_sdk_core11.serviceError)(
-        import_sdk_core11.ErrorCodes.PERMISSION_DENIED,
+      return (0, import_sdk_core12.err)((0, import_sdk_core12.serviceError)(
+        import_sdk_core12.ErrorCodes.PERMISSION_DENIED,
         `Reading storage status needs ${action} on ${spaceId}, which this session was not granted.`,
         "storage",
         { meta: { requiredAction: action, resource: spaceId } }
@@ -4415,8 +4416,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       const text = await response.text();
       if (!response.ok) {
         const unauthorized = response.status === 401 || response.status === 403;
-        return (0, import_sdk_core11.err)((0, import_sdk_core11.serviceError)(
-          unauthorized ? import_sdk_core11.ErrorCodes.AUTH_UNAUTHORIZED : import_sdk_core11.ErrorCodes.NETWORK_ERROR,
+        return (0, import_sdk_core12.err)((0, import_sdk_core12.serviceError)(
+          unauthorized ? import_sdk_core12.ErrorCodes.AUTH_UNAUTHORIZED : import_sdk_core12.ErrorCodes.NETWORK_ERROR,
           `Failed to read storage status: ${response.status} - ${text.slice(0, 300)}`,
           "storage",
           { meta: { status: response.status, ...unauthorized ? { requiredAction: action, resource: spaceId } : {} } }
@@ -4428,10 +4429,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       } catch {
         body = void 0;
       }
-      const status = (0, import_sdk_core11.parseStorageStatus)(body);
+      const status = (0, import_sdk_core12.parseStorageStatus)(body);
       if (!status) {
-        return (0, import_sdk_core11.err)((0, import_sdk_core11.serviceError)(
-          import_sdk_core11.ErrorCodes.STORAGE_STATUS_UNAVAILABLE,
+        return (0, import_sdk_core12.err)((0, import_sdk_core12.serviceError)(
+          import_sdk_core12.ErrorCodes.STORAGE_STATUS_UNAVAILABLE,
           "This TinyCloud node does not report storage usage yet.",
           "storage",
           { meta: { status: response.status } }
@@ -4441,10 +4442,10 @@ var _TinyCloudNode = class _TinyCloudNode {
         this.storageFull.clearFor(spaceId);
         if (spaceOwnerKey(spaceId) === this.currentStorageOwner()) this.storageFull.clearFor(void 0);
       }
-      return (0, import_sdk_core11.ok)(status);
+      return (0, import_sdk_core12.ok)(status);
     } catch (error) {
-      return (0, import_sdk_core11.err)((0, import_sdk_core11.serviceError)(
-        import_sdk_core11.ErrorCodes.NETWORK_ERROR,
+      return (0, import_sdk_core12.err)((0, import_sdk_core12.serviceError)(
+        import_sdk_core12.ErrorCodes.NETWORK_ERROR,
         `Failed to read storage status: ${error instanceof Error ? error.message : String(error)}`,
         "storage",
         { cause: error instanceof Error ? error : void 0 }
@@ -4584,7 +4585,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   createReceiveOnlySharing() {
     const receiveOnlyGraph = this._serviceGraph;
-    return new import_sdk_core11.SharingService({
+    return new import_sdk_core12.SharingService({
       hosts: [this.config.host],
       // session: undefined - not needed for receive()
       invoke: receiveOnlyGraph.invoke,
@@ -4599,7 +4600,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       createKVService: (config) => {
         const prefix = config.pathPrefix?.replace(/\/$/, "");
-        const kvService = new import_sdk_core11.KVService({ prefix });
+        const kvService = new import_sdk_core12.KVService({ prefix });
         const kvContext = receiveOnlyGraph.track(createServiceContext({
           requestSink: receiveOnlyGraph.requestSink,
           invoke: config.invoke,
@@ -4647,7 +4648,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: config.nonce,
       siweConfig: config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? config.includeAccountRegistryPermissions === false ? import_sdk_core11.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core11.BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? config.includeAccountRegistryPermissions === false ? import_sdk_core12.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core12.BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : config.includeAccountRegistryPermissions,
       // Sign-in needs only the entry inputs (prefixes + secrets opt-in);
       // storage and scheduling never leave TinyCloudNode.
@@ -4658,7 +4659,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         syncScope: config.replication.syncScope
       } : void 0
     });
-    this.tc = new import_sdk_core11.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core12.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: config.telemetry,
       retryPolicy: config.retryPolicy
@@ -4712,15 +4713,15 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   async routingDestinations(resource, access, noEntryHosts) {
     const session = this.currentTinyCloudSession();
-    if (session) this.refreshRegistryOwner((0, import_sdk_core11.pkhDid)(session.address, session.chainId));
+    if (session) this.refreshRegistryOwner((0, import_sdk_core12.pkhDid)(session.address, session.chainId));
     if (this.auth) return this.auth.resolveResourceDestinations(resource, access, noEntryHosts);
-    const owner = resource.startsWith("urn:tinycloud:encryption:") ? (0, import_sdk_core11.parseNetworkId)(resource.split("/")[0]).ownerDid : (0, import_sdk_core11.parseSpaceUri)(resource)?.owner ?? (() => {
+    const owner = resource.startsWith("urn:tinycloud:encryption:") ? (0, import_sdk_core12.parseNetworkId)(resource.split("/")[0]).ownerDid : (0, import_sdk_core12.parseSpaceUri)(resource)?.owner ?? (() => {
       const key = /^tinycloud:key:(z[^:]+):[^/]+$/.exec(resource);
       return key ? `did:key:${key[1]}` : void 0;
     })();
     if (!owner) throw new Error(`Cannot determine registry owner for ${resource}`);
-    const subject = owner.startsWith("did:pkh:") ? (0, import_sdk_core11.pkhDid)(owner.slice(owner.lastIndexOf(":") + 1), this.config.registryChainId ?? 1) : owner;
-    const resolved = await (0, import_sdk_core11.resolveRegistryResource)(subject, resource, access, {
+    const subject = owner.startsWith("did:pkh:") ? (0, import_sdk_core12.pkhDid)(owner.slice(owner.lastIndexOf(":") + 1), this.config.registryChainId ?? 1) : owner;
+    const resolved = await (0, import_sdk_core12.resolveRegistryResource)(subject, resource, access, {
       registryUrl: this.config.tinycloudRegistryUrl,
       registryChainId: this.config.registryChainId,
       sequenceStore: this.config.registrySequenceStore,
@@ -4730,9 +4731,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (resolved.verdict.status === "unregistered") {
       const hint = noEntryHosts === void 0 ? this.explicitHost ?? this.config.host : noEntryHosts[0];
       const host = hint ?? this.config.newUserHost ?? (this.config.tinycloudFallbackHosts === void 0 ? DEFAULT_HOST : this.config.tinycloudFallbackHosts?.[0]);
-      if (!host || !hint && this.config.newUserHost === null) throw new import_sdk_core11.NodeNotFoundError(subject, resolved.verdict);
-      const url = (0, import_sdk_core11.exactHttpOrigin)(host, "new-user host");
-      (0, import_sdk_core11.warnRegistryDefaultNode)(resolved.verdict, this.config.registryCacheStore, this.config.onRegistryFallback);
+      if (!host || !hint && this.config.newUserHost === null) throw new import_sdk_core12.NodeNotFoundError(subject, resolved.verdict);
+      const url = (0, import_sdk_core12.exactHttpOrigin)(host, "new-user host");
+      (0, import_sdk_core12.warnRegistryDefaultNode)(resolved.verdict, this.config.registryCacheStore, this.config.onRegistryFallback);
       return [{ url }];
     }
     const destinations = resolved.hosts.flatMap((host) => host.urls.map((url) => ({ url, nodeDid: host.nodeDid })));
@@ -4759,7 +4760,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         if (access === "host") dataHost ?? (dataHost = destinations[0]?.url);
         else encryptionHost ?? (encryptionHost = destinations[0]?.url);
       } catch (error) {
-        if (!(error instanceof import_sdk_core11.NodeNotFoundError) || error.verdict.status !== "registered") throw error;
+        if (!(error instanceof import_sdk_core12.NodeNotFoundError) || error.verdict.status !== "registered") throw error;
         unserved ?? (unserved = error);
       }
     }
@@ -4841,7 +4842,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   /** Publish the active owner Node as a session-signed registry record. */
   async publishActiveNodeLocation(registryUrl, fetchFn = globalThis.fetch.bind(globalThis)) {
     const node = await this.activeNodeIdentity();
-    return (0, import_sdk_core11.publishLocationRecord)({
+    return (0, import_sdk_core12.publishLocationRecord)({
       registryUrl,
       subject: this.credentialHolderDid,
       nodeOrigin: node.origin,
@@ -4858,7 +4859,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   get did() {
     if (this._address) {
-      return (0, import_sdk_core11.pkhDid)(this._address, this._chainId);
+      return (0, import_sdk_core12.pkhDid)(this._address, this._chainId);
     }
     return this.sessionManager.getDID(this.sessionKeyId);
   }
@@ -4896,7 +4897,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   refreshRegistryForCapabilities(permissions) {
     for (const permission of permissions) {
       try {
-        const owner = permission.service === "tinycloud.encryption" && permission.path.startsWith("urn:tinycloud:encryption:") ? (0, import_sdk_core11.parseNetworkId)(permission.path.split("/")[0]).ownerDid : permission.space ? this.ownerDidFromSpaceId(permission.space) : void 0;
+        const owner = permission.service === "tinycloud.encryption" && permission.path.startsWith("urn:tinycloud:encryption:") ? (0, import_sdk_core12.parseNetworkId)(permission.path.split("/")[0]).ownerDid : permission.space ? this.ownerDidFromSpaceId(permission.space) : void 0;
         if (owner) this.refreshRegistryOwner(owner);
       } catch {
       }
@@ -4904,11 +4905,11 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   refreshRegistryOwner(owner) {
     if (this.config.tinycloudRegistryUrl === null) return;
-    const subject = owner.startsWith("did:pkh:") ? (0, import_sdk_core11.pkhDid)(owner.slice(owner.lastIndexOf(":") + 1), this.config.registryChainId ?? 1) : owner;
-    const key = (0, import_sdk_core11.registryOwnerKeyV2)(subject);
+    const subject = owner.startsWith("did:pkh:") ? (0, import_sdk_core12.pkhDid)(owner.slice(owner.lastIndexOf(":") + 1), this.config.registryChainId ?? 1) : owner;
+    const key = (0, import_sdk_core12.registryOwnerKeyV2)(subject);
     if (this.registryRefreshOwners.has(key)) return;
     this.registryRefreshOwners.add(key);
-    void (0, import_sdk_core11.refreshOwnerRegistry)(subject, {
+    void (0, import_sdk_core12.refreshOwnerRegistry)(subject, {
       registryUrl: this.config.tinycloudRegistryUrl,
       registryChainId: this.config.registryChainId,
       sequenceStore: this.config.registrySequenceStore,
@@ -4918,7 +4919,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
   projectSignedRecapCapabilities(siwe) {
     const projected = this.parseRecapWithCaveats(siwe).map((entry) => {
-      const normalized = (0, import_sdk_core11.parseRecapCapabilities)(() => [entry], siwe)[0];
+      const normalized = (0, import_sdk_core12.parseRecapCapabilities)(() => [entry], siwe)[0];
       if (normalized.service !== "tinycloud.encryption") return normalized;
       if (!this.isEncryptionNetworkOperation("encryption", entry.path, entry.space)) {
         return { ...normalized, space: entry.space };
@@ -4962,14 +4963,14 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._address) {
       return void 0;
     }
-    return this.wasmBindings.makeSpaceId(this._address, this._chainId, import_sdk_core11.ACCOUNT_REGISTRY_SPACE);
+    return this.wasmBindings.makeSpaceId(this._address, this._chainId, import_sdk_core12.ACCOUNT_REGISTRY_SPACE);
   }
   /**
    * Account-level application and delegation helpers.
