@tinycloud/node-sdk 3.2.0-beta.1 → 3.2.0-beta.3

package/dist/index.cjs

@@ -5,6 +5,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -32,6 +35,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
 
 // ../../node_modules/bn.js/lib/bn.js
 var require_bn = __commonJS({
@@ -14350,8 +14358,8 @@ function searchPath(object, path) {
   }
   return currentChild;
 }
-function uuidV4(randomBytes2) {
-  const bytes = arrayify(randomBytes2);
+function uuidV4(randomBytes3) {
+  const bytes = arrayify(randomBytes3);
   bytes[6] = bytes[6] & 15 | 64;
   bytes[8] = bytes[8] & 63 | 128;
   const value = hexlify(bytes);
@@ -17022,166 +17030,632 @@ var require_utils2 = __commonJS({
   }
 });
 
+// src/replication/config.ts
+function assertValidReplicationConfig(replication) {
+  if (replication === void 0 || replication.enabled !== true) return;
+  if (replication.storage === void 0 || replication.storage === null) {
+    throw new TypeError("replication.enabled requires replication.storage");
+  }
+  if (!Array.isArray(replication.prefixes) || replication.prefixes.length === 0) {
+    throw new TypeError("replication.prefixes must be a non-empty array");
+  }
+  for (const prefix of replication.prefixes) {
+    if (typeof prefix !== "string" || prefix === "") {
+      throw new TypeError("replication.prefixes must not contain an empty prefix");
+    }
+  }
+  for (const [index, prefix] of replication.prefixes.entries()) {
+    for (const other of replication.prefixes.slice(index + 1)) {
+      if ((0, import_sdk_services.kvPrefixCovers)(prefix, other) || (0, import_sdk_services.kvPrefixCovers)(other, prefix)) {
+        throw new TypeError(
+          `replication.prefixes must not overlap: ${JSON.stringify(prefix)} and ${JSON.stringify(other)}`
+        );
+      }
+    }
+    if (prefix.split("/", 1)[0] === "vault" && replication.allowSecrets !== true) {
+      throw new TypeError(
+        `replication prefix ${JSON.stringify(prefix)} overlaps the vault namespace; pass allowSecrets to opt in`
+      );
+    }
+  }
+}
+var import_sdk_services;
+var init_config = __esm({
+  "src/replication/config.ts"() {
+    "use strict";
+    import_sdk_services = require("@tinycloud/sdk-services");
+  }
+});
+
+// src/replication/authority-sign-in.ts
+function hasUnrestrictedGetCoverage(entries, spaceId, prefix) {
+  const requiredPaths = (0, import_sdk_core2.grantPathsForSelector)(prefix);
+  return (0, import_sdk_core2.isCapabilitySubset)(
+    requiredPaths.map((path) => ({ service: KV_SERVICE, space: spaceId, path, actions: [KV_GET] })),
+    [...entries]
+  ).subset;
+}
+function augmentSignInEntriesWithReplication(input) {
+  const out = [];
+  const replication = input.replication;
+  if (replication === void 0) return out;
+  for (const prefix of replication.prefixes) {
+    if ((0, import_sdk_services2.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
+      continue;
+    }
+    if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, prefix)) {
+      continue;
+    }
+    for (const path of (0, import_sdk_core2.grantPathsForSelector)(prefix)) {
+      out.push({
+        service: KV_SERVICE,
+        space: input.primarySpaceId,
+        path,
+        actions: [KV_GET, KV_SYNC]
+      });
+    }
+  }
+  return out;
+}
+var import_sdk_core2, import_sdk_services2, KV_GET, KV_SYNC, KV_SERVICE;
+var init_authority_sign_in = __esm({
+  "src/replication/authority-sign-in.ts"() {
+    "use strict";
+    import_sdk_core2 = require("@tinycloud/sdk-core");
+    import_sdk_services2 = require("@tinycloud/sdk-services");
+    KV_GET = import_sdk_core2.KV.GET;
+    KV_SYNC = import_sdk_core2.KV.SYNC;
+    KV_SERVICE = "tinycloud.kv";
+  }
+});
+
+// src/replication/runtime.ts
+var runtime_exports = {};
+__export(runtime_exports, {
+  ReplicationRuntime: () => ReplicationRuntime
+});
+function resolvedOptions(options) {
+  return {
+    ...options,
+    syncIntervalMs: options.syncIntervalMs ?? 6e4,
+    maxStalenessMs: options.maxStalenessMs ?? 12e4,
+    staleSyncTimeoutMs: options.staleSyncTimeoutMs ?? 5e3,
+    allowSecrets: options.allowSecrets === true,
+    verify: options.verify === true
+  };
+}
+var import_sdk_core10, scheduler, ReplicationRuntime;
+var init_runtime = __esm({
+  "src/replication/runtime.ts"() {
+    "use strict";
+    import_sdk_core10 = require("@tinycloud/sdk-core");
+    scheduler = {
+      now: () => Date.now(),
+      setTimeout(fn, ms) {
+        const timer = setTimeout(fn, ms);
+        timer.unref?.();
+        return () => clearTimeout(timer);
+      }
+    };
+    ReplicationRuntime = class {
+      constructor(options, clock = scheduler) {
+        this.options = options;
+        this.clock = clock;
+        this.pending = /* @__PURE__ */ new Map();
+        this.attached = /* @__PURE__ */ new Map();
+        this.previous = Promise.resolve();
+        this.binding = Promise.resolve();
+        this.generation = 0;
+        this.bindingActive = false;
+        this.pendingPurgeSet = false;
+        this.closed = false;
+        this.control = {
+          status: async () => {
+            await this.binding;
+            return this.current ? this.current.status() : [];
+          },
+          sync: async (input) => {
+            await this.binding;
+            if (this.purgedGeneration === this.generation) return;
+            if (this.current) await this.current.sync(input);
+          },
+          purge: (input) => {
+            if (this.bindingActive) {
+              this.pendingPurge = input;
+              this.pendingPurgeSet = true;
+              const existing = this.current ?? this.lastController;
+              if (existing) {
+                this.pendingPurgeResult = existing.purge(input);
+                this.purgedGeneration = this.generation;
+              }
+              return this.binding.then(() => this.pendingPurgeResult ?? { purged: [], failed: [] });
+            }
+            const controller = this.current ?? this.lastController;
+            if (!controller) return Promise.resolve({ purged: [], failed: [] });
+            this.purgedGeneration = this.generation;
+            return controller.purge(input);
+          },
+          clearPending: async () => {
+            await this.binding;
+            if (this.current) return this.current.clearPending();
+            const pending = this.lastPending;
+            if (!pending) return 0;
+            return pending.update((state) => {
+              const before = state.records.length;
+              state.records = state.records.filter(
+                (record) => record.state === "committed" || record.state === "in_flight" && this.clock.now() - Date.parse(record.at) <= 10 * 6e4
+              );
+              return before - state.records.length;
+            });
+          },
+          close: async () => {
+            this.closed = true;
+            this.unbind();
+            await this.binding.catch(() => void 0);
+            await this.previous;
+          }
+        };
+      }
+      loadServices() {
+        return this.services ?? (this.services = import("@tinycloud/sdk-services/kv/replication"));
+      }
+      detachAll() {
+        for (const kv of this.attached.keys()) kv.setReadThrough(null);
+        this.attached.clear();
+      }
+      bind(input) {
+        if (this.closed || !this.options.enabled) return Promise.resolve();
+        this.bindingActive = true;
+        const generation = ++this.generation;
+        this.purgedGeneration = void 0;
+        const { context, session } = input;
+        const emit = (event) => {
+          try {
+            this.options.onEvent?.(event);
+          } catch {
+          }
+          const { type, ...data } = event;
+          context.emit(type, data);
+        };
+        const previous = this.current;
+        this.current = void 0;
+        for (const kv of this.attached.keys()) kv.setReadThrough(null);
+        this.primarySpace = session.spaceId;
+        const close = previous ? previous.close().catch(() => void 0) : Promise.resolve();
+        this.previous = this.previous.then(() => close);
+        const previousClose = this.previous;
+        this.binding = this.loadServices().then((services) => {
+          if (generation !== this.generation || this.closed) return;
+          let identity;
+          try {
+            identity = services.canonicalReplicationIdentity({
+              host: context.hosts[0],
+              space: session.spaceId,
+              principal: input.principal ?? (0, import_sdk_core10.pkhDid)(input.address, input.chainId)
+            });
+          } catch {
+            for (const prefix of this.options.prefixes) {
+              emit({ type: "replication.state", at: new Date(this.clock.now()).toISOString(), space: session.spaceId, replica: prefix, state: "unavailable", code: "CONFIG_INVALID" });
+            }
+            return;
+          }
+          const key2 = services.replicationIdentityKey(identity);
+          let pending = this.pending.get(key2);
+          if (!pending) {
+            pending = this.options.storage.pendingWrites?.(identity) ?? services.createMemoryPendingStore(identity);
+            this.pending.set(key2, pending);
+          }
+          this.lastPending = pending;