    */
   get account() {
     if (!this._account) {
-      this._account = new import_sdk_core7.AccountService({
+      this._account = new import_sdk_core8.AccountService({
         getDid: () => this.did,
         getHost: () => this.hosts[0] ?? this.config.host,
         getPrimarySpaceId: () => this.spaceId,
@@ -5027,7 +5028,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   async endSession() {
     const leavingAddress = this.address ?? this._restoredTcSession?.address;
     const leavingChainId = this._chainId;
-    const leavingPrincipal = this.replicaSessionPrincipal ?? (leavingAddress ? (0, import_sdk_core11.pkhDid)(leavingAddress, leavingChainId) : void 0);
+    const leavingPrincipal = this.replicaSessionPrincipal ?? (leavingAddress ? (0, import_sdk_core12.pkhDid)(leavingAddress, leavingChainId) : void 0);
     const leavingAuth = this.auth;
     const leavingSignature = leavingAuth?.tinyCloudSession?.signature ?? this._restoredTcSession?.signature;
     const leavingContext = this._serviceContext;
@@ -5179,12 +5180,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.replicaRestoreGate = void 0;
     this._serviceGraph = this.createServiceGraphLifetime();
     this.auth = oldAuth;
-    this.tc = this.auth ? new import_sdk_core11.TinyCloud(this.auth, {
+    this.tc = this.auth ? new import_sdk_core12.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: this.config.telemetry,
       retryPolicy: this.config.retryPolicy
     }) : null;
-    this._capabilityRegistry = new import_sdk_core11.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core12.CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({ sessionManager: this.sessionManager });
     this._sharingService = this.createReceiveOnlySharing();
   }
@@ -5211,7 +5212,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   /**
    * Fresh OpenKey sign-in. The callback receives the SDK's original SIWE and
-   * session JWK before approval; the signed result is verified against those
+   * public session JWK before approval; the signed result is verified against those
    * bytes before the network session or replica stamp is committed.
    */
   async signInWithOpenKey(authorizeFn, options) {
@@ -5272,11 +5273,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.pendingAccountRegistrySync?.controller.abort();
     await this.accountRegistryTail;
     await this.wasmBindings.ensureInitialized?.();
-    const address = (0, import_sdk_core11.canonicalizeAddress)(await this.signer.getAddress());
+    const address = (0, import_sdk_core12.canonicalizeAddress)(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     this.assertSessionEpoch(epoch, "Sign-in");
-    const nextPrincipal = (0, import_sdk_core11.pkhDid)(address, chainId);
-    const priorPrincipal = this.replicaSessionPrincipal ?? (this.address ? (0, import_sdk_core11.pkhDid)(this.address, this._chainId) : void 0);
+    const nextPrincipal = (0, import_sdk_core12.pkhDid)(address, chainId);
+    const priorPrincipal = this.replicaSessionPrincipal ?? (this.address ? (0, import_sdk_core12.pkhDid)(this.address, this._chainId) : void 0);
     if (this.config.replication?.enabled && priorPrincipal && priorPrincipal !== nextPrincipal) {
       const denial = await this.denyReplicaGate({ reason: "account_switch", principal: priorPrincipal, next: nextPrincipal });
       if (denial) {
@@ -5328,7 +5329,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       this.hostedOwnedSpaceIds.add(spaceId);
     }
     this.replicationDelegateSession = void 0;
-    this.replicaSessionPrincipal = (0, import_sdk_core11.pkhDid)(address, chainId);
+    this.replicaSessionPrincipal = (0, import_sdk_core12.pkhDid)(address, chainId);
     this.replicationScopeError = void 0;
     await this.quiesceReplicaRuntime();
     this.assertSessionEpoch(epoch, "Sign-in");
@@ -5346,7 +5347,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primarySession = this.currentTinyCloudSession();
     if (primarySession) {
       this.registerPrimarySessionGrant(primarySession);
-      this.refreshRegistryOwner((0, import_sdk_core11.pkhDid)(primarySession.address, primarySession.chainId));
+      this.refreshRegistryOwner((0, import_sdk_core12.pkhDid)(primarySession.address, primarySession.chainId));
       this.refreshRegistryForCapabilities(this.getVerifiedSessionCapabilities());
       if (this.auth?.spaceHosting === "unknown") {
         await this.checkSpaceHosting();
@@ -5378,7 +5379,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     }
     if (!bootstrapped && this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
-      await this.ensureOwnedSpaceHostedById(this.ownedSpaceId(import_sdk_core11.SECRETS_SPACE));
+      await this.ensureOwnedSpaceHostedById(this.ownedSpaceId(import_sdk_core12.SECRETS_SPACE));
     }
     this.assertSessionEpoch(epoch, "Sign-in");
     if (!bootstrapped) {
@@ -5422,7 +5423,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       this._bootstrapStatus = { skipped: true, reason: "interactive-signer" };
       return false;
     }
-    const steps = (0, import_sdk_core11.bootstrapSteps)(this._address, this._chainId);
+    const steps = (0, import_sdk_core12.bootstrapSteps)(this._address, this._chainId);
     try {
       const decision = await this.resolveBootstrapDecision(steps);
       if (decision.action === "skip") {
@@ -5465,7 +5466,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!auth) {
       throw new Error("Account bootstrap requires an active wallet session");
     }
-    const accountSpaceId = this.ownedSpaceId(import_sdk_core11.ACCOUNT_REGISTRY_SPACE);
+    const accountSpaceId = this.ownedSpaceId(import_sdk_core12.ACCOUNT_REGISTRY_SPACE);
     const skipped = auth.lastActivationSkippedSpaceIds;
     if (skipped.includes(accountSpaceId)) return { action: "run", mode: "fresh" };
     if (skipped.some((spaceId) => enshrinedSpaceIds.has(spaceId))) {
@@ -5488,7 +5489,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
         return { action: "run", mode: "repair" };
       }
-      if (marker.error.code === import_sdk_core11.ErrorCodes.KV_NOT_FOUND && this.markerReadIsUnhostedSpace(marker.error.meta)) {
+      if (marker.error.code === import_sdk_core12.ErrorCodes.KV_NOT_FOUND && this.markerReadIsUnhostedSpace(marker.error.meta)) {
         return { action: "run", mode: "fresh" };
       }
     } catch (err2) {
@@ -5502,7 +5503,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return { action: "run", mode: "repair" };
   }
   async readBootstrapCompletionMarker() {
-    return this.kvForSpace(this.ownedSpaceId(import_sdk_core11.ACCOUNT_REGISTRY_SPACE)).get(
+    return this.kvForSpace(this.ownedSpaceId(import_sdk_core12.ACCOUNT_REGISTRY_SPACE)).get(
       BOOTSTRAP_COMPLETION_MARKER_KEY
     );
   }
@@ -5511,7 +5512,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Bootstrap completion marker requires an active wallet session");
     }
     const canonicalStepIds = new Set(
-      (0, import_sdk_core11.bootstrapSteps)(this._address, this._chainId).map((step) => step.id)
+      (0, import_sdk_core12.bootstrapSteps)(this._address, this._chainId).map((step) => step.id)
     );
     const providedStepIds = new Set(steps.map((step) => step.id));
     if (canonicalStepIds.size !== providedStepIds.size || [...canonicalStepIds].some((stepId) => !providedStepIds.has(stepId))) {
@@ -5522,7 +5523,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       stepIds: [...canonicalStepIds],
       completedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    const written = await this.kvForSpace(this.ownedSpaceId(import_sdk_core11.ACCOUNT_REGISTRY_SPACE)).put(
+    const written = await this.kvForSpace(this.ownedSpaceId(import_sdk_core12.ACCOUNT_REGISTRY_SPACE)).put(
       BOOTSTRAP_COMPLETION_MARKER_KEY,
       marker
     );
@@ -5569,7 +5570,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const warnings = [];
     const primarySession = auth.tinyCloudSession;
     const defaultSpaceId = this.ownedSpaceId("default");
-    const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === import_sdk_core11.BOOTSTRAP_SESSION_REQUESTS.default;
+    const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === import_sdk_core12.BOOTSTRAP_SESSION_REQUESTS.default;
     for (const step of steps) {
       if (step.kind === "host") await this.assertMayCreateSpace(step.spaceId);
     }
@@ -5588,7 +5589,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       try {
         session = await auth.createBootstrapSession({
           spaceId: step.spaceId,
-          capabilityRequest: step.request ?? import_sdk_core11.BOOTSTRAP_SESSION_REQUESTS[step.space],
+          capabilityRequest: step.request ?? import_sdk_core12.BOOTSTRAP_SESSION_REQUESTS[step.space],
           rawAbilities
         });
       } catch (err2) {
@@ -5625,7 +5626,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       for (const destination of destinations) {
         try {
           await (0, import_sdk_services5.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
-          const result = await (0, import_sdk_core11.activateSessionWithHost)(destination.url, session.delegationHeader, graph.signal);
+          const result = await (0, import_sdk_core12.activateSessionWithHost)(destination.url, session.delegationHeader, graph.signal);
           if (!result.success) throw Object.assign(new Error("Bootstrap activation failed"), { cause: result });
           activated = result;
         } catch (error) {
@@ -5645,7 +5646,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       this.registerBootstrapRuntimeGrant(
         session,
-        import_sdk_core11.BOOTSTRAP_SESSION_REQUESTS[step.space],
+        import_sdk_core12.BOOTSTRAP_SESSION_REQUESTS[step.space],
         rawAbilitiesBySpace.get(step.space)
       );
     }
@@ -5695,7 +5696,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       if (step.kind === "seed-applications") {
         const registered = await this.account.applications.register(
-          step.manifests.length > 0 ? [...step.manifests] : import_sdk_core11.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+          step.manifests.length > 0 ? [...step.manifests] : import_sdk_core12.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
           // The write is an INSERT OR REPLACE and is safe to repeat during a
           // repair, so skip the manifest-hash pre-read.