+          const controller = services.createKVReplication({
+            options: resolvedOptions(this.options),
+            mode: this.options.mode ?? "background",
+            storage: this.options.storage,
+            identity,
+            session: { id: session.delegationCid, did: session.verificationMethod, space: session.spaceId },
+            authority: input.authority,
+            pending,
+            scheduler: this.clock,
+            emit,
+            fetch: context.fetch,
+            previous: previousClose
+          });
+          this.current = controller;
+          this.lastController = controller;
+          this.lastIdentity = identity;
+          for (const [kv, space] of this.attached) {
+            kv.setReadThrough(space === this.primarySpace ? controller : null);
+          }
+          for (const scoped of input.primaryKV) this.attach(scoped.space, scoped.kv);
+          if (this.pendingPurgeSet) {
+            this.pendingPurgeResult = controller.purge(this.pendingPurge);
+            this.purgedGeneration = generation;
+            this.pendingPurge = void 0;
+            this.pendingPurgeSet = false;
+          }
+        }).finally(() => {
+          if (generation === this.generation) this.bindingActive = false;
+        });
+        for (const kv of this.attached.keys()) kv.setReadThroughReady?.(this.binding);
+        return this.binding;
+      }
+      attach(space, kv) {
+        this.attached.set(kv, space);
+        kv.setReadThrough(space === this.primarySpace ? this.current ?? null : null);
+        return this.binding.then(() => {
+          kv.setReadThrough(space === this.primarySpace ? this.current ?? null : null);
+        });
+      }
+      unbind() {
+        this.generation++;
+        this.bindingActive = false;
+        this.pendingPurgeSet = false;
+        const controller = this.current;
+        this.current = void 0;
+        this.primarySpace = void 0;
+        this.detachAll();
+        const binding = this.binding;
+        const close = binding.then(() => controller?.close()).catch(() => void 0);
+        this.previous = this.previous.then(() => close);
+        return this.previous;
+      }
+      get boundIdentity() {
+        return this.lastIdentity;
+      }
+    };
+  }
+});
+
+// src/replication/authority.ts
+var authority_exports = {};
+__export(authority_exports, {
+  AUTHORITY_EXPIRY_MARGIN_MS: () => AUTHORITY_EXPIRY_MARGIN_MS,
+  assertValidReplicationConfig: () => assertValidReplicationConfig,
+  augmentSignInEntriesWithReplication: () => augmentSignInEntriesWithReplication,
+  createReplicationAuthority: () => createReplicationAuthority,
+  hasUnrestrictedGetCoverage: () => hasUnrestrictedGetCoverage,
+  replicationScopeFromSignedSession: () => replicationScopeFromSignedSession,
+  ucanAttCovers: () => ucanAttCovers,
+  ucanAttUnconstrainedFor: () => ucanAttUnconstrainedFor
+});
+function replicationEntries(spaceId, prefix) {
+  return (0, import_sdk_core11.grantPathsForSelector)(prefix).map((path) => ({
+    service: KV_SERVICE2,
+    space: spaceId,
+    path,
+    actions: [KV_GET2, KV_SYNC2]
+  }));
+}
+function caveatBranchesUnconstrained(value) {
+  if (value === void 0 || value === null) return true;
+  if (typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0) {
+    return true;
+  }
+  if (!Array.isArray(value)) return false;
+  try {
+    return (0, import_sdk_core11.canonicalizeRecapCaveats)(value) === (0, import_sdk_core11.canonicalizeRecapCaveats)(void 0);
+  } catch {
+    return false;
+  }
+}
+function kvPathInResource(resource, space) {
+  for (const base2 of [`${space}/kv/`, `tinycloud://${space}/kv/`]) {
+    if (resource.startsWith(base2)) return resource.slice(base2.length);
+  }
+  return void 0;
+}
+function ucanAttCovers(att, space, prefix, ability, options) {
+  const requiredPaths = prefix.endsWith("/") ? [prefix] : [prefix, `${prefix}/`];
+  return requiredPaths.every((requestedPath) => {
+    for (const [resource, abilities] of Object.entries(att)) {
+      const path = kvPathInResource(resource, space);
+      if (path === void 0) continue;
+      for (const [granted, caveats] of Object.entries(abilities)) {
+        if (!(0, import_sdk_core11.actionContains)(granted, ability)) continue;
+        if (!(0, import_sdk_core11.isCapabilitySubset)(
+          [{ service: KV_SERVICE2, space, path: requestedPath, actions: [ability] }],
+          [{ service: KV_SERVICE2, space, path, actions: [granted] }]
+        ).subset) continue;
+        if (options?.ignoreCaveats === true || caveatBranchesUnconstrained(caveats)) return true;
+      }
+    }
+    return false;
+  });
+}
+function ucanAttUnconstrainedFor(att, space, prefix) {
+  return ucanAttCovers(att, space, prefix, KV_GET2) && ucanAttCovers(att, space, prefix, KV_SYNC2);
+}
+function replicationScopeFromSignedSession(input) {
+  let grant;
+  try {
+    grant = parseUcanGrant(input.delegationHeader.Authorization);
+  } catch {
+    return void 0;
+  }
+  const bareDid = (value) => value.split("#", 1)[0];
+  if (grant.cid !== input.delegationCid || bareDid(grant.audience) !== bareDid(input.verificationMethod)) return void 0;
+  for (const resource of Object.keys(grant.att)) {
+    const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv\//)?.[1];
+    if (space !== input.persistedSpace) continue;
+    const owner = (0, import_sdk_core11.parseSpaceUri)(space);
+    if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };
+  }
+  return void 0;
+}
+function createReplicationAuthority(host) {
+  const planOrRefusal = (entries) => {
+    const plan = host.planDelegation(entries);
+    if ("refused" in plan) return plan;
+    return { path: plan.path, parentCid: plan.parentCid, expiresAt: plan.expiresAt };
+  };
+  const sessionAudience = (value) => value.split("#", 1)[0];
+  const signedSessionGrant = (session) => {
+    const grant = parseUcanGrant(session.delegationHeader.Authorization);
+    if (grant.cid !== session.delegationCid || sessionAudience(grant.audience) !== sessionAudience(session.verificationMethod)) return void 0;
+    return grant;
+  };
+  const authority = {
+    get sessionOnly() {
+      const session = host.replicationSession();
+      return session !== void 0 && session.siwe === void 0;
+    },
+    sessionGrant(prefix) {
+      const session = host.replicationSession();
+      if (session === void 0) return { refused: "SESSION_EXPIRING" };
+      const siweExpiry = session.siwe ? host.siweExpiration(session.siwe)?.getTime() : void 0;
+      if (siweExpiry !== void 0 && siweExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {
+        return { refused: "SESSION_EXPIRING" };
+      }
+      let grant;
+      try {
+        const verified = signedSessionGrant(session);
+        if (!verified) return { refused: "NOT_COVERED" };
+        grant = verified;
+      } catch {
+        return { refused: "NOT_COVERED" };
+      }
+      const tokenExpiry = grant.expiresAt === null ? void 0 : grant.expiresAt * 1e3;
+      if (tokenExpiry === void 0 || tokenExpiry <= Date.now() + AUTHORITY_EXPIRY_MARGIN_MS) {
+        return { refused: "SESSION_EXPIRING" };
+      }
+      const covered = ucanAttCovers(grant.att, session.spaceId, prefix, KV_GET2, { ignoreCaveats: true }) && ucanAttCovers(grant.att, session.spaceId, prefix, KV_SYNC2, { ignoreCaveats: true });
+      if (!covered) return { refused: "NOT_COVERED" };
+      if (!ucanAttUnconstrainedFor(grant.att, session.spaceId, prefix)) {
+        return { refused: "CAVEATED_AUTHORITY" };
+      }
+      return {
+        ucan: grant.jwt,
+        device: { did: session.verificationMethod, jwk: session.jwk }
+      };
+    },
+    plan(prefix) {
+      const session = host.replicationSession();
+      if (session === void 0) return { refused: "SESSION_EXPIRING" };
+      const sessionGrant = this.sessionGrant(prefix);
+      if (!("refused" in sessionGrant)) {
+        const signed2 = signedSessionGrant(session);
+        if (!signed2 || signed2.expiresAt === null) return { refused: "NOT_COVERED" };
+        return {
+          path: "session",
+          parentCid: session.delegationCid,
+          expiresAt: signed2.expiresAt * 1e3
+        };
+      }
+      if (authority.sessionOnly) return sessionGrant;
+      return planOrRefusal(replicationEntries(session.spaceId, prefix));
+    },
+    async mint(deviceDid, prefix, signal) {
+      if (authority.sessionOnly) throw new Error("compact delegate sessions cannot mint device grants");
+      const session = host.replicationSession();
+      if (session === void 0) throw new Error("replication mint without a session");
+      const entries = replicationEntries(session.spaceId, prefix);
+      const plan = planOrRefusal(entries);
+      if ("refused" in plan) {
+        throw Object.assign(
+          new Error(`replication authority refused the mint: ${plan.refused}`),
+          { refused: plan.refused }
+        );
+      }
+      signal.throwIfAborted();
+      const minted = await new Promise((resolve, reject2) => {
+        const onAbort = () => reject2(signal.reason ?? new Error("replication mint aborted"));
+        signal.addEventListener("abort", onAbort, { once: true });