           { assumeUnregistered: true }
@@ -5715,7 +5716,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           migrations: [
             {
               id: "001_initial",
-              sql: [...import_sdk_core11.SECRET_RECORDS_SCHEMA]
+              sql: [...import_sdk_core12.SECRET_RECORDS_SCHEMA]
             }
           ]
         });
@@ -5890,7 +5891,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.signer) {
       throw new Error("Manifest registry write requires wallet mode");
     }
-    const accountSpaceId = this.ownedSpaceId(import_sdk_core11.ACCOUNT_REGISTRY_SPACE);
+    const accountSpaceId = this.ownedSpaceId(import_sdk_core12.ACCOUNT_REGISTRY_SPACE);
     await this.ensureOwnedSpaceHostedById(accountSpaceId, signal);
     if (signal.aborted) throw signal.reason;
     const result = await account.applications.register(request.manifests);
@@ -5905,7 +5906,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const session = context.session;
     if (!session) throw new Error("Account registry requires an active service session");
     const contexts = [context];
-    const accountSpaceId = this.ownedSpaceId(import_sdk_core11.ACCOUNT_REGISTRY_SPACE);
+    const accountSpaceId = this.ownedSpaceId(import_sdk_core12.ACCOUNT_REGISTRY_SPACE);
     const createScopedContext = (spaceId) => {
       const scoped = this._serviceGraph.track(createServiceContext({
         requestSink: this._serviceGraph.requestSink,
@@ -5921,10 +5922,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       contexts.push(scoped);
       return scoped;
     };
-    const sql = new import_sdk_core11.SQLService({});
+    const sql = new import_sdk_core12.SQLService({});
     const sqlContext = createScopedContext(accountSpaceId);
     sql.initialize(sqlContext);
-    const spaces = new import_sdk_core11.SpaceService({
+    const spaces = new import_sdk_core12.SpaceService({
       hosts: context.hosts,
       session,
       invoke: context.invoke,
@@ -5934,14 +5935,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       }),
       userDid: this.did,
       createKVService: (spaceId) => {
-        const kv = new import_sdk_core11.KVService({});
+        const kv = new import_sdk_core12.KVService({});
         kv.initialize(createScopedContext(spaceId));
         return kv;
       }
     });
     return {
       contexts,
-      account: new import_sdk_core7.AccountService({
+      account: new import_sdk_core8.AccountService({
         getDid: () => this.did,
         getHost: () => context.hosts[0] ?? this.config.host,
         getPrimarySpaceId: () => session.spaceId,
@@ -6097,7 +6098,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       return true;
     }
     const indexRead = {
-      spaceId: this.ownedSpaceId(import_sdk_core11.ACCOUNT_REGISTRY_SPACE),
+      spaceId: this.ownedSpaceId(import_sdk_core12.ACCOUNT_REGISTRY_SPACE),
       service: "sql",
       path: "account",
       action: "tinycloud.sql/read"
@@ -6125,7 +6126,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           stopped(error);
           return;
         }
-        const verdict = (0, import_sdk_core11.authorizationVerdictOf)(error);
+        const verdict = (0, import_sdk_core12.authorizationVerdictOf)(error);
         const message = error instanceof Error ? error.message : String(error);
         const isAuthorizationVerdict = verdict === void 0 ? /^(?:Unauthorized Action\b|(?:(?:request failed|HTTP request failed|status(?: code)?|response status)\s*:\s*)?(?:HTTP\s*)?(?:401|403)\b)/i.test(message) : verdict !== "other";
         if (isAuthorizationVerdict) {
@@ -6135,7 +6136,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           );
           return;
         }
-        if ((0, import_sdk_core11.isStorageFullError)(error) || (0, import_sdk_core11.isStorageFullError)(error?.cause) || message.includes(import_sdk_core11.STORAGE_FULL_MESSAGE) || message.includes(import_sdk_core11.STORAGE_WRITE_TOO_LARGE_MESSAGE)) {
+        if ((0, import_sdk_core12.isStorageFullError)(error) || (0, import_sdk_core12.isStorageFullError)(error?.cause) || message.includes(import_sdk_core12.STORAGE_FULL_MESSAGE) || message.includes(import_sdk_core12.STORAGE_WRITE_TOO_LARGE_MESSAGE)) {
           console.warn(
             "TinyCloud account registry sync stopped: storage is full",
             error
@@ -6173,8 +6174,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const networkIds = /* @__PURE__ */ new Set();
     for (const resource of request.resources) {
-      if (resource.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && resource.path.startsWith("urn:tinycloud:encryption:") && resource.actions.includes(DECRYPT_ACTION2)) {
-        const parsed = resource.path.includes("/") ? (0, import_resource2.parseEncryptionResource)(resource.path) : { ...(0, import_sdk_core11.parseNetworkId)(resource.path), kind: "network" };
+      if (resource.service === import_sdk_core12.ENCRYPTION_PERMISSION_SERVICE && resource.path.startsWith("urn:tinycloud:encryption:") && resource.actions.includes(DECRYPT_ACTION2)) {
+        const parsed = resource.path.includes("/") ? (0, import_resource2.parseEncryptionResource)(resource.path) : { ...(0, import_sdk_core12.parseNetworkId)(resource.path), kind: "network" };
         if (parsed.kind === "network") networkIds.add(resource.path);
       }
     }
@@ -6185,7 +6186,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       return;
     }
     for (const networkId of this.requestedEncryptionNetworkIds()) {
-      const parsed = (0, import_sdk_core11.parseNetworkId)(networkId);
+      const parsed = (0, import_sdk_core12.parseNetworkId)(networkId);
       if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
         continue;
       }
@@ -6230,7 +6231,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!host) {
       throw new Error("Owned space hosting requires a TinyCloud host");
     }
-    const activation = await (0, import_sdk_core11.activateSessionWithHost)(host, session.delegationHeader, signal);
+    const activation = await (0, import_sdk_core12.activateSessionWithHost)(host, session.delegationHeader, signal);
     if (activation.success && !activation.skipped?.includes(spaceId)) {
       this.confirmedHostedSpaceIds.add(spaceId);
       return;
@@ -6251,7 +6252,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     if (signal?.aborted) throw signal.reason;
-    const retry = await (0, import_sdk_core11.activateSessionWithHost)(host, session.delegationHeader, signal);
+    const retry = await (0, import_sdk_core12.activateSessionWithHost)(host, session.delegationHeader, signal);
     if (!retry.success || retry.skipped?.includes(spaceId)) {
       throw Object.assign(
         new Error(
@@ -6303,7 +6304,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     if (!this.auth.registryRecordPresent) {
-      const activation = await (0, import_sdk_core11.activateSessionWithHost)(
+      const activation = await (0, import_sdk_core12.activateSessionWithHost)(
         host,
         session.delegationHeader
       );
@@ -6555,7 +6556,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     let restoredAddress;
     try {
-      restoredAddress = hasPersistedProof ? (0, import_sdk_core11.canonicalizeAddress)(sessionData.address) : void 0;
+      restoredAddress = hasPersistedProof ? (0, import_sdk_core12.canonicalizeAddress)(sessionData.address) : void 0;
     } catch {
       throw new InvalidRestoredSessionError("Persisted session has an invalid wallet address.");
     }
@@ -6590,15 +6591,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       stagedSessionExpiry = signedExpiry ?? persistedPolicyExpiry ?? persistedExpiry(void 0);
     }
     const restoreHints = this.explicitHost ? [this.explicitHost] : sessionData.tinycloudHosts ?? [];
-    const resolvedHost = this.config.replication?.enabled ? (await this.routingDestinations(sessionData.spaceId, "read", restoreHints))[0]?.url : void 0;
-    const stagedHost = resolvedHost ?? (0, import_sdk_core11.exactHttpOrigin)(restoreHints[0] ?? this.config.host, "restored host hint");
+    const stagedHost = (0, import_sdk_core12.exactHttpOrigin)(restoreHints[0] ?? this.config.host, "restored host hint");
     let restoredNodeFeatures;
     let replicaProtocolMismatch = false;
     if (this.config.replication?.enabled) {
       try {
-        restoredNodeFeatures = (await (0, import_sdk_core11.checkNodeInfo)(stagedHost, this.wasmBindings.protocolVersion())).features;
+        restoredNodeFeatures = (await (0, import_sdk_core12.checkNodeInfo)(stagedHost, this.wasmBindings.protocolVersion())).features;
       } catch (error) {
-        replicaProtocolMismatch = error instanceof import_sdk_core11.ProtocolMismatchError;
+        replicaProtocolMismatch = error instanceof import_sdk_core12.ProtocolMismatchError;
       }
     }
     const stagedAddress = restoredAddress;
@@ -6609,7 +6609,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     let replicationScopeUnavailable = false;
     if (this.config.replication?.enabled) {
       if (stagedAddress !== void 0) {
-        replicationPrincipal = (0, import_sdk_core11.pkhDid)(stagedAddress, stagedChainId);
+        replicationPrincipal = (0, import_sdk_core12.pkhDid)(stagedAddress, stagedChainId);
       } else {
         try {
           const { replicationScopeFromSignedSession } = await getNodeReplicationLoaders().authority();
@@ -6658,7 +6658,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
       }
     }
-    const stagedNodeDid = stagedAddress ? (0, import_sdk_core11.pkhDid)(stagedAddress, stagedChainId) : canonicalVerificationMethod;
+    const stagedNodeDid = stagedAddress ? (0, import_sdk_core12.pkhDid)(stagedAddress, stagedChainId) : canonicalVerificationMethod;
     const serviceSession = {
       delegationHeader: sessionData.delegationHeader,
       delegationCid: sessionData.delegationCid,
@@ -6686,7 +6686,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       stagedSessionExpiry,
       stagedRecap
     );
-    const stagedAccountSpaceId = stagedAddress ? this.wasmBindings.makeSpaceId(stagedAddress, stagedChainId, import_sdk_core11.ACCOUNT_REGISTRY_SPACE) : void 0;