+        host.mintDelegation(deviceDid, entries).then(
+          (result) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(result);
+          },
+          (error) => {
+            signal.removeEventListener("abort", onAbort);
+            reject2(error instanceof Error ? error : new Error(String(error)));
+          }
+        );
+      });
+      return { ucan: minted.ucan, parentCid: plan.parentCid, expiresAt: minted.expiresAt };
+    }
+  };
+  return authority;
+}
+var import_sdk_core11, import_replica, parseUcanGrant, KV_GET2, KV_SYNC2, KV_SERVICE2, AUTHORITY_EXPIRY_MARGIN_MS;
+var init_authority = __esm({
+  "src/replication/authority.ts"() {
+    "use strict";
+    import_sdk_core11 = require("@tinycloud/sdk-core");
+    import_replica = require("@tinycloud/replica");
+    init_config();
+    init_authority_sign_in();
+    parseUcanGrant = import_replica.parseUcanGrant;
+    KV_GET2 = import_sdk_core11.KV.GET;
+    KV_SYNC2 = import_sdk_core11.KV.SYNC;
+    KV_SERVICE2 = "tinycloud.kv";
+    AUTHORITY_EXPIRY_MARGIN_MS = 6e4;
+  }
+});
+
 // src/index.ts
-var index_exports = {};
-__export(index_exports, {
+var src_exports = {};
+__export(src_exports, {
   ACCEPTED_MARKER_VERSIONS: () => ACCEPTED_MARKER_VERSIONS,
-  ACCOUNT_REGISTRY_PATH: () => import_sdk_core12.ACCOUNT_REGISTRY_PATH,
-  ACCOUNT_REGISTRY_SPACE: () => import_sdk_core12.ACCOUNT_REGISTRY_SPACE,
-  AccountService: () => import_sdk_core4.AccountService,
-  AutoApproveSpaceCreationHandler: () => import_sdk_core11.AutoApproveSpaceCreationHandler,
+  ACCOUNT_REGISTRY_PATH: () => import_sdk_core16.ACCOUNT_REGISTRY_PATH,
+  ACCOUNT_REGISTRY_SPACE: () => import_sdk_core16.ACCOUNT_REGISTRY_SPACE,
+  AccountService: () => import_sdk_core5.AccountService,
+  AutoApproveSpaceCreationHandler: () => import_sdk_core15.AutoApproveSpaceCreationHandler,
   BOOTSTRAP_COMPLETION_MARKER_KEY: () => BOOTSTRAP_COMPLETION_MARKER_KEY,
   BOOTSTRAP_COMPLETION_MARKER_VERSION: () => BOOTSTRAP_COMPLETION_MARKER_VERSION,
-  CapabilityKeyRegistry: () => import_sdk_core20.CapabilityKeyRegistry,
-  CapabilityKeyRegistryErrorCodes: () => import_sdk_core20.CapabilityKeyRegistryErrorCodes,
-  CaveatedDelegationUnsupportedError: () => import_sdk_core12.CaveatedDelegationUnsupportedError,
-  DECRYPT_ACTION: () => import_sdk_core17.DECRYPT_ACTION,
-  DECRYPT_FACT_TYPE: () => import_sdk_core17.DECRYPT_FACT_TYPE,
-  DECRYPT_RESULT_TYPE: () => import_sdk_core17.DECRYPT_RESULT_TYPE,
-  DEFAULT_ENCRYPTION_ALG: () => import_sdk_core17.DEFAULT_ENCRYPTION_ALG,
-  DEFAULT_KEY_VERSION: () => import_sdk_core17.DEFAULT_KEY_VERSION,
-  DEFAULT_MANIFEST_SPACE: () => import_sdk_core12.DEFAULT_MANIFEST_SPACE,
-  DEFAULT_MANIFEST_VERSION: () => import_sdk_core12.DEFAULT_MANIFEST_VERSION,
-  DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => import_sdk_core13.DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
-  DataVaultService: () => import_sdk_core16.DataVaultService,
-  DatabaseHandle: () => import_sdk_core14.DatabaseHandle,
-  DecryptTransportResponseError: () => import_sdk_core17.DecryptTransportResponseError,
+  CapabilityKeyRegistry: () => import_sdk_core24.CapabilityKeyRegistry,
+  CapabilityKeyRegistryErrorCodes: () => import_sdk_core24.CapabilityKeyRegistryErrorCodes,
+  CaveatedDelegationUnsupportedError: () => import_sdk_core16.CaveatedDelegationUnsupportedError,
+  DECRYPT_ACTION: () => import_sdk_core21.DECRYPT_ACTION,
+  DECRYPT_FACT_TYPE: () => import_sdk_core21.DECRYPT_FACT_TYPE,
+  DECRYPT_RESULT_TYPE: () => import_sdk_core21.DECRYPT_RESULT_TYPE,
+  DEFAULT_ENCRYPTION_ALG: () => import_sdk_core21.DEFAULT_ENCRYPTION_ALG,
+  DEFAULT_KEY_VERSION: () => import_sdk_core21.DEFAULT_KEY_VERSION,
+  DEFAULT_MANIFEST_SPACE: () => import_sdk_core16.DEFAULT_MANIFEST_SPACE,
+  DEFAULT_MANIFEST_VERSION: () => import_sdk_core16.DEFAULT_MANIFEST_VERSION,
+  DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => import_sdk_core17.DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
+  DataVaultService: () => import_sdk_core20.DataVaultService,
+  DatabaseHandle: () => import_sdk_core18.DatabaseHandle,
+  DecryptTransportResponseError: () => import_sdk_core21.DecryptTransportResponseError,
   DelegatedAccess: () => DelegatedAccess,
-  DelegationErrorCodes: () => import_sdk_core19.DelegationErrorCodes,
-  DelegationManager: () => import_sdk_core19.DelegationManager,
-  DuckDbAction: () => import_sdk_core15.DuckDbAction,
-  DuckDbDatabaseHandle: () => import_sdk_core15.DuckDbDatabaseHandle,
-  DuckDbService: () => import_sdk_core15.DuckDbService,
-  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_core17.ENCRYPTION_NETWORK_URN_PREFIX,
-  ENCRYPTION_SERVICE: () => import_sdk_core17.ENCRYPTION_SERVICE,
-  ENCRYPTION_SERVICE_SHORT: () => import_sdk_core17.ENCRYPTION_SERVICE_SHORT,
-  ENVELOPE_VERSION: () => import_sdk_core17.ENVELOPE_VERSION,
-  EncryptionService: () => import_sdk_core17.EncryptionService,
+  DelegationErrorCodes: () => import_sdk_core23.DelegationErrorCodes,
+  DelegationManager: () => import_sdk_core23.DelegationManager,
+  DuckDbAction: () => import_sdk_core19.DuckDbAction,
+  DuckDbDatabaseHandle: () => import_sdk_core19.DuckDbDatabaseHandle,
+  DuckDbService: () => import_sdk_core19.DuckDbService,
+  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_core21.ENCRYPTION_NETWORK_URN_PREFIX,
+  ENCRYPTION_SERVICE: () => import_sdk_core21.ENCRYPTION_SERVICE,
+  ENCRYPTION_SERVICE_SHORT: () => import_sdk_core21.ENCRYPTION_SERVICE_SHORT,
+  ENVELOPE_VERSION: () => import_sdk_core21.ENVELOPE_VERSION,
+  EncryptionService: () => import_sdk_core21.EncryptionService,
   FileSessionStorage: () => FileSessionStorage,
-  HooksService: () => import_sdk_core18.HooksService,
-  IdentityParseError: () => import_sdk_core11.IdentityParseError,
+  HooksService: () => import_sdk_core22.HooksService,
+  IdentityParseError: () => import_sdk_core15.IdentityParseError,
   InvalidRestoredSessionError: () => InvalidRestoredSessionError,
-  KVService: () => import_sdk_core13.KVService,
-  ManifestValidationError: () => import_sdk_core12.ManifestValidationError,
+  KVService: () => import_sdk_core17.KVService,
+  MAX_SECRET_SCOPE_LENGTH: () => import_sdk_core20.MAX_SECRET_SCOPE_LENGTH,
+  ManifestValidationError: () => import_sdk_core16.ManifestValidationError,
   MemorySessionStorage: () => MemorySessionStorage,
-  NETWORK_NAME_PATTERN: () => import_sdk_core17.NETWORK_NAME_PATTERN,
-  NetworkIdError: () => import_sdk_core17.NetworkIdError,
+  NETWORK_NAME_PATTERN: () => import_sdk_core21.NETWORK_NAME_PATTERN,
+  NetworkIdError: () => import_sdk_core21.NetworkIdError,
   NodeUserAuthorization: () => NodeUserAuthorization,
   NodeWasmBindings: () => NodeWasmBindings,
-  PermissionNotInManifestError: () => import_sdk_core12.PermissionNotInManifestError,
-  PrefixedKVService: () => import_sdk_core13.PrefixedKVService,
+  PermissionNotInManifestError: () => import_sdk_core16.PermissionNotInManifestError,
+  PrefixedKVService: () => import_sdk_core17.PrefixedKVService,
   PrivateKeySigner: () => PrivateKeySigner,
-  ProtocolMismatchError: () => import_sdk_core22.ProtocolMismatchError,
+  ProtocolMismatchError: () => import_sdk_core26.ProtocolMismatchError,
   RUNTIME_DELEGATION_REJECTIONS: () => RUNTIME_DELEGATION_REJECTIONS,
   RuntimeDelegationRejectedError: () => RuntimeDelegationRejectedError,
-  SECRET_NAME_RE: () => import_sdk_core16.SECRET_NAME_RE,
-  SQLAction: () => import_sdk_core14.SQLAction,
-  SQLService: () => import_sdk_core14.SQLService,
-  STORAGE_FULL_MESSAGE: () => import_sdk_core11.STORAGE_FULL_MESSAGE,
-  STORAGE_WRITE_TOO_LARGE_MESSAGE: () => import_sdk_core11.STORAGE_WRITE_TOO_LARGE_MESSAGE,
-  SecretsService: () => import_sdk_core16.SecretsService,
-  ServiceContext: () => import_sdk_core23.ServiceContext,
-  SessionExpiredError: () => import_sdk_core12.SessionExpiredError,
-  SharingService: () => import_sdk_core19.SharingService,
-  SilentNotificationHandler: () => import_sdk_core11.SilentNotificationHandler,
-  Space: () => import_sdk_core21.Space,
-  SpaceErrorCodes: () => import_sdk_core21.SpaceErrorCodes,
-  SpaceService: () => import_sdk_core21.SpaceService,
-  TinyCloud: () => import_sdk_core10.TinyCloud,
-  TinyCloudDebugLogger: () => import_sdk_core11.TinyCloudDebugLogger,
+  SECRET_NAME_RE: () => import_sdk_core20.SECRET_NAME_RE,
+  SECRET_SCOPE_RE: () => import_sdk_core20.SECRET_SCOPE_RE,
+  SQLAction: () => import_sdk_core18.SQLAction,
+  SQLService: () => import_sdk_core18.SQLService,
+  STORAGE_FULL_MESSAGE: () => import_sdk_core15.STORAGE_FULL_MESSAGE,
+  STORAGE_WRITE_TOO_LARGE_MESSAGE: () => import_sdk_core15.STORAGE_WRITE_TOO_LARGE_MESSAGE,
+  SecretsService: () => import_sdk_core20.SecretsService,
+  ServiceContext: () => import_sdk_core27.ServiceContext,
+  SessionExpiredError: () => import_sdk_core16.SessionExpiredError,
+  SharingService: () => import_sdk_core23.SharingService,
+  SilentNotificationHandler: () => import_sdk_core15.SilentNotificationHandler,
+  Space: () => import_sdk_core25.Space,
+  SpaceErrorCodes: () => import_sdk_core25.SpaceErrorCodes,
+  SpaceService: () => import_sdk_core25.SpaceService,
+  TC832_RESERVED_SCOPES: () => import_sdk_core20.TC832_RESERVED_SCOPES,
+  TinyCloud: () => import_sdk_core14.TinyCloud,