+    const stagedAccountSpaceId = stagedAddress ? this.wasmBindings.makeSpaceId(stagedAddress, stagedChainId, import_sdk_core12.ACCOUNT_REGISTRY_SPACE) : void 0;
     const stagedGraph = this.stageRestoredServiceGraph({
       host: stagedHost,
       manager: stagedManager,
@@ -6776,7 +6776,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       this.assertSessionEpoch(epoch, "Session restore");
     }
     if (this.config.replication?.enabled) {
-      if (stagedAddress !== void 0) this.refreshRegistryOwner((0, import_sdk_core11.pkhDid)(stagedAddress, stagedChainId));
+      if (stagedAddress !== void 0) this.refreshRegistryOwner((0, import_sdk_core12.pkhDid)(stagedAddress, stagedChainId));
       this.refreshRegistryForCapabilities(this.getVerifiedSessionCapabilities());
     }
   }
@@ -6828,7 +6828,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   stageRestoredServiceGraph(input) {
     const graph = this.createServiceGraphLifetime(input.serviceSession);
-    const core = this.auth ? new import_sdk_core11.TinyCloud(this.auth, {
+    const core = this.auth ? new import_sdk_core12.TinyCloud(this.auth, {
       invokeAny: graph.invokeAny,
       telemetry: this.config.telemetry,
       retryPolicy: this.config.retryPolicy
@@ -6847,16 +6847,16 @@ var _TinyCloudNode = class _TinyCloudNode {
       telemetry: this.config.telemetry,
       retryPolicy: this.config.retryPolicy
     }));
-    const kv = new import_sdk_core11.KVService({});
+    const kv = new import_sdk_core12.KVService({});
     kv.initialize(serviceContext);
     serviceContext.registerService("kv", kv);
-    const sql = new import_sdk_core11.SQLService({});
+    const sql = new import_sdk_core12.SQLService({});
     sql.initialize(serviceContext);
     serviceContext.registerService("sql", sql);
-    const duckdb = new import_sdk_core11.DuckDbService({});
+    const duckdb = new import_sdk_core12.DuckDbService({});
     duckdb.initialize(serviceContext);
     serviceContext.registerService("duckdb", duckdb);
-    const hooks = new import_sdk_core11.HooksService({});
+    const hooks = new import_sdk_core12.HooksService({});
     hooks.initialize(serviceContext);
     serviceContext.registerService("hooks", hooks);
     serviceContext.setSession(input.serviceSession);
@@ -6879,7 +6879,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     vault.initialize(serviceContext);
     serviceContext.registerService("vault", vault);
-    const capabilityRegistry = new import_sdk_core11.CapabilityKeyRegistry();
+    const capabilityRegistry = new import_sdk_core12.CapabilityKeyRegistry();
     if (input.tinyCloudSession) {
       const session = input.tinyCloudSession;
       const delegations = input.recap.map((entry) => ({
@@ -6903,7 +6903,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }, delegations);
       }
     }
-    const delegationManager = new import_sdk_core11.DelegationManager({
+    const delegationManager = new import_sdk_core12.DelegationManager({
       hosts: [input.host],
       accountSpaceId: input.accountSpaceId,
       session: input.serviceSession,
@@ -6914,7 +6914,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       fetch: graph.fetch
     });
     const keyProvider = new WasmKeyProvider({ sessionManager: input.manager });
-    const sharingService = new import_sdk_core11.SharingService({
+    const sharingService = new import_sdk_core12.SharingService({
       hosts: [input.host],
       invoke: graph.invoke,
       fetch: graph.fetch,
@@ -6927,7 +6927,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return this.wasmBindings.computeCid(data, codec);
       },
       createKVService: (config) => {
-        const service = new import_sdk_core11.KVService({ prefix: config.pathPrefix?.replace(/\/$/, "") });
+        const service = new import_sdk_core12.KVService({ prefix: config.pathPrefix?.replace(/\/$/, "") });
         const context = graph.track(createServiceContext({
           requestSink: graph.requestSink,
           invoke: config.invoke,
@@ -6959,7 +6959,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return delegation;
       } : void 0
     });
-    const spaceService = new import_sdk_core11.SpaceService({
+    const spaceService = new import_sdk_core12.SpaceService({
       hosts: [input.host],
       session: input.serviceSession,
       invoke: graph.invoke,
@@ -6968,7 +6968,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       userDid: input.nodeDid,
       createKVService: (spaceId) => {
         graph.assertActive();
-        const scopedKv = new import_sdk_core11.KVService({});
+        const scopedKv = new import_sdk_core12.KVService({});
         const context = graph.track(createServiceContext({
           requestSink: graph.requestSink,
           invoke: graph.invoke,
@@ -6985,7 +6985,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       createVaultService: (spaceId) => {
         graph.assertActive();
-        const scopedKv = new import_sdk_core11.KVService({});
+        const scopedKv = new import_sdk_core12.KVService({});
         const context = graph.track(createServiceContext({
           requestSink: graph.requestSink,
           invoke: graph.invoke,
@@ -7086,7 +7086,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       did: () => session.verificationMethod.split("#", 1)[0],
       sign: async (attenuation) => {
         const now = Math.floor(Date.now() / 1e3);
-        const invocation = await (0, import_sdk_core11.signCompactUcanAuthorization)({
+        const invocation = await (0, import_sdk_core12.signCompactUcanAuthorization)({
           issuerDid: session.verificationMethod.split("#", 1)[0],
           audienceDid: await this.fetchNodeId(),
           attenuation,
@@ -7118,7 +7118,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nodeAudience: input.nodeAudience,
       ...input.role === "policy-enforcement" ? { enforcerDid: input.audienceDid } : {}
     };
-    const root = await (0, import_sdk_core11.signCompactUcanRootAuthorization)({
+    const root = await (0, import_sdk_core12.signCompactUcanRootAuthorization)({
       issuerDid: ownerDid,
       audienceDid: input.audienceDid,
       attenuation: unifiedRootAttenuation(input.capabilities),
@@ -7160,7 +7160,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (decision.needsApproval) return void 0;
       throw new Error(decision.reason ?? "OpenKey automatic credential signing was rejected");
     }
-    if (typeof decision.signature !== "string" || !await (0, import_sdk_core11.verifyEip191MessageSignature)(
+    if (typeof decision.signature !== "string" || !await (0, import_sdk_core12.verifyEip191MessageSignature)(
       request.message,
       decision.signature,
       request.address
@@ -7185,7 +7185,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (approval) {
       const decision = await approval(request);
       if (!decision.approved) throw new Error(decision.reason ?? "Credential signing was rejected");
-      if (decision.signature !== void 0 && !await (0, import_sdk_core11.verifyEip191MessageSignature)(
+      if (decision.signature !== void 0 && !await (0, import_sdk_core12.verifyEip191MessageSignature)(
         request.message,
         decision.signature,
         request.address
@@ -7277,7 +7277,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core11.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core11.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core12.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core12.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions,
       replication: this.config.replication?.enabled === true ? {
         enabled: true,
@@ -7286,7 +7286,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         syncScope: this.config.replication.syncScope
       } : void 0
     });
-    this.tc = new import_sdk_core11.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core12.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: this.config.telemetry,
       retryPolicy: this.config.retryPolicy
@@ -7340,7 +7340,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core11.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core11.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core12.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core12.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions,
       replication: this.config.replication?.enabled === true ? {
         enabled: true,
@@ -7349,7 +7349,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         syncScope: this.config.replication.syncScope
       } : void 0
     });
-    this.tc = new import_sdk_core11.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core12.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: this.config.telemetry,
       retryPolicy: this.config.retryPolicy
@@ -7380,21 +7380,21 @@ var _TinyCloudNode = class _TinyCloudNode {
       telemetry: this.config.telemetry,
       retryPolicy: this.config.retryPolicy
     }));
-    this._kv = new import_sdk_core11.KVService({});
+    this._kv = new import_sdk_core12.KVService({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
     const features = this.nodeFeatures;
     if (features.length === 0 || features.includes("sql")) {
-      this._sql = new import_sdk_core11.SQLService({});
+      this._sql = new import_sdk_core12.SQLService({});
       this._sql.initialize(this._serviceContext);
       this._serviceContext.registerService("sql", this._sql);
     }
     if (features.length === 0 || features.includes("duckdb")) {
-      this._duckdb = new import_sdk_core11.DuckDbService({});
+      this._duckdb = new import_sdk_core12.DuckDbService({});
       this._duckdb.initialize(this._serviceContext);
       this._serviceContext.registerService("duckdb", this._duckdb);
     }
-    this._hooks = new import_sdk_core11.HooksService({});
+    this._hooks = new import_sdk_core12.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -7418,7 +7418,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     kvService.setReadThroughReady(attached);
   }
   createSpaceScopedKVService(spaceId) {
-    const kvService = new import_sdk_core11.KVService({});
+    const kvService = new import_sdk_core12.KVService({});
     if (this._serviceContext) {
       const spaceScopedContext = this._serviceGraph.track(createServiceContext({
         requestSink: this._serviceGraph.requestSink,
@@ -7515,7 +7515,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         const shared = wasm.vault_x25519_dh(receiverPrivateKey, peerPublic);
         return columnDecrypt(shared, ciphertext);
       },
-      verifyNodeSignature: (nodeId, message, signature) => (0, import_sdk_core11.verifyDidKeyEd25519Signature)(nodeId, message, signature)
+      verifyNodeSignature: (nodeId, message, signature) => (0, import_sdk_core12.verifyDidKeyEd25519Signature)(nodeId, message, signature)
     };
   }
   /**
@@ -7531,7 +7531,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (cached) return cached;
     const response = await fetch(`${host}/info`);
     if (!response.ok) {
-      throw await (0, import_sdk_core11.httpResponseError)(response, "Failed to fetch node info");
+      throw await (0, import_sdk_core12.httpResponseError)(response, "Failed to fetch node info");
     }
     const info = await response.json();
     if (typeof info.nodeId !== "string" || info.nodeId.length === 0) {
@@ -7597,7 +7597,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     if (response.status === 404) return null;
     if (!response.ok) {
-      throw await (0, import_sdk_core11.httpResponseError)(response, `Failed to fetch encryption network ${networkId}`);
+      throw await (0, import_sdk_core12.httpResponseError)(response, `Failed to fetch encryption network ${networkId}`);
     }
     const body = await response.json();
     return "descriptor" in body && body.descriptor ? body.descriptor : body;
@@ -7633,7 +7633,7 @@ var _TinyCloudNode = class _TinyCloudNode {
             path: networkId,
             actions: ["tinycloud.encryption/decrypt"]
           }) : void 0;
-          throw new import_sdk_core11.DecryptTransportResponseError(
+          throw new import_sdk_core12.DecryptTransportResponseError(
             response.status,
             permissionHint,
             response.status === 404 && networkId === this.getDefaultEncryptionNetworkId() && await response.text().catch(() => "") === "network not found" ? `Network not found: ${networkId}. Sign in again with a current SDK to create the account's encryption network.` : void 0
@@ -7642,7 +7642,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return await response.json();
       }
     };
-    return new import_sdk_core11.EncryptionService({
+    return new import_sdk_core12.EncryptionService({
       resolveTargetNode: async (networkId) => (await this.encryptionDestination(networkId)).nodeDid,
       crypto: crypto2,
       signer: {
@@ -7657,7 +7657,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           graph.assertActive();
           return {
             ...signed,
-            canonicalBody: (0, import_sdk_core11.canonicalizeEncryptionJson)(
+            canonicalBody: (0, import_sdk_core12.canonicalizeEncryptionJson)(
               input.body
             )
           };
@@ -7681,7 +7681,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           if (!address || !didPrincipalMatches2(principal, did)) {
             return null;
           }
-          const publicSpaceId = (0, import_sdk_core11.makePublicSpaceId)(address, chainId);
+          const publicSpaceId = (0, import_sdk_core12.makePublicSpaceId)(address, chainId);
           const encodedKey = discoveryKey.split("/").map(encodeURIComponent).join("/");
           const response = await graph.fetch(
             `${destination.url}/public/${encodeURIComponent(publicSpaceId)}/kv/${encodedKey}`,
@@ -7713,7 +7713,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   createVaultService(spaceId, kv, encryptionService = this.getEncryptionService(), nodeContext) {
     const wasm = this.wasmBindings;
     const serviceGraph = nodeContext?.serviceGraph ?? this._serviceGraph;
-    const vaultCrypto = (0, import_sdk_core11.createVaultCrypto)({
+    const vaultCrypto = (0, import_sdk_core12.createVaultCrypto)({
       vault_encrypt: wasm.vault_encrypt,
       vault_decrypt: wasm.vault_decrypt,
       vault_derive_key: wasm.vault_derive_key,
@@ -7728,7 +7728,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const chainId = nodeContext?.chainId ?? this._chainId;
     const host = nodeContext?.host ?? this.config.host;
     const ownerDid = this.ownerDidFromSpaceId(spaceId) ?? did;
-    return new import_sdk_core11.DataVaultService({
+    return new import_sdk_core12.DataVaultService({
       spaceId,
       crypto: vaultCrypto,
       encryption: {
@@ -7753,8 +7753,8 @@ var _TinyCloudNode = class _TinyCloudNode {
           serviceGraph.assertActive();
           return self._publicKV ?? self.tc.publicKV;
         },
-        readPublicSpace: (host2, targetSpaceId, key) => import_sdk_core11.TinyCloud.readPublicSpace(host2, targetSpaceId, key),
-        makePublicSpaceId: import_sdk_core11.TinyCloud.makePublicSpaceId,
+        readPublicSpace: (host2, targetSpaceId, key) => import_sdk_core12.TinyCloud.readPublicSpace(host2, targetSpaceId, key),
+        makePublicSpaceId: import_sdk_core12.TinyCloud.makePublicSpaceId,
         did,
         address: address ?? "",
         chainId,
@@ -7768,7 +7768,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   initializeV2Services(serviceSession) {
     const graph = this._serviceGraph;
-    this._capabilityRegistry = new import_sdk_core11.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core12.CapabilityKeyRegistry();
     const tcSession = this.auth?.tinyCloudSession;
     if (tcSession && this._address) {
       const sessionKey = {
@@ -7808,7 +7808,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       this._capabilityRegistry.registerKey(sessionKey, delegations);
     }
-    this._delegationManager = new import_sdk_core11.DelegationManager({
+    this._delegationManager = new import_sdk_core12.DelegationManager({
       hosts: [this.config.host],
       accountSpaceId: this.accountSpaceId,
       session: serviceSession,
@@ -7818,7 +7818,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionInvocationSigner: this.sessionInvocationSignerFor(serviceSession),
       fetch: graph.fetch
     });
-    this._spaceService = new import_sdk_core11.SpaceService({
+    this._spaceService = new import_sdk_core12.SpaceService({
       hosts: [this.config.host],
       session: serviceSession,
       invoke: graph.invoke,
@@ -7884,7 +7884,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       isStorageFull: () => this.ownStorageFull
     });
-    this._sharingService = new import_sdk_core11.SharingService({
+    this._sharingService = new import_sdk_core12.SharingService({
       hosts: [this.config.host],
       session: serviceSession,
       invoke: graph.invoke,
@@ -7903,7 +7903,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       createKVService: (config) => {
         graph.assertActive();
-        const service = new import_sdk_core11.KVService({ prefix: config.pathPrefix?.replace(/\/$/, "") });
+        const service = new import_sdk_core12.KVService({ prefix: config.pathPrefix?.replace(/\/$/, "") });
         const context = graph.track(createServiceContext({
           requestSink: graph.requestSink,
           invoke: config.invoke,
@@ -7991,7 +7991,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       // DID here and rejects the fragment as an invalid audience DID.
       verificationMethod: params.session.verificationMethod.split("#", 1)[0]
     };
-    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(params.expirationSecs * 1e3, "ucan");
+    (0, import_sdk_core12.assertExpiryWithinTechnicalLimit)(params.expirationSecs * 1e3, "ucan");
     const result = this.wasmBindings.createDelegation(
       wasmSession,
       params.delegateDID,
@@ -8001,7 +8001,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       params.notBeforeSecs
     );
     return {
-      ...terminal ? (0, import_sdk_core11.markDelegationTerminal)(result.delegation, params.session.jwk) : { delegation: result.delegation, cid: result.cid },
+      ...terminal ? (0, import_sdk_core12.markDelegationTerminal)(result.delegation, params.session.jwk) : { delegation: result.delegation, cid: result.cid },
       // Rust serde `rename_all = "camelCase"` emits `delegateDid`
       // (lowercase d); the TypeScript interface uses `delegateDID`
       // (historical, matches Delegation.delegateDID). Normalize here.
@@ -8027,13 +8027,13 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!(params.expiresAt instanceof Date) || params.expiresAt.getTime() <= now.getTime()) {
       throw new Error("Owner delegation expiry must be explicit, future, and a valid date");
     }
-    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(params.expiresAt, "siwe");
+    (0, import_sdk_core12.assertExpiryWithinTechnicalLimit)(params.expiresAt, "siwe");
     if (!this.signer) throw new Error("Owner wallet signer is required");
     const session = this.currentTinyCloudSession();
     if (!session) throw new Error("Owner session is required");
-    const ownerDid = (0, import_sdk_core11.pkhDid)(session.address, session.chainId);
+    const ownerDid = (0, import_sdk_core12.pkhDid)(session.address, session.chainId);
     for (const permission of permissions) {
-      if (permission.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && !(0, import_sdk_core11.principalDidEquals)((0, import_sdk_core11.parseNetworkId)(permission.path).ownerDid, ownerDid)) {
+      if (permission.service === import_sdk_core12.ENCRYPTION_PERMISSION_SERVICE && !(0, import_sdk_core12.principalDidEquals)((0, import_sdk_core12.parseNetworkId)(permission.path).ownerDid, ownerDid)) {
         throw new Error("Owner delegation cannot grant a foreign encryption network");
       }
     }
@@ -8115,7 +8115,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   /** Register a signed policy and sibling roots with this Node's Policy/v3 runtime. */
   async registerPolicy(params) {
     this._serviceGraph.assertActive();
-    return (0, import_sdk_core11.registerPolicyV3)({
+    return (0, import_sdk_core12.registerPolicyV3)({
       ...params,
       nodeOrigin: this.config.host,
       fetch: globalThis.fetch.bind(globalThis)
@@ -8128,8 +8128,8 @@ var _TinyCloudNode = class _TinyCloudNode {
    * not sent.