+  TinyCloudDebugLogger: () => import_sdk_core15.TinyCloudDebugLogger,
   TinyCloudNode: () => TinyCloudNode,
-  UnsupportedFeatureError: () => import_sdk_core22.UnsupportedFeatureError,
+  UnsupportedFeatureError: () => import_sdk_core26.UnsupportedFeatureError,
   UnsupportedSessionRestoreError: () => UnsupportedSessionRestoreError,
-  VAULT_PERMISSION_SERVICE: () => import_sdk_core12.VAULT_PERMISSION_SERVICE,
-  VaultHeaders: () => import_sdk_core16.VaultHeaders,
-  VaultPublicSpaceKVActions: () => import_sdk_core16.VaultPublicSpaceKVActions,
-  VersionCheckError: () => import_sdk_core22.VersionCheckError,
+  VAULT_PERMISSION_SERVICE: () => import_sdk_core16.VAULT_PERMISSION_SERVICE,
+  VaultHeaders: () => import_sdk_core20.VaultHeaders,
+  VaultPublicSpaceKVActions: () => import_sdk_core20.VaultPublicSpaceKVActions,
+  VersionCheckError: () => import_sdk_core26.VersionCheckError,
   WasmKeyProvider: () => WasmKeyProvider,
   activateCompactRuntimeDelegation: () => activateCompactRuntimeDelegation,
   activateValidatedRuntimeDelegation: () => activateValidatedRuntimeDelegation,
-  addressStorageKey: () => import_sdk_core11.addressStorageKey,
-  buildCanonicalDecryptRequest: () => import_sdk_core17.buildCanonicalDecryptRequest,
-  buildDecryptAttenuation: () => import_sdk_core17.buildDecryptAttenuation,
-  buildDecryptFacts: () => import_sdk_core17.buildDecryptFacts,
-  buildDecryptInvocation: () => import_sdk_core17.buildDecryptInvocation,
-  buildNetworkId: () => import_sdk_core17.buildNetworkId,
-  buildSpaceUri: () => import_sdk_core21.buildSpaceUri,
-  canonicalHashHex: () => import_sdk_core17.canonicalHashHex,
-  canonicalSignedResponse: () => import_sdk_core17.canonicalSignedResponse,
-  canonicalizeAddress: () => import_sdk_core11.canonicalizeAddress,
-  canonicalizeDid: () => import_sdk_core11.canonicalizeDid,
-  canonicalizeDidUrl: () => import_sdk_core11.canonicalizeDidUrl,
-  canonicalizeEncryptionJson: () => import_sdk_core17.canonicalizeEncryptionJson,
-  canonicalizeNetworkId: () => import_sdk_core11.canonicalizeNetworkId,
-  canonicalizeSecretScope: () => import_sdk_core16.canonicalizeSecretScope,
-  checkDecryptInvocationInput: () => import_sdk_core17.checkDecryptInvocationInput,
-  checkNodeInfo: () => import_sdk_core22.checkNodeInfo,
-  clearTinyCloudDebugLogs: () => import_sdk_core11.clearTinyCloudDebugLogs,
-  composeManifestRequest: () => import_sdk_core12.composeManifestRequest,
-  createCapabilityKeyRegistry: () => import_sdk_core20.createCapabilityKeyRegistry,
-  createOpenKeyCallbackSigningStrategy: () => import_sdk_core2.createOpenKeyCallbackSigningStrategy,
-  createSharingService: () => import_sdk_core19.createSharingService,
-  createSpaceService: () => import_sdk_core21.createSpaceService,
-  createVaultCrypto: () => import_sdk_core16.createVaultCrypto,
+  addressStorageKey: () => import_sdk_core15.addressStorageKey,
+  appSecretScope: () => import_sdk_core20.appSecretScope,
+  buildCanonicalDecryptRequest: () => import_sdk_core21.buildCanonicalDecryptRequest,
+  buildDecryptAttenuation: () => import_sdk_core21.buildDecryptAttenuation,
+  buildDecryptFacts: () => import_sdk_core21.buildDecryptFacts,
+  buildDecryptInvocation: () => import_sdk_core21.buildDecryptInvocation,
+  buildNetworkId: () => import_sdk_core21.buildNetworkId,
+  buildSpaceUri: () => import_sdk_core25.buildSpaceUri,
+  canonicalHashHex: () => import_sdk_core21.canonicalHashHex,
+  canonicalSignedResponse: () => import_sdk_core21.canonicalSignedResponse,
+  canonicalizeAddress: () => import_sdk_core15.canonicalizeAddress,
+  canonicalizeDid: () => import_sdk_core15.canonicalizeDid,
+  canonicalizeDidUrl: () => import_sdk_core15.canonicalizeDidUrl,
+  canonicalizeEncryptionJson: () => import_sdk_core21.canonicalizeEncryptionJson,
+  canonicalizeNetworkId: () => import_sdk_core15.canonicalizeNetworkId,
+  canonicalizeSecretScope: () => import_sdk_core20.canonicalizeSecretScope,
+  checkDecryptInvocationInput: () => import_sdk_core21.checkDecryptInvocationInput,
+  checkNodeInfo: () => import_sdk_core26.checkNodeInfo,
+  clearTinyCloudDebugLogs: () => import_sdk_core15.clearTinyCloudDebugLogs,
+  composeManifestRequest: () => import_sdk_core16.composeManifestRequest,
+  createCapabilityKeyRegistry: () => import_sdk_core24.createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy: () => import_sdk_core3.createOpenKeyCallbackSigningStrategy,
+  createSharingService: () => import_sdk_core23.createSharingService,
+  createSpaceService: () => import_sdk_core25.createSpaceService,
+  createVaultCrypto: () => import_sdk_core20.createVaultCrypto,
   createWasmKeyProvider: () => createWasmKeyProvider,
-  decryptEnvelopeWithKey: () => import_sdk_core17.decryptEnvelopeWithKey,
+  decryptEnvelopeWithKey: () => import_sdk_core21.decryptEnvelopeWithKey,
   defaultSignStrategy: () => defaultSignStrategy,
-  defaultSpaceCreationHandler: () => import_sdk_core11.defaultSpaceCreationHandler,
-  deriveSignedReceiverKey: () => import_sdk_core17.deriveSignedReceiverKey,
+  defaultSpaceCreationHandler: () => import_sdk_core15.defaultSpaceCreationHandler,
+  deriveSignedReceiverKey: () => import_sdk_core21.deriveSignedReceiverKey,
   deserializeDelegation: () => deserializeDelegation,
-  didCacheKey: () => import_sdk_core11.didCacheKey,
-  didEquals: () => import_sdk_core11.didEquals,
-  disableTinyCloudDebug: () => import_sdk_core11.disableTinyCloudDebug,
-  discoverNetwork: () => import_sdk_core17.discoverNetwork,
-  enableTinyCloudDebug: () => import_sdk_core11.enableTinyCloudDebug,
-  encryptToNetwork: () => import_sdk_core17.encryptToNetwork,
-  encryptionBase64Decode: () => import_sdk_core17.encryptionBase64Decode,
-  encryptionBase64Encode: () => import_sdk_core17.encryptionBase64Encode,
-  encryptionError: () => import_sdk_core17.encryptionError,
-  encryptionUtf8Decode: () => import_sdk_core17.encryptionUtf8Decode,
-  encryptionUtf8Encode: () => import_sdk_core17.encryptionUtf8Encode,
-  ensureNetworkUsableForDecrypt: () => import_sdk_core17.ensureNetworkUsableForDecrypt,
-  expandActionShortNames: () => import_sdk_core12.expandActionShortNames,
-  expandPermissionEntries: () => import_sdk_core12.expandPermissionEntries,
-  expandPermissionEntry: () => import_sdk_core12.expandPermissionEntry,
+  didCacheKey: () => import_sdk_core15.didCacheKey,
+  didEquals: () => import_sdk_core15.didEquals,
+  disableTinyCloudDebug: () => import_sdk_core15.disableTinyCloudDebug,
+  discoverNetwork: () => import_sdk_core21.discoverNetwork,
+  enableTinyCloudDebug: () => import_sdk_core15.enableTinyCloudDebug,
+  encryptToNetwork: () => import_sdk_core21.encryptToNetwork,
+  encryptionBase64Decode: () => import_sdk_core21.encryptionBase64Decode,
+  encryptionBase64Encode: () => import_sdk_core21.encryptionBase64Encode,
+  encryptionError: () => import_sdk_core21.encryptionError,
+  encryptionUtf8Decode: () => import_sdk_core21.encryptionUtf8Decode,
+  encryptionUtf8Encode: () => import_sdk_core21.encryptionUtf8Encode,
+  ensureNetworkUsableForDecrypt: () => import_sdk_core21.ensureNetworkUsableForDecrypt,
+  expandActionShortNames: () => import_sdk_core16.expandActionShortNames,
+  expandPermissionEntries: () => import_sdk_core16.expandPermissionEntries,
+  expandPermissionEntry: () => import_sdk_core16.expandPermissionEntry,
   extractSiweExpiration: () => extractSiweExpiration,
-  generateRandomReceiverKey: () => import_sdk_core17.generateRandomReceiverKey,
-  getTinyCloudDebugLogs: () => import_sdk_core11.getTinyCloudDebugLogs,
+  generateRandomReceiverKey: () => import_sdk_core21.generateRandomReceiverKey,
+  getTinyCloudDebugLogs: () => import_sdk_core15.getTinyCloudDebugLogs,
   grantAuthRequest: () => grantAuthRequest,
-  hexDecode: () => import_sdk_core17.hexDecode,
-  hexEncode: () => import_sdk_core17.hexEncode,
-  installTinyCloudDebugGlobals: () => import_sdk_core11.installTinyCloudDebugGlobals,
-  isCapabilitySubset: () => import_sdk_core12.isCapabilitySubset,
-  isEvmAddress: () => import_sdk_core11.isEvmAddress,
-  isNetworkId: () => import_sdk_core17.isNetworkId,
-  isStorageFullError: () => import_sdk_core11.isStorageFullError,
-  loadManifest: () => import_sdk_core12.loadManifest,
-  makePkhSpaceId: () => import_sdk_core11.makePkhSpaceId,
-  makePublicSpaceId: () => import_sdk_core21.makePublicSpaceId,
-  networkDiscoveryKey: () => import_sdk_core17.networkDiscoveryKey,
-  openWrappedKey: () => import_sdk_core17.openWrappedKey,
-  parseCanonicalNetworkId: () => import_sdk_core11.parseCanonicalNetworkId,
-  parseExpiry: () => import_sdk_core12.parseExpiry,
-  parseNetworkId: () => import_sdk_core17.parseNetworkId,
-  parsePkhDid: () => import_sdk_core11.parsePkhDid,
-  parseSecretCatalogKey: () => import_sdk_core16.parseSecretCatalogKey,
-  parseSpaceUri: () => import_sdk_core21.parseSpaceUri,
-  pkhDid: () => import_sdk_core11.pkhDid,
-  principalDid: () => import_sdk_core11.principalDid,
-  principalDidEquals: () => import_sdk_core11.principalDidEquals,
-  resolveManifest: () => import_sdk_core12.resolveManifest,
-  resolveSecretListPrefix: () => import_sdk_core16.resolveSecretListPrefix,
-  resolveSecretPath: () => import_sdk_core16.resolveSecretPath,
-  resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core12.resourceCapabilitiesToSpaceAbilitiesMap,