    */
   async authorizeShareDeliveryV3(input) {
-    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(new Date(input.expiresAt), "siwe");
-    const envelopeRef = await (0, import_sdk_core11.shortDeliveryLinkBodyCid)(input.shareUrl, input.trustedOrigins);
+    (0, import_sdk_core12.assertExpiryWithinTechnicalLimit)(new Date(input.expiresAt), "siwe");
+    const envelopeRef = await (0, import_sdk_core12.shortDeliveryLinkBodyCid)(input.shareUrl, input.trustedOrigins);
     const session = this.currentTinyCloudSession();
     const serviceSession = this._serviceContext?.session;
     if (!session || !serviceSession) throw new Error("Share delivery requires an authenticated session");
@@ -8146,21 +8146,21 @@ var _TinyCloudNode = class _TinyCloudNode {
       // Re-normalised through Date, so the sent value is always `YYYY-MM-DDTHH:mm:ss.SSSZ` (UTC, three digits).
       expiresAt: new Date(input.expiresAt).toISOString()
     };
-    const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, import_sdk_core11.canonicalizeEncryptionJson)(body)))));
+    const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, import_sdk_core12.canonicalizeEncryptionJson)(body)))));
     const request = { ...body, requestBodyDigest };
     const authorization = authorizationHeader(this.wasmBindings.invoke(serviceSession, "kv", input.resourcePath, "tinycloud.kv/get"));
     const response = await fetch(`${this.config.host}/policy/v3/deliveries/authorize`, {
       method: "POST",
       headers: { accept: "application/json", "content-type": "application/json", authorization },
-      body: (0, import_sdk_core11.canonicalizeEncryptionJson)(request)
+      body: (0, import_sdk_core12.canonicalizeEncryptionJson)(request)
     });
-    if (response.status === 400 || response.status === 422) throw new import_sdk_core11.ShareDeliveryRefusedError();
+    if (response.status === 400 || response.status === 422) throw new import_sdk_core12.ShareDeliveryRefusedError();
     if (!response.ok) {
       const reply = await response.text().catch(() => response.statusText);
-      const body2 = (await (0, import_sdk_core11.withoutShareLink)(reply, input.shareUrl)).trim().slice(0, 512);
+      const body2 = (await (0, import_sdk_core12.withoutShareLink)(reply, input.shareUrl)).trim().slice(0, 512);
       throw Object.assign(new Error(`V3 share delivery authorization failed: HTTP ${response.status}${body2 ? ` - ${body2}` : ""}`), { status: response.status });
     }
-    const verified = await (0, import_sdk_core11.verifyShareDeliveryAuthorizationV3Bytes)(new Uint8Array(await response.arrayBuffer()), {
+    const verified = await (0, import_sdk_core12.verifyShareDeliveryAuthorizationV3Bytes)(new Uint8Array(await response.arrayBuffer()), {
       request,
       envelope: input.envelope,
       envelopeRef,
@@ -8169,7 +8169,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     const requestDigest = new Uint8Array(await crypto.subtle.digest(
       "SHA-256",
-      new TextEncoder().encode(`${import_sdk_core11.CREDENTIAL_INVITATION_REQUEST_DOMAIN}${(0, import_sdk_core11.canonicalizeEncryptionJson)(verified.request)}`)
+      new TextEncoder().encode(`${import_sdk_core12.CREDENTIAL_INVITATION_REQUEST_DOMAIN}${(0, import_sdk_core12.canonicalizeEncryptionJson)(verified.request)}`)
     ));
     return {
       ...verified,
@@ -8181,7 +8181,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
   }
   async createRootDelegationForSharing(params, assertActive) {
-    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(params.requestedExpiry, "siwe");
+    (0, import_sdk_core12.assertExpiryWithinTechnicalLimit)(params.requestedExpiry, "siwe");
     try {
       return (await this.createOwnerDelegation({
         delegateDid: params.shareKeyDID,
@@ -8238,7 +8238,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._sql) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("sql")) {
-        throw new import_sdk_core11.UnsupportedFeatureError("sql", this.config.host, features);
+        throw new import_sdk_core12.UnsupportedFeatureError("sql", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -8262,7 +8262,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._serviceContext || !this._serviceContext.session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    const sql = new import_sdk_core11.SQLService({});
+    const sql = new import_sdk_core12.SQLService({});
     const spaceScopedContext = this._serviceGraph.track(createServiceContext({
       requestSink: this._serviceGraph.requestSink,
       invoke: this._serviceContext.invoke,
@@ -8294,7 +8294,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._serviceContext || !this._serviceContext.session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    const kv = new import_sdk_core11.KVService({});
+    const kv = new import_sdk_core12.KVService({});
     const spaceScopedContext = this._serviceGraph.track(createServiceContext({
       requestSink: this._serviceGraph.requestSink,
       invoke: this._serviceContext.invoke,
@@ -8314,7 +8314,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._duckdb) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("duckdb")) {
-        throw new import_sdk_core11.UnsupportedFeatureError("duckdb", this.config.host, features);
+        throw new import_sdk_core12.UnsupportedFeatureError("duckdb", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -8393,7 +8393,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       type: NETWORK_ADMIN_TYPE,
       targetNode,
       networkId,
-      bodyHash: (0, import_sdk_core11.canonicalHashHex)(
+      bodyHash: (0, import_sdk_core12.canonicalHashHex)(
         crypto2.sha256,
         body
       ),
@@ -8411,7 +8411,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         Authorization: signed.authorization,
         "Content-Type": "application/json"
       },
-      body: (0, import_sdk_core11.canonicalizeEncryptionJson)(
+      body: (0, import_sdk_core12.canonicalizeEncryptionJson)(
         body
       )
     });
@@ -8423,7 +8423,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     if (!response.ok) {
-      throw await (0, import_sdk_core11.httpResponseError)(response, `Failed to create encryption network ${networkId}`);
+      throw await (0, import_sdk_core12.httpResponseError)(response, `Failed to create encryption network ${networkId}`);
     }
     const created = await response.json();
     return created.descriptor;
@@ -8442,7 +8442,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return existing;
       }
     }
-    const parsed = (0, import_sdk_core11.parseNetworkId)(networkId);
+    const parsed = (0, import_sdk_core12.parseNetworkId)(networkId);
     if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
       throw new Error(
         `Cannot create encryption network ${networkId}: owner ${parsed.ownerDid} does not match signed-in DID ${this.did}`
@@ -8491,7 +8491,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * normal KV and encryption invocation paths.
    */
   async readSecret(input) {
-    const resolved = (0, import_sdk_core11.resolveSecretPath)(input.name, { scope: input.scope });
+    const resolved = (0, import_sdk_core12.resolveSecretPath)(input.name, { scope: input.scope });
     const targetSpace = input.space.startsWith("tinycloud:") ? input.space : this.ownedSpaceId(input.space);
     const result = await this.getBaseVault(targetSpace).readNetworkEncrypted(
       resolved.vaultKey
@@ -8525,7 +8525,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const resolvedSpace = spaceId.startsWith("tinycloud:") ? spaceId : this.ownedSpaceId(spaceId);
     let secrets = this._baseSecrets.get(resolvedSpace);
     if (!secrets) {
-      secrets = new import_sdk_core11.SecretsService(() => this.getBaseVault(resolvedSpace));
+      secrets = new import_sdk_core12.SecretsService(() => this.getBaseVault(resolvedSpace));
       this._baseSecrets.set(resolvedSpace, secrets);
     }
     return secrets;
@@ -8627,7 +8627,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session || !Array.isArray(permissions) || permissions.length === 0) {
       return false;
     }
-    const expanded = (0, import_sdk_core11.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core11.pkhDid)(session.address, session.chainId));
+    const expanded = (0, import_sdk_core12.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core12.pkhDid)(session.address, session.chainId));
     if (this.sessionCoversPermissionEntries(session, expanded)) {
       return true;
     }
@@ -8647,7 +8647,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session || !Array.isArray(permissions) || permissions.length === 0) {
       return [];
     }
-    const expanded = (0, import_sdk_core11.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core11.pkhDid)(session.address, session.chainId));
+    const expanded = (0, import_sdk_core12.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core12.pkhDid)(session.address, session.chainId));
     return this.findRuntimeGrantsForPermissionEntries(expanded, session).map(
       (grant) => grant.delegation
     );
@@ -8668,7 +8668,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     for (const grant of this.runtimePermissionGrants) {
       if (grant.provenance === "primary") continue;
       for (const operation of grant.operations) {
-        const service = import_sdk_core11.SERVICE_SHORT_TO_LONG[operation.service];
+        const service = import_sdk_core12.SERVICE_SHORT_TO_LONG[operation.service];
         if (service === void 0 || typeof operation.path !== "string" || typeof operation.action !== "string") {
           continue;
         }
@@ -8686,7 +8686,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           service,
           ...space === void 0 ? {} : { space },
           path: operation.path,
-          caveats: (0, import_sdk_core11.canonicalizeRecapCaveats)(caveats)
+          caveats: (0, import_sdk_core12.canonicalizeRecapCaveats)(caveats)
         });
         const existing = grouped.get(identity);
         if (existing === void 0) {
@@ -8731,7 +8731,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegationCid: grant.delegationCid,
       spaceId: grant.spaceId,
       jwk: this.sessionKeyJwk,
-      address: (0, import_sdk_core11.canonicalizeAddress)(grant.address),
+      address: (0, import_sdk_core12.canonicalizeAddress)(grant.address),
       chainId: grant.chainId,
       siwe: grant.siwe,
       signature: grant.signature
@@ -8770,7 +8770,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           if (!encryption && destination.nodeDid !== void 0) target.spaces.push(resource);
         }
       } catch (error) {