+  hexDecode: () => import_sdk_core21.hexDecode,
+  hexEncode: () => import_sdk_core21.hexEncode,
+  installTinyCloudDebugGlobals: () => import_sdk_core15.installTinyCloudDebugGlobals,
+  isCapabilitySubset: () => import_sdk_core16.isCapabilitySubset,
+  isEvmAddress: () => import_sdk_core15.isEvmAddress,
+  isNetworkId: () => import_sdk_core21.isNetworkId,
+  isStorageFullError: () => import_sdk_core15.isStorageFullError,
+  loadManifest: () => import_sdk_core16.loadManifest,
+  makePkhSpaceId: () => import_sdk_core15.makePkhSpaceId,
+  makePublicSpaceId: () => import_sdk_core25.makePublicSpaceId,
+  networkDiscoveryKey: () => import_sdk_core21.networkDiscoveryKey,
+  openWrappedKey: () => import_sdk_core21.openWrappedKey,
+  parseCanonicalNetworkId: () => import_sdk_core15.parseCanonicalNetworkId,
+  parseExpiry: () => import_sdk_core16.parseExpiry,
+  parseNetworkId: () => import_sdk_core21.parseNetworkId,
+  parsePkhDid: () => import_sdk_core15.parsePkhDid,
+  parseSecretCatalogKey: () => import_sdk_core20.parseSecretCatalogKey,
+  parseSpaceUri: () => import_sdk_core25.parseSpaceUri,
+  pkhDid: () => import_sdk_core15.pkhDid,
+  principalDid: () => import_sdk_core15.principalDid,
+  principalDidEquals: () => import_sdk_core15.principalDidEquals,
+  resolveManifest: () => import_sdk_core16.resolveManifest,
+  resolveSecretListPrefix: () => import_sdk_core20.resolveSecretListPrefix,
+  resolveSecretPath: () => import_sdk_core20.resolveSecretPath,
+  resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core16.resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation: () => serializeDelegation,
   signedCompactUcanExpiry: () => signedCompactUcanExpiry,
-  tinyCloudDebugLogger: () => import_sdk_core11.tinyCloudDebugLogger,
-  validateEnvelope: () => import_sdk_core17.validateEnvelope,
-  validateManifest: () => import_sdk_core12.validateManifest,
-  verifyDecryptResponse: () => import_sdk_core17.verifyDecryptResponse,
+  sqliteReplicaStorage: () => sqliteReplicaStorage,
+  tinyCloudDebugLogger: () => import_sdk_core15.tinyCloudDebugLogger,
+  validateEnvelope: () => import_sdk_core21.validateEnvelope,
+  validateManifest: () => import_sdk_core16.validateManifest,
+  verifyDecryptResponse: () => import_sdk_core21.verifyDecryptResponse,
   wireOpenKeyAuthorize: () => wireOpenKeyAuthorize
 });
-module.exports = __toCommonJS(index_exports);
+module.exports = __toCommonJS(src_exports);
 
 // src/NodeWasmBindings.ts
 var import_node_sdk_wasm = require("@tinycloud/node-sdk-wasm");
@@ -17303,7 +17777,9 @@ var RUNTIME_DELEGATION_REJECTIONS = [
   "audience_mismatch",
   "resources_mismatch",
   "unsupported",
-  "activation_rejected"
+  "activation_rejected",
+  "activation_unavailable",
+  "activation_unauthenticated"
 ];
 var RuntimeDelegationRejectedError = class extends Error {
   constructor(reason, message) {
@@ -17312,6 +17788,18 @@ var RuntimeDelegationRejectedError = class extends Error {
     this.reason = reason;
   }
 };
+function activationRejectionReason(error) {
+  if (typeof error !== "object" || error === null) return "activation_rejected";
+  if ("code" in error && error.code === "ACTIVATION_TRANSPORT_FAILED") {
+    return "activation_unavailable";
+  }
+  const cause = "cause" in error ? error.cause : void 0;
+  const status = typeof cause === "object" && cause !== null && "status" in cause ? cause.status : void 0;
+  if (typeof status !== "number") return "activation_rejected";
+  if (status === 408 || status === 429 || status >= 500) return "activation_unavailable";
+  if (status === 401) return "activation_unauthenticated";
+  return "activation_rejected";
+}
 function reject(reason, message) {
   throw new RuntimeDelegationRejectedError(reason, message);
 }
@@ -17696,7 +18184,10 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
       await node.useRuntimeDelegation(installedCandidate);
     }
   } catch (error) {
-    reject("activation_rejected", error instanceof Error ? error.message : String(error));
+    reject(
+      activationRejectionReason(error),
+      error instanceof Error ? error.message : String(error)
+    );
   }
   const installed = node.getRuntimePermissionDelegations().find((candidate) => candidate.cid === cid);
   if (!installed) {
@@ -17796,16 +18287,32 @@ function deserializeDelegation(data) {
 }
 
 // src/TinyCloudNode.ts
-var import_sdk_core8 = require("@tinycloud/sdk-core");
-var import_sdk_services = require("@tinycloud/sdk-services");
+init_config();
+
+// src/replication/module-registry.ts
+var nodeLoaders;
+function registerReplicationLoaders(loaders) {
+  nodeLoaders = loaders;
+}
+function getNodeReplicationLoaders() {
+  if (nodeLoaders === void 0) {
+    throw new Error("Replication requires registering replication controller loaders.");
+  }
+  return nodeLoaders;
+}
+
+// src/TinyCloudNode.ts
+var import_sdk_core9 = require("@tinycloud/sdk-core");
+var import_sdk_services3 = require("@tinycloud/sdk-services");
 
 // src/authorization/NodeUserAuthorization.ts
 var import_node_crypto = require("crypto");
 var import_siwe = require("siwe");
-var import_sdk_core3 = require("@tinycloud/sdk-core");
+var import_sdk_core4 = require("@tinycloud/sdk-core");
+init_authority_sign_in();
 
 // src/authorization/strategies.ts
-var import_sdk_core2 = require("@tinycloud/sdk-core");
+var import_sdk_core3 = require("@tinycloud/sdk-core");
 var defaultSignStrategy = { type: "auto-sign" };
 
 // src/storage/MemorySessionStorage.ts
@@ -17880,8 +18387,8 @@ var MemorySessionStorage = class {
 };
 
 // src/authorization/NodeUserAuthorization.ts
-var DECRYPT_ACTION = import_sdk_core3.ENCRYPTION.DECRYPT;
-var NETWORK_CREATE_ACTION = import_sdk_core3.ENCRYPTION.NETWORK_CREATE;
+var DECRYPT_ACTION = import_sdk_core4.ENCRYPTION.DECRYPT;
+var NETWORK_CREATE_ACTION = import_sdk_core4.ENCRYPTION.NETWORK_CREATE;
 function describeHostFailure(result) {
   const text = result.error?.trim();
   return text ? `${result.status} - ${text}` : `${result.status}`;
@@ -17909,7 +18416,7 @@ function canonicalOpenKeyManifestSha256Hex(value) {
 }
 function didPrincipalMatches(actual, expected) {
   try {
-    return (0, import_sdk_core3.principalDidEquals)(actual, expected);
+    return (0, import_sdk_core4.principalDidEquals)(actual, expected);
   } catch {
     return actual === expected;
   }
@@ -17950,30 +18457,30 @@ var NodeUserAuthorization = class {
     this.spacePrefix = config.spacePrefix ?? "default";
     this.defaultActions = config.defaultActions ?? {
       kv: {
-        "": [import_sdk_core3.KV.PUT, import_sdk_core3.KV.GET, import_sdk_core3.KV.DEL, import_sdk_core3.KV.LIST, import_sdk_core3.KV.METADATA]
+        "": [import_sdk_core4.KV.PUT, import_sdk_core4.KV.GET, import_sdk_core4.KV.DEL, import_sdk_core4.KV.LIST, import_sdk_core4.KV.METADATA]
       },
       sql: {
-        "": [import_sdk_core3.SQL.READ, import_sdk_core3.SQL.WRITE, import_sdk_core3.SQL.SCHEMA, import_sdk_core3.SQL.ADMIN, import_sdk_core3.SQL.EXPORT]
+        "": [import_sdk_core4.SQL.READ, import_sdk_core4.SQL.WRITE, import_sdk_core4.SQL.SCHEMA, import_sdk_core4.SQL.ADMIN, import_sdk_core4.SQL.EXPORT]
       },
       duckdb: {
         "": [
-          import_sdk_core3.DUCKDB.READ,
-          import_sdk_core3.DUCKDB.WRITE,
-          import_sdk_core3.DUCKDB.ADMIN,
-          import_sdk_core3.DUCKDB.DESCRIBE,
-          import_sdk_core3.DUCKDB.EXPORT,
-          import_sdk_core3.DUCKDB.IMPORT,
-          import_sdk_core3.DUCKDB.EXECUTE
+          import_sdk_core4.DUCKDB.READ,
+          import_sdk_core4.DUCKDB.WRITE,
+          import_sdk_core4.DUCKDB.ADMIN,
+          import_sdk_core4.DUCKDB.DESCRIBE,
+          import_sdk_core4.DUCKDB.EXPORT,
+          import_sdk_core4.DUCKDB.IMPORT,
+          import_sdk_core4.DUCKDB.EXECUTE
         ]
       },
       capabilities: {
-        "": [import_sdk_core3.CAPABILITIES.READ]
+        "": [import_sdk_core4.CAPABILITIES.READ]
       },
       hooks: {
-        "": [import_sdk_core3.HOOKS.SUBSCRIBE, import_sdk_core3.HOOKS.REGISTER, import_sdk_core3.HOOKS.LIST, import_sdk_core3.HOOKS.UNREGISTER]
+        "": [import_sdk_core4.HOOKS.SUBSCRIBE, import_sdk_core4.HOOKS.REGISTER, import_sdk_core4.HOOKS.LIST, import_sdk_core4.HOOKS.UNREGISTER]
       }
     };
-    this.sessionExpirationMs = config.sessionExpirationMs ?? import_sdk_core3.EXPIRY.SESSION_MS;
+    this.sessionExpirationMs = config.sessionExpirationMs ?? import_sdk_core4.EXPIRY.SESSION_MS;
     this.autoCreateSpace = config.autoCreateSpace ?? false;
     this.spaceCreationHandler = config.spaceCreationHandler;
     this.tinycloudHosts = config.tinycloudHosts;
@@ -17988,6 +18495,7 @@ var NodeUserAuthorization = class {
     this.nonce = config.nonce;
     this.siweConfig = config.siweConfig;
     this.includeAccountRegistryPermissions = config.includeAccountRegistryPermissions ?? true;
+    this.replication = config.replication?.enabled === true ? config.replication : void 0;
     this._manifest = config.manifest;
     this._capabilityRequest = config.capabilityRequest;
     this.sessionManager = config.sessionManager ?? this.wasm.createSessionManager();
@@ -18052,7 +18560,7 @@ var NodeUserAuthorization = class {
    *   {@link ensureTinyCloudHosts}.