-        if (!(error instanceof import_sdk_core11.NodeNotFoundError)) throw error;
+        if (!(error instanceof import_sdk_core12.NodeNotFoundError)) throw error;
         unserved ?? (unserved = error);
       }
     }
@@ -8784,7 +8784,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       try {
         await (0, import_sdk_services5.verifyResourceDestination)(target, globalThis.fetch.bind(globalThis));
         const timeout = AbortSignal.timeout(5e3);
-        const result = await (0, import_sdk_core11.activateSessionWithHost)(
+        const result = await (0, import_sdk_core12.activateSessionWithHost)(
           target.url,
           delegationHeader,
           signal ? AbortSignal.any([signal, timeout]) : timeout
@@ -8844,10 +8844,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     const graph = this._serviceGraph;
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core11.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core12.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     if (delegation.expiry.getTime() <= Date.now()) {
-      throw new import_sdk_core11.SessionExpiredError(delegation.expiry);
+      throw new import_sdk_core12.SessionExpiredError(delegation.expiry);
     }
     const expectedDids = [session.verificationMethod, this.sessionDid];
     if (!expectedDids.some((did) => didPrincipalMatches2(delegation.delegateDID, did))) {
@@ -8900,17 +8900,17 @@ var _TinyCloudNode = class _TinyCloudNode {
     const graph = this._serviceGraph;
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core11.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core12.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     const sessionExpiry = extractSiweExpiration(session.siwe);
     if (sessionExpiry !== void 0) {
       const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
       if (sessionExpiry.getTime() <= Date.now() + marginMs) {
-        throw new import_sdk_core11.SessionExpiredError(sessionExpiry);
+        throw new import_sdk_core12.SessionExpiredError(sessionExpiry);
       }
     }
-    const expanded = (0, import_sdk_core11.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core11.pkhDid)(session.address, session.chainId));
-    const bindsShareKey = expanded.some((entry) => entry.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && entry.actions.includes("tinycloud.encryption/key.create"));
+    const expanded = (0, import_sdk_core12.expandRuntimePermissionEntries)(permissions, (0, import_sdk_core12.pkhDid)(session.address, session.chainId));
+    const bindsShareKey = expanded.some((entry) => entry.service === import_sdk_core12.ENCRYPTION_PERMISSION_SERVICE && entry.actions.includes("tinycloud.encryption/key.create"));
     const captured = bindsShareKey ? { ...session, jwk: { ...options?.expectedSessionKey ?? session.jwk } } : session;
     const assertCapturedKey = bindsShareKey ? () => {
       const live = session.jwk;
@@ -8966,7 +8966,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (sessionExpiry !== void 0 && sessionExpiry < expiresAt) {
       expiresAt = sessionExpiry;
     }
-    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(expiresAt, "siwe");
+    (0, import_sdk_core12.assertExpiryWithinTechnicalLimit)(expiresAt, "siwe");
     const delegations = [];
     let rawEntriesAttached = false;
     for (const [spaceId, entries] of bySpace) {
@@ -9007,7 +9007,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         this.assertRuntimeGrantMessage(prepared.siwe, session);
       }
       const signature = options?.signMessage !== void 0 ? await options.signMessage(prepared.siwe) : await this.signer.signMessage(prepared.siwe);
-      if (options?.signMessage !== void 0 && !await (0, import_sdk_core11.verifyEip191MessageSignature)(prepared.siwe, signature, session.address)) {
+      if (options?.signMessage !== void 0 && !await (0, import_sdk_core12.verifyEip191MessageSignature)(prepared.siwe, signature, session.address)) {
         throw new Error("The signature does not match the account that owns this session.");
       }
       graph.assertActive();
@@ -9186,10 +9186,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     await this.assertMayCreateSpace(publicSpaceId);
     await this.auth.hostPublicSpace(publicSpaceId);
-    const kvActions = [import_sdk_core11.KV.PUT, import_sdk_core11.KV.GET, import_sdk_core11.KV.DEL, import_sdk_core11.KV.LIST, import_sdk_core11.KV.METADATA];
+    const kvActions = [import_sdk_core12.KV.PUT, import_sdk_core12.KV.GET, import_sdk_core12.KV.DEL, import_sdk_core12.KV.LIST, import_sdk_core12.KV.METADATA];
     const abilities = { kv: { "": kvActions } };
     const now = /* @__PURE__ */ new Date();
-    const expiryMs = import_sdk_core11.EXPIRY.EPHEMERAL_MS;
+    const expiryMs = import_sdk_core12.EXPIRY.EPHEMERAL_MS;
     const expirationTime = new Date(now.getTime() + expiryMs);
     const prepared = this.wasmBindings.prepareSession({
       abilities,
@@ -9234,7 +9234,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }]);
     }
     if (this._serviceContext) {
-      const publicKV = new import_sdk_core11.KVService({ prefix: "" });
+      const publicKV = new import_sdk_core12.KVService({ prefix: "" });
       const publicContext = this._serviceGraph.track(createServiceContext({
         requestSink: this._serviceGraph.requestSink,
         invoke: this._serviceGraph.invoke,
@@ -9359,14 +9359,14 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core11.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core12.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     const sessionExpiry = extractSiweExpiration(session.siwe);
     if (sessionExpiry !== void 0) {
       const now2 = Date.now();
       const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
       if (sessionExpiry.getTime() <= now2 + marginMs) {
-        throw new import_sdk_core11.SessionExpiredError(sessionExpiry);
+        throw new import_sdk_core12.SessionExpiredError(sessionExpiry);
       }
     }
     if (!Array.isArray(permissions) || permissions.length === 0) {
@@ -9374,18 +9374,18 @@ var _TinyCloudNode = class _TinyCloudNode {
         "delegateTo requires a non-empty permissions array"
       );
     }
-    const expandedEntries = (0, import_sdk_core11.expandDelegationPermissionEntries)(permissions);
-    const namedKeyEntries = expandedEntries.filter((entry) => entry.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && entry.path.includes("/"));
+    const expandedEntries = (0, import_sdk_core12.expandDelegationPermissionEntries)(permissions);
+    const namedKeyEntries = expandedEntries.filter((entry) => entry.service === import_sdk_core12.ENCRYPTION_PERMISSION_SERVICE && entry.path.includes("/"));
     if (namedKeyEntries.length > 0) {
-      if (expandedEntries.some((entry) => entry.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && !entry.path.includes("/"))) {
-        throw new import_sdk_core11.ManifestValidationError("named-key delegation cannot include bare-network permissions");
+      if (expandedEntries.some((entry) => entry.service === import_sdk_core12.ENCRYPTION_PERMISSION_SERVICE && !entry.path.includes("/"))) {
+        throw new import_sdk_core12.ManifestValidationError("named-key delegation cannot include bare-network permissions");
       }
       if (options?.forceWalletSign) {
-        throw new import_sdk_core11.ManifestValidationError("named-key delegation requires a signed session grant");
+        throw new import_sdk_core12.ManifestValidationError("named-key delegation requires a signed session grant");
       }
       const granted = this.projectSignedRecapCapabilities(session.siwe);
       const { subset, missing } = this.signedCapabilitySubset(namedKeyEntries, granted);
-      if (!subset) throw new import_sdk_core11.PermissionNotInManifestError(missing, granted);
+      if (!subset) throw new import_sdk_core12.PermissionNotInManifestError(missing, granted);
     }
     const now = /* @__PURE__ */ new Date();
     const expiryMs = resolveExpiryMs(options?.expiry);
@@ -9419,12 +9419,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     );
     if ("refused" in plan) {
       if (plan.refused === "SESSION_EXPIRING") {
-        throw new import_sdk_core11.SessionExpiredError(plan.expiredAt ?? sessionExpiry ?? /* @__PURE__ */ new Date(0));
+        throw new import_sdk_core12.SessionExpiredError(plan.expiredAt ?? sessionExpiry ?? /* @__PURE__ */ new Date(0));
       }
       if (plan.refused === "CAVEATED_AUTHORITY") {
-        throw new import_sdk_core11.CaveatedDelegationUnsupportedError(plan.caveated ?? []);
+        throw new import_sdk_core12.CaveatedDelegationUnsupportedError(plan.caveated ?? []);
       }
-      throw new import_sdk_core11.PermissionNotInManifestError(plan.missing ?? [], plan.granted ?? []);
+      throw new import_sdk_core12.PermissionNotInManifestError(plan.missing ?? [], plan.granted ?? []);
     }
     if (plan.path === "runtime") {
       const delegation2 = await this.createDelegationViaRuntimeGrant(
@@ -9463,7 +9463,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   planDerivation(expandedEntries, session, effectiveExpiration, nowMs) {
     const caveatedRequest = expandedEntries.filter(
-      (entry) => !(0, import_sdk_core11.recapCaveatsEqual)(entry.caveats, void 0)
+      (entry) => !(0, import_sdk_core12.recapCaveatsEqual)(entry.caveats, void 0)
     );
     if (caveatedRequest.length > 0) {
       return { refused: "CAVEATED_AUTHORITY", caveated: caveatedRequest };
@@ -9604,7 +9604,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }, getNodeReplicationLoaders().gatedNetwork);
         return;
       }
-      const identityPrincipal = principal ?? (this._address === void 0 ? void 0 : (0, import_sdk_core11.pkhDid)(this._address, this._chainId));
+      const identityPrincipal = principal ?? (this._address === void 0 ? void 0 : (0, import_sdk_core12.pkhDid)(this._address, this._chainId));
       if (identityPrincipal === void 0) return;
       const authority = await this.replicationAuthority();
       if (epoch !== this.sessionEpoch || attempt !== this.latestSessionAttempt || this._kv !== kv || this._serviceContext !== context) return;
@@ -9700,7 +9700,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const spaceId = resolvedSpaces.size === 1 ? [...resolvedSpaces][0] : session.spaceId;
     const abilities = {};
     for (const entry of entries) {
-      const shortService = import_sdk_core11.SERVICE_LONG_TO_SHORT[entry.service];
+      const shortService = import_sdk_core12.SERVICE_LONG_TO_SHORT[entry.service];
       if (shortService === void 0) {
         throw new Error(
           `delegateTo: unknown service '${entry.service}' \u2014 no short-form mapping`