    */
   setRestoredTinyCloudSession(session, hosts) {
-    const address = (0, import_sdk_core3.canonicalizeAddress)(session.address);
+    const address = (0, import_sdk_core4.canonicalizeAddress)(session.address);
     this._tinyCloudSession = { ...session, address };
     this._address = address;
     this._chainId = session.chainId;
@@ -18113,8 +18621,8 @@ var NodeUserAuthorization = class {
     if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
       return;
     }
-    const subject = (0, import_sdk_core3.pkhDid)(address, chainId);
-    const resolved = await (0, import_sdk_core3.resolveTinyCloudHosts)(subject, {
+    const subject = (0, import_sdk_core4.pkhDid)(address, chainId);
+    const resolved = await (0, import_sdk_core4.resolveTinyCloudHosts)(subject, {
       registryUrl: this.tinycloudRegistryUrl,
       fallbackHosts: this.tinycloudFallbackHosts,
       autoDiscoverLocalNode: this.autoDiscoverLocalNode,
@@ -18182,7 +18690,7 @@ var NodeUserAuthorization = class {
     if (this._manifest === void 0) {
       return void 0;
     }
-    this._capabilityRequest = (0, import_sdk_core3.composeManifestRequest)(
+    this._capabilityRequest = (0, import_sdk_core4.composeManifestRequest)(
       Array.isArray(this._manifest) ? this._manifest : [this._manifest],
       {
         includeAccountRegistryPermissions: this.includeAccountRegistryPermissions
@@ -18194,50 +18702,173 @@ var NodeUserAuthorization = class {
     if (space.startsWith("tinycloud:")) {
       return space;
     }
-    return (0, import_sdk_core3.makePkhSpaceId)(address, chainId, space);
+    return (0, import_sdk_core4.makePkhSpaceId)(address, chainId, space);
+  }
+  /**
+   * The plain-session primary abilities: `defaultActions` (the shared table)
+   * unless the primary space IS the account space, where account-registry
+   * permissions merge into a private clone so the shared table is never
+   * mutated. Shared between `resolveSignInCapabilities` and
+   * `signInPermissionInputs` so sign-in and `replicationSignInEntries`
+   * can't disagree (§4.6).
+   */
+  primaryActionsForSignIn() {
+    const primaryActions = this.includeAccountRegistryPermissions && this.spacePrefix === import_sdk_core4.ACCOUNT_REGISTRY_SPACE ? cloneAbilitiesMap(this.defaultActions) : this.defaultActions;
+    if (this.includeAccountRegistryPermissions && this.spacePrefix === import_sdk_core4.ACCOUNT_REGISTRY_SPACE) {
+      const accountAbilities = (0, import_sdk_core4.resourceCapabilitiesToAbilitiesMap)(
+        import_sdk_core4.ACCOUNT_MANIFEST_PERMISSIONS
+      );
+      for (const [service, paths] of Object.entries(accountAbilities)) {
+        const existingPaths = primaryActions[service] ?? (primaryActions[service] = {});
+        for (const [path, actions] of Object.entries(paths)) {
+          const existingActions = existingPaths[path] ?? (existingPaths[path] = []);
+          for (const action of actions) {
+            if (!existingActions.includes(action)) existingActions.push(action);
+          }
+        }
+      }
+    }
+    return primaryActions;
+  }
+  /**
+   * The abilities a `spacePrefix: "secrets"` plain session actually requests
+   * for its primary space: the vault-secrets subtree only — the
+   * `defaultActions` root `get` is REPLACED, not merged (sign-in installs
+   * this map under the primary space id). Shared between
+   * `resolveSignInCapabilities` and `signInPermissionInputs` so the
+   * replication augmentation measures coverage against the effective
+   * pre-replication request, never the uninstalled `primaryActions` (§4.1).
+   */
+  secretsPrimaryAbilities() {
+    return {
+      kv: {
+        "vault/secrets/": [
+          import_sdk_core4.KV.GET,
+          import_sdk_core4.KV.PUT,
+          import_sdk_core4.KV.DEL,
+          import_sdk_core4.KV.LIST,
+          import_sdk_core4.KV.METADATA
+        ]
+      }
+    };
+  }
+  /**
+   * The effective sign-in request as `PermissionEntry`s plus the resolved
+   * primary space id — the inputs to the replication augmentation (§4.1).
+   * `resolveSignInCapabilities` merges the augmented entries into its
+   * abilities; `replicationSignInEntries()` returns them verbatim, so the
+   * entries the SIWE recap carries and the restore check sees are the same.
+   */
+  signInPermissionInputs(address, chainId) {
+    const request = this.getCapabilityRequest();
+    if (request === void 0) {
+      const primarySpaceId2 = (0, import_sdk_core4.makePkhSpaceId)(address, chainId, this.spacePrefix);
+      const effectivePrimary = this.spacePrefix === "secrets" ? this.secretsPrimaryAbilities() : this.primaryActionsForSignIn();
+      const kvPaths = effectivePrimary["kv"] ?? {};
+      return {
+        primarySpaceId: primarySpaceId2,
+        entries: Object.entries(kvPaths).map(([path, actions]) => ({
+          service: "tinycloud.kv",
+          space: primarySpaceId2,
+          path,
+          actions: [...actions]
+        }))
+      };
+    }
+    const spaceResources = request.resources.filter(
+      (entry) => entry.service !== import_sdk_core4.ENCRYPTION_PERMISSION_SERVICE
+    );
+    const primarySpaceName = spaceResources.find((entry) => entry.space !== "account")?.space ?? import_sdk_core4.DEFAULT_MANIFEST_SPACE;
+    const primarySpaceId = this.resolveSpaceName(
+      primarySpaceName,
+      address,
+      chainId
+    );
+    return {
+      primarySpaceId,
+      entries: spaceResources.map((entry) => ({
+        service: entry.service,
+        space: this.resolveSpaceName(entry.space, address, chainId),
+        path: entry.path,
+        actions: [...entry.actions]
+      }))
+    };
+  }
+  /**
+   * Merge replication augmentation entries into a space's abilities map
+   * without mutating shared tables (`defaultActions` may back the base map):
+   * the primary entry in `spaceAbilities` is replaced with a copy whose `kv`
+   * paths gain `get`/`sync`. Returns the merged map for `abilities`.
+   */
+  mergeReplicationEntries(spaceAbilities, primarySpaceId, abilities, entries) {
+    var _a;
+    if (entries.length === 0) {
+      return abilities;
+    }
+    const base2 = spaceAbilities[primarySpaceId] ?? abilities;
+    const kv = {};
+    for (const [path, actions] of Object.entries(base2["kv"] ?? {})) {
+      kv[path] = [...actions];
+    }
+    for (const entry of entries) {
+      const list = kv[_a = entry.path] ?? (kv[_a] = []);
+      for (const action of entry.actions) {
+        if (!list.includes(action)) list.push(action);
+      }
+    }
+    const merged = { ...base2, kv };
+    spaceAbilities[primarySpaceId] = merged;
+    return merged;
+  }
+  /**
+   * The replication entries this authorization's sign-in request carries
+   * for the signed-in or restored address (TC-858 §4.1/§4.6): the output of
+   * the same augmentation `resolveSignInCapabilities` runs — one
+   * `{tinycloud.kv, primarySpace, prefix, [get, sync]}` per configured
+   * prefix that already has an unrestricted covering `get` and passes the
+   * secrets opt-in gate. Empty when replication is off or no address is
+   * known. Pure.