@@ -9812,7 +9812,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this.wasmBindings.makeSpaceId(session.address, session.chainId, space);
   }
   expandPermissionEntries(permissions) {
-    return (0, import_sdk_core11.expandPermissionEntries)(permissions);
+    return (0, import_sdk_core12.expandPermissionEntries)(permissions);
   }
   /**
    * Checks the SIWE text a caller-supplied signer is asked to sign: it must be in canonical form (parsing and
@@ -9829,7 +9829,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (parsed.prepareMessage() !== siwe) {
       throw new Error("The prepared sign-in message is not in canonical form.");
     }
-    if (parsed.chainId !== session.chainId || (0, import_sdk_core11.canonicalizeAddress)(parsed.address) !== (0, import_sdk_core11.canonicalizeAddress)(session.address)) {
+    if (parsed.chainId !== session.chainId || (0, import_sdk_core12.canonicalizeAddress)(parsed.address) !== (0, import_sdk_core12.canonicalizeAddress)(session.address)) {
       throw new Error("The prepared sign-in message is for a different account or chain than this session.");
     }
   }
@@ -9839,10 +9839,10 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   assertDelegationCaveatsPreservable(entries) {
     const caveated = entries.filter(
-      (entry) => !(0, import_sdk_core11.recapCaveatsEqual)(entry.caveats, void 0)
+      (entry) => !(0, import_sdk_core12.recapCaveatsEqual)(entry.caveats, void 0)
     );
     if (caveated.length > 0) {
-      throw new import_sdk_core11.CaveatedDelegationUnsupportedError(caveated);
+      throw new import_sdk_core12.CaveatedDelegationUnsupportedError(caveated);
     }
   }
   /**
@@ -9854,7 +9854,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   assertRuntimeGrantCaveatsPreservable(entries, requestedOperations, grant) {
     const caveated = this.caveatedRuntimeGrantEntries(entries, requestedOperations, grant);
     if (caveated.length > 0) {
-      throw new import_sdk_core11.CaveatedDelegationUnsupportedError(caveated);
+      throw new import_sdk_core12.CaveatedDelegationUnsupportedError(caveated);
     }
   }
   /**
@@ -9871,7 +9871,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         const requested = requestedOperations[operationIndex++];
         if (!requested) continue;
         const constrained = grant.operations.find(
-          (granted) => this.operationCovers(granted, requested) && !(0, import_sdk_core11.recapCaveatsEqual)(granted.caveats, void 0)
+          (granted) => this.operationCovers(granted, requested) && !(0, import_sdk_core12.recapCaveatsEqual)(granted.caveats, void 0)
         );
         if (constrained) {
           caveated.push({
@@ -9888,7 +9888,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   assertPortableDelegationCaveatsPreservable(delegation) {
     const entries = [];
     const add = (service, space, path, actions, caveats) => {
-      if ((0, import_sdk_core11.recapCaveatsEqual)(caveats, void 0)) return;
+      if ((0, import_sdk_core12.recapCaveatsEqual)(caveats, void 0)) return;
       entries.push({
         service: service.startsWith("tinycloud.") ? service : `tinycloud.${service}`,
         space,
@@ -9908,11 +9908,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       add(resource.service, resource.space, resource.path, resource.actions, resource.caveats);
     }
     if (entries.length > 0) {
-      throw new import_sdk_core11.CaveatedDelegationUnsupportedError(entries);
+      throw new import_sdk_core12.CaveatedDelegationUnsupportedError(entries);
     }
   }
   shortServiceName(service) {
-    const short = import_sdk_core11.SERVICE_LONG_TO_SHORT[service];
+    const short = import_sdk_core12.SERVICE_LONG_TO_SHORT[service];
     if (short === void 0) {
       throw new Error(
         `unknown service '${service}' \u2014 no short-form mapping`
@@ -9939,7 +9939,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return abilities;
   }
   isEncryptionPermissionEntry(entry) {
-    return entry.service === import_sdk_core11.ENCRYPTION_PERMISSION_SERVICE && this.isEncryptionNetworkOperation("encryption", entry.path, entry.space);
+    return entry.service === import_sdk_core12.ENCRYPTION_PERMISSION_SERVICE && this.isEncryptionNetworkOperation("encryption", entry.path, entry.space);
   }
   isRawRevocationPermissionEntry(entry) {
     return entry.service === "tinycloud.delegation" && entry.path === "" && entry.space?.startsWith("urn:cid:") === true && entry.actions.includes("tinycloud.delegation/revoke");
@@ -9987,7 +9987,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const missing = requested.filter((entry) => {
       const raw = this.isEncryptionPermissionEntry(entry) || this.isRawRevocationPermissionEntry(entry);
       const comparable = raw && this.isEncryptionPermissionEntry(entry) ? { ...entry, space: "encryption" } : entry;
-      return !(0, import_sdk_core11.isCapabilitySubset)([comparable], raw ? rawGranted : spaceGranted).subset;
+      return !(0, import_sdk_core12.isCapabilitySubset)([comparable], raw ? rawGranted : spaceGranted).subset;
     });
     return { subset: missing.length === 0, missing };
   }
@@ -10234,7 +10234,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (granted.service !== requested.service || !this.actionContains(granted.action, requested.action)) {
       return false;
     }
-    if (requested.caveats !== void 0 && !(0, import_sdk_core11.recapCaveatsEqual)(granted.caveats, requested.caveats)) {
+    if (requested.caveats !== void 0 && !(0, import_sdk_core12.recapCaveatsEqual)(granted.caveats, requested.caveats)) {
       return false;
     }
     if (granted.resource !== void 0 || requested.resource !== void 0) {
@@ -10256,7 +10256,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (grantedAction === requestedAction) {
       return true;
     }
-    if ((0, import_sdk_core11.isExplicitOnlyAction)(requestedAction)) {
+    if ((0, import_sdk_core12.isExplicitOnlyAction)(requestedAction)) {
       return false;
     }
     if (grantedAction.endsWith("/*")) {
@@ -10368,7 +10368,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (resolvedDelegateDID.endsWith(".eth") && this.config.ensResolver) {
       const address = await this.config.ensResolver.resolveAddress(resolvedDelegateDID);
       if (!address) throw new Error(`Could not resolve ENS name: ${resolvedDelegateDID}`);
-      resolvedDelegateDID = (0, import_sdk_core11.pkhDid)(address, 1);
+      resolvedDelegateDID = (0, import_sdk_core12.pkhDid)(address, 1);
     }
     const entries = legacyParamsToPermissionEntries(
       params.actions,
@@ -10382,7 +10382,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       });
       return result.delegation;
     } catch (err2) {
-      if (err2 instanceof import_sdk_core11.PermissionNotInManifestError) {
+      if (err2 instanceof import_sdk_core12.PermissionNotInManifestError) {
       } else {
         throw err2;
       }
@@ -10426,7 +10426,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const now = /* @__PURE__ */ new Date();
     const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
     const expirationTime = new Date(now.getTime() + expiryMs);
-    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(expirationTime, "siwe");
+    (0, import_sdk_core12.assertExpiryWithinTechnicalLimit)(expirationTime, "siwe");
     const prepared = this.wasmBindings.prepareSession({
       abilities,
       address: this.wasmBindings.ensureEip55(session.address),
@@ -10465,12 +10465,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     const hasKvActions = params.actions.some((a) => a.startsWith("tinycloud.kv/"));
     if (hasKvActions && params.includePublicSpace !== false) {
-      const publicSpaceId = (0, import_sdk_core11.makePublicSpaceId)(
+      const publicSpaceId = (0, import_sdk_core12.makePublicSpaceId)(
         this.wasmBindings.ensureEip55(session.address),
         session.chainId
       );
       const publicAbilities = {
-        kv: { "": [import_sdk_core11.KV.GET, import_sdk_core11.KV.PUT, import_sdk_core11.KV.METADATA] }
+        kv: { "": [import_sdk_core12.KV.GET, import_sdk_core12.KV.PUT, import_sdk_core12.KV.METADATA] }
       };
       const publicPrepared = this.wasmBindings.prepareSession({
         abilities: publicAbilities,
@@ -10495,7 +10495,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           delegationHeader: publicSession.delegationHeader,
           spaceId: publicSpaceId,
           path: "",
-          actions: [import_sdk_core11.KV.GET, import_sdk_core11.KV.PUT, import_sdk_core11.KV.METADATA],
+          actions: [import_sdk_core12.KV.GET, import_sdk_core12.KV.PUT, import_sdk_core12.KV.METADATA],
           disableSubDelegation: false,
           expiry: expirationTime,
           delegateDID: params.delegateDID,
@@ -10575,7 +10575,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const { abilities, rawAbilities } = this.buildActivationAbilities(delegation);
     const now = /* @__PURE__ */ new Date();
     const expirationTime = delegation.expiry;
-    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(expirationTime, "siwe");
+    (0, import_sdk_core12.assertExpiryWithinTechnicalLimit)(expirationTime, "siwe");
     const prepared = this.wasmBindings.prepareSession({
       abilities,
       address: this.wasmBindings.ensureEip55(mySession.address),
@@ -10691,7 +10691,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const now = /* @__PURE__ */ new Date();
     const requestedExpiry = params.expiryMs === void 0 ? parentDelegation.expiry : new Date(now.getTime() + params.expiryMs);
     const actualExpiry = requestedExpiry > parentDelegation.expiry ? parentDelegation.expiry : requestedExpiry;
-    (0, import_sdk_core11.assertExpiryWithinTechnicalLimit)(actualExpiry, "siwe");
+    (0, import_sdk_core12.assertExpiryWithinTechnicalLimit)(actualExpiry, "siwe");
     const abilities = {};
     const rawAbilities = {};
     for (const resource of requestedResources) {
@@ -10765,7 +10765,6 @@ _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS = 6e4;
 var TinyCloudNode = _TinyCloudNode;
 
 // src/core.ts
-var import_sdk_core14 = require("@tinycloud/sdk-core");
 var import_sdk_core15 = require("@tinycloud/sdk-core");
 var import_sdk_core16 = require("@tinycloud/sdk-core");
 var import_sdk_core17 = require("@tinycloud/sdk-core");
@@ -10775,6 +10774,7 @@ var import_sdk_core20 = require("@tinycloud/sdk-core");
 var import_sdk_core21 = require("@tinycloud/sdk-core");
 var import_sdk_core22 = require("@tinycloud/sdk-core");
 var import_sdk_core23 = require("@tinycloud/sdk-core");
+var import_sdk_core24 = require("@tinycloud/sdk-core");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACCOUNT_REGISTRY_PATH,