+   */
+  replicationSignInEntries() {
+    if (this.replication === void 0) return [];
+    const address = this._address ?? this._tinyCloudSession?.address;
+    const chainId = this._chainId ?? this._tinyCloudSession?.chainId;
+    if (address === void 0 || chainId === void 0) return [];
+    const { entries, primarySpaceId } = this.signInPermissionInputs(address, chainId);
+    return augmentSignInEntriesWithReplication({
+      entries,
+      primarySpaceId,
+      replication: this.replication
+    });
   }
   defaultEncryptionNetworkId(address, chainId) {
-    return `urn:tinycloud:encryption:${(0, import_sdk_core3.pkhDid)(address, chainId)}:default`;
+    return `urn:tinycloud:encryption:${(0, import_sdk_core4.pkhDid)(address, chainId)}:default`;
   }
   resolveSignInCapabilities(address, chainId) {
     const request = this.getCapabilityRequest();
     if (request === void 0) {
       const defaultNetworkId = this.defaultEncryptionNetworkId(address, chainId);
-      const primarySpaceId2 = (0, import_sdk_core3.makePkhSpaceId)(address, chainId, this.spacePrefix);
-      const secretsSpaceId = (0, import_sdk_core3.makePkhSpaceId)(address, chainId, "secrets");
-      const primaryActions = this.includeAccountRegistryPermissions && this.spacePrefix === import_sdk_core3.ACCOUNT_REGISTRY_SPACE ? cloneAbilitiesMap(this.defaultActions) : this.defaultActions;
+      const primarySpaceId2 = (0, import_sdk_core4.makePkhSpaceId)(address, chainId, this.spacePrefix);
+      const secretsSpaceId = (0, import_sdk_core4.makePkhSpaceId)(address, chainId, "secrets");
+      const primaryActions = this.primaryActionsForSignIn();
       const spaceAbilities2 = {
         [primarySpaceId2]: primaryActions,
-        [secretsSpaceId]: {
-          kv: {
-            "vault/secrets/": [
-              import_sdk_core3.KV.GET,
-              import_sdk_core3.KV.PUT,
-              import_sdk_core3.KV.DEL,
-              import_sdk_core3.KV.LIST,
-              import_sdk_core3.KV.METADATA
-            ]
-          }
-        }
+        [secretsSpaceId]: this.secretsPrimaryAbilities()
       };
-      if (this.includeAccountRegistryPermissions && this.spacePrefix !== import_sdk_core3.ACCOUNT_REGISTRY_SPACE) {
-        spaceAbilities2[(0, import_sdk_core3.makePkhSpaceId)(address, chainId, import_sdk_core3.ACCOUNT_REGISTRY_SPACE)] = (0, import_sdk_core3.resourceCapabilitiesToAbilitiesMap)(import_sdk_core3.ACCOUNT_MANIFEST_PERMISSIONS);
-      } else if (this.includeAccountRegistryPermissions) {
-        const accountAbilities = (0, import_sdk_core3.resourceCapabilitiesToAbilitiesMap)(
-          import_sdk_core3.ACCOUNT_MANIFEST_PERMISSIONS
-        );
-        for (const [service, paths] of Object.entries(accountAbilities)) {
-          const existingPaths = primaryActions[service] ?? (primaryActions[service] = {});
-          for (const [path, actions] of Object.entries(paths)) {
-            const existingActions = existingPaths[path] ?? (existingPaths[path] = []);
-            for (const action of actions) {
-              if (!existingActions.includes(action)) existingActions.push(action);
-            }
-          }
-        }
-      }
+      if (this.includeAccountRegistryPermissions && this.spacePrefix !== import_sdk_core4.ACCOUNT_REGISTRY_SPACE) {
+        spaceAbilities2[(0, import_sdk_core4.makePkhSpaceId)(address, chainId, import_sdk_core4.ACCOUNT_REGISTRY_SPACE)] = (0, import_sdk_core4.resourceCapabilitiesToAbilitiesMap)(import_sdk_core4.ACCOUNT_MANIFEST_PERMISSIONS);
+      }
+      const mergedPrimary = this.mergeReplicationEntries(
+        spaceAbilities2,
+        primarySpaceId2,
+        primaryActions,
+        augmentSignInEntriesWithReplication({
+          ...this.signInPermissionInputs(address, chainId),
+          replication: this.replication
+        })
+      );
       return {
-        abilities: primaryActions,
+        abilities: mergedPrimary,
         spaceId: primarySpaceId2,
         spaceAbilities: spaceAbilities2,
         rawAbilities: {
@@ -18246,35 +18877,44 @@ var NodeUserAuthorization = class {
       };
     }
     const rawAbilities = {};
-    const currentDid = (0, import_sdk_core3.pkhDid)(address, chainId);
+    const currentDid = (0, import_sdk_core4.pkhDid)(address, chainId);
     const spaceResources = request.resources.filter((entry) => {
-      if (entry.service !== import_sdk_core3.ENCRYPTION_PERMISSION_SERVICE) {
+      if (entry.service !== import_sdk_core4.ENCRYPTION_PERMISSION_SERVICE) {
         return true;
       }
       for (const action of entry.actions) {
         addRawAbility(rawAbilities, entry.path, action);
       }
       if (entry.actions.includes(DECRYPT_ACTION)) {
-        const parsed = (0, import_sdk_core3.parseNetworkId)(entry.path);
+        const parsed = (0, import_sdk_core4.parseNetworkId)(entry.path);
         if (didPrincipalMatches(parsed.ownerDid, currentDid)) {
           addRawAbility(rawAbilities, entry.path, NETWORK_CREATE_ACTION);
         }
       }
       return false;
     });
-    const primarySpaceName = spaceResources.find((entry) => entry.space !== "account")?.space ?? import_sdk_core3.DEFAULT_MANIFEST_SPACE;
+    const primarySpaceName = spaceResources.find((entry) => entry.space !== "account")?.space ?? import_sdk_core4.DEFAULT_MANIFEST_SPACE;
     const primarySpaceId = this.resolveSpaceName(
       primarySpaceName,
       address,
       chainId
     );
-    const bySpace = (0, import_sdk_core3.resourceCapabilitiesToSpaceAbilitiesMap)(spaceResources);
+    const bySpace = (0, import_sdk_core4.resourceCapabilitiesToSpaceAbilitiesMap)(spaceResources);
     const spaceAbilities = {};
     for (const [space, abilities] of Object.entries(bySpace)) {
       spaceAbilities[this.resolveSpaceName(space, address, chainId)] = abilities;
     }
+    const mergedPrimaryAbilities = this.mergeReplicationEntries(
+      spaceAbilities,
+      primarySpaceId,
+      spaceAbilities[primarySpaceId] ?? (0, import_sdk_core4.resourceCapabilitiesToAbilitiesMap)([]),
+      augmentSignInEntriesWithReplication({
+        ...this.signInPermissionInputs(address, chainId),
+        replication: this.replication
+      })
+    );
     return {
-      abilities: spaceAbilities[primarySpaceId] ?? (0, import_sdk_core3.resourceCapabilitiesToAbilitiesMap)([]),
+      abilities: mergedPrimaryAbilities,
       spaceId: primarySpaceId,
       spaceAbilities,
       rawAbilities: Object.keys(rawAbilities).length > 0 ? rawAbilities : void 0
@@ -18332,14 +18972,14 @@ var NodeUserAuthorization = class {
    * Create the space on the TinyCloud server (host delegation).
    * This registers the user as the owner of the space.
    */
-  async hostSpace(targetSpaceId, purpose) {
+  async hostSpace(targetSpaceId, purpose, signal) {
     if (!this._tinyCloudSession || !this._address || !this._chainId) {
       throw new Error("Must be signed in to host space");
     }
     await this.ensureTinyCloudHosts();
     const host = this.primaryTinyCloudHost;
     const spaceId = targetSpaceId ?? this._tinyCloudSession.spaceId;
-    const peerId = await (0, import_sdk_core3.fetchPeerId)(host, spaceId);
+    const peerId = await (0, import_sdk_core4.fetchPeerId)(host, spaceId, signal);
     const siwe = this.wasm.generateHostSIWEMessage({
       address: this._address,
       chainId: this._chainId,
@@ -18348,9 +18988,28 @@ var NodeUserAuthorization = class {
       spaceId,
       peerId
     });
-    const signature2 = await this.signMessage(siwe, purpose);
+    if (signal?.aborted) throw signal.reason;
+    const signing = this.signMessage(siwe, purpose);
+    let signature2;
+    if (!signal) {
+      signature2 = await signing;
+    } else {
+      let rejectOnAbort;
+      const aborted = new Promise((_resolve, reject2) => {
+        rejectOnAbort = reject2;
+      });
+      const onAbort = () => rejectOnAbort(signal.reason);
+      signal.addEventListener("abort", onAbort, { once: true });
+      if (signal.aborted) onAbort();
+      try {
+        signature2 = await Promise.race([signing, aborted]);
+      } finally {
+        signal.removeEventListener("abort", onAbort);
+      }
+    }
+    if (signal?.aborted) throw signal.reason;
     const headers = this.wasm.siweToDelegationHeaders({ siwe, signature: signature2 });
-    return (0, import_sdk_core3.submitHostDelegation)(host, headers);
+    return (0, import_sdk_core4.submitHostDelegation)(host, headers, signal);
   }
   /**
    * Create a specific space on the server via host delegation.
@@ -18371,8 +19030,8 @@ var NodeUserAuthorization = class {
    * keeps its HTTP status (e.g. a typed 401/403) instead of collapsing to
    * `false`.
    */
-  async hostOwnedSpaceResult(spaceId, purpose) {
-    return this.hostSpace(spaceId, purpose);
+  async hostOwnedSpaceResult(spaceId, purpose, signal) {
+    return this.hostSpace(spaceId, purpose, signal);
   }
   /**
    * Ensure the user's space exists on the TinyCloud server.
@@ -18389,12 +19048,12 @@ var NodeUserAuthorization = class {
     await this.ensureTinyCloudHosts();
     const host = this.primaryTinyCloudHost;
     const primarySpaceId = this._tinyCloudSession.spaceId;
-    const result = await (0, import_sdk_core3.activateSessionWithHost)(
+    const result = await (0, import_sdk_core4.activateSessionWithHost)(
       host,
       this._tinyCloudSession.delegationHeader
     );
     this.recordActivationSkippedSpaces(result, primarySpaceId);
-    const handler = this.spaceCreationHandler ?? (this.autoCreateSpace ? new import_sdk_core3.AutoApproveSpaceCreationHandler() : void 0);
+    const handler = this.spaceCreationHandler ?? (this.autoCreateSpace ? new import_sdk_core4.AutoApproveSpaceCreationHandler() : void 0);
     const creationContext = {
       spaceId: primarySpaceId,
       address: this._address,
@@ -18430,7 +19089,7 @@ var NodeUserAuthorization = class {
         throw error;
       }
       await new Promise((resolve) => setTimeout(resolve, 100));
-      const retryResult = await (0, import_sdk_core3.activateSessionWithHost)(
+      const retryResult = await (0, import_sdk_core4.activateSessionWithHost)(
         host,
         this._tinyCloudSession.delegationHeader
       );
@@ -18470,7 +19129,7 @@ var NodeUserAuthorization = class {
         throw error;
       }
       await new Promise((resolve) => setTimeout(resolve, 100));
-      const retryResult = await (0, import_sdk_core3.activateSessionWithHost)(
+      const retryResult = await (0, import_sdk_core4.activateSessionWithHost)(
         host,
         this._tinyCloudSession.delegationHeader
       );
@@ -18512,7 +19171,7 @@ var NodeUserAuthorization = class {
     const jwk = JSON.parse(jwkString);
     const now = /* @__PURE__ */ new Date();
     const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
-    const abilities = (0, import_sdk_core3.resourceCapabilitiesToAbilitiesMap)(
+    const abilities = (0, import_sdk_core4.resourceCapabilitiesToAbilitiesMap)(
       options.capabilityRequest.resources
     );
     const prepared = this.wasm.prepareSession({
@@ -18563,7 +19222,7 @@ var NodeUserAuthorization = class {
    * @param options - Optional per-call SIWE overrides for this sign-in only
    */
   async signIn(options) {
-    this._address = (0, import_sdk_core3.canonicalizeAddress)(await this.signer.getAddress());
+    this._address = (0, import_sdk_core4.canonicalizeAddress)(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
     const address = this._address;
     const chainId = this._chainId;
@@ -18612,7 +19271,7 @@ var NodeUserAuthorization = class {
       siwe: prepared.siwe,
       signature: signature2
     };
-    const spacesMetadata = this.enablePublicSpace ? { public: (0, import_sdk_core3.makePkhSpaceId)(address, chainId, "public") } : void 0;
+    const spacesMetadata = this.enablePublicSpace ? { public: (0, import_sdk_core4.makePkhSpaceId)(address, chainId, "public") } : void 0;
     const tinyCloudSession = {
       address,
       chainId,
@@ -18650,7 +19309,7 @@ var NodeUserAuthorization = class {
     this._address = address;
     this._chainId = chainId;
     const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await (0, import_sdk_core3.checkNodeInfo)(
+    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(
       infoHost,
       this.wasm.protocolVersion()
     );
@@ -18690,7 +19349,7 @@ var NodeUserAuthorization = class {
    */
   async signMessage(message, purpose) {
     if (!this._address) {
-      this._address = (0, import_sdk_core3.canonicalizeAddress)(await this.signer.getAddress());
+      this._address = (0, import_sdk_core4.canonicalizeAddress)(await this.signer.getAddress());
     }
     if (!this._chainId) {
       this._chainId = await this.signer.getChainId();
@@ -18718,7 +19377,7 @@ var NodeUserAuthorization = class {
    * ```
    */
   async prepareSessionForSigning() {
-    const address = (0, import_sdk_core3.canonicalizeAddress)(await this.signer.getAddress());
+    const address = (0, import_sdk_core4.canonicalizeAddress)(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     const keyId = `session-${Date.now()}`;
     this.sessionManager.renameSessionKeyId(this.activeSessionKeyId, keyId);
@@ -18769,7 +19428,7 @@ var NodeUserAuthorization = class {
       ...prepared,
       signature: signature2
     });
-    const address = (0, import_sdk_core3.canonicalizeAddress)(await this.signer.getAddress());
+    const address = (0, import_sdk_core4.canonicalizeAddress)(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     await this.resolveTinyCloudHostsForSignIn(address, chainId);
     const clientSession = {
@@ -18780,7 +19439,7 @@ var NodeUserAuthorization = class {
       siwe: prepared.siwe,
       signature: signature2
     };
-    const spacesMetadata = this.enablePublicSpace ? { public: (0, import_sdk_core3.makePkhSpaceId)(address, chainId, "public") } : void 0;
+    const spacesMetadata = this.enablePublicSpace ? { public: (0, import_sdk_core4.makePkhSpaceId)(address, chainId, "public") } : void 0;
     const tinyCloudSession = {
       address,
       chainId,
@@ -18822,7 +19481,7 @@ var NodeUserAuthorization = class {
     this._address = address;
     this._chainId = chainId;
     const infoHost = this.primaryTinyCloudHost;
-    const nodeInfo = await (0, import_sdk_core3.checkNodeInfo)(
+    const nodeInfo = await (0, import_sdk_core4.checkNodeInfo)(
       infoHost,
       this.wasm.protocolVersion()
     );
@@ -18878,7 +19537,7 @@ var NodeUserAuthorization = class {
       }
       this.tinycloudHosts = [overrideHost];
     }
-    const signingAddress = (0, import_sdk_core3.canonicalizeAddress)(await this.signer.getAddress());
+    const signingAddress = (0, import_sdk_core4.canonicalizeAddress)(await this.signer.getAddress());
     const signingChainId = await this.signer.getChainId();
     await this.resolveTinyCloudHostsForSignIn(signingAddress, signingChainId);
     const { prepared, keyId, jwk } = await this.prepareSessionForSigning();
@@ -18983,8 +19642,8 @@ var NodeUserAuthorization = class {
         "signInWithOpenKeyResult requires prepared.siwe (the SDK-generated SIWE the sign-in was proposed with)"
       );
     }
-    const expectedAddress = (0, import_sdk_core3.canonicalizeAddress)(await this.signer.getAddress());
-    if ((0, import_sdk_core3.canonicalizeAddress)(result.address) !== expectedAddress) {
+    const expectedAddress = (0, import_sdk_core4.canonicalizeAddress)(await this.signer.getAddress());
+    if ((0, import_sdk_core4.canonicalizeAddress)(result.address) !== expectedAddress) {
       throw new Error(
         `OpenKey returned signature from ${result.address} but expected ${expectedAddress}`
       );
@@ -19009,15 +19668,15 @@ var NodeUserAuthorization = class {
         `OpenKey signature verification failed${type ? `: ${type}` : ""}${details}`
       );
     }
-    if ((0, import_sdk_core3.canonicalizeAddress)(parsedSignedSiwe.address) !== expectedAddress) {
+    if ((0, import_sdk_core4.canonicalizeAddress)(parsedSignedSiwe.address) !== expectedAddress) {
       throw new Error(
         `OpenKey signedMessage.address (${parsedSignedSiwe.address}) does not match local signer address (${expectedAddress})`
       );
     }
     const originalHasRecap = /(?:^|\n)-\s+urn:recap:/i.test(prepared.siwe);
-    const originalFields = (0, import_sdk_core3.extractImmutableSiweFields)(prepared.siwe);
-    const signedFields = (0, import_sdk_core3.extractImmutableSiweFields)(result.signedMessage);
-    const changedFields = (0, import_sdk_core3.diffImmutableSiweFields)(originalFields, signedFields, {
+    const originalFields = (0, import_sdk_core4.extractImmutableSiweFields)(prepared.siwe);
+    const signedFields = (0, import_sdk_core4.extractImmutableSiweFields)(result.signedMessage);
+    const changedFields = (0, import_sdk_core4.diffImmutableSiweFields)(originalFields, signedFields, {
       originalHasRecap
     });
     if (changedFields.length > 0) {
@@ -19028,20 +19687,20 @@ var NodeUserAuthorization = class {
     let originalCaps;
     let signedCaps;
     try {
-      originalCaps = (0, import_sdk_core3.extractRecapAttenuations)(prepared.siwe);
+      originalCaps = (0, import_sdk_core4.extractRecapAttenuations)(prepared.siwe);
     } catch (err) {
       throw new Error(
         `Failed to decode prepared SIWE recap: ${err.message}`
       );
     }
     try {
-      signedCaps = (0, import_sdk_core3.extractRecapAttenuations)(result.signedMessage);
+      signedCaps = (0, import_sdk_core4.extractRecapAttenuations)(result.signedMessage);
     } catch (err) {
       throw new Error(
         `Failed to decode OpenKey signedMessage recap: ${err.message}`
       );
     }
-    const unauthorized = (0, import_sdk_core3.unauthorizedRecapCapabilities)(signedCaps, originalCaps);
+    const unauthorized = (0, import_sdk_core4.unauthorizedRecapCapabilities)(signedCaps, originalCaps);
     if (unauthorized.length > 0) {
       const previewLimit = 5;
       const preview = unauthorized.slice(0, previewLimit).map((u) => `${u.resource}::${u.action}`).join(", ");
@@ -19058,7 +19717,7 @@ var NodeUserAuthorization = class {
     const grantedPairs = /* @__PURE__ */ new Set();
     const grantedFourPartIndex = /* @__PURE__ */ new Map();
     for (const [resource, actions] of Object.entries(signedCaps)) {
-      const { space, path } = (0, import_sdk_core3.parseCanonicalRecapResource)(resource);
+      const { space, path } = (0, import_sdk_core4.parseCanonicalRecapResource)(resource);
       for (const action of Object.keys(actions)) {
         grantedPairs.add(`${resource}\0${action}`);
         const slashIdx = action.indexOf("/");
@@ -19299,16 +19958,16 @@ var NodeUserAuthorization = class {
 };
 
 // src/account/AccountService.ts
-var import_sdk_core4 = require("@tinycloud/sdk-core");
+var import_sdk_core5 = require("@tinycloud/sdk-core");
 
 // src/DelegatedAccess.ts
-var import_sdk_core5 = require("@tinycloud/sdk-core");
+var import_sdk_core6 = require("@tinycloud/sdk-core");
 var DelegatedAccess = class {
   constructor(session, delegation, host, invoke2, invokeAny2, telemetry) {
     this.session = session;
     this._delegation = delegation;
     this.host = host;
-    this._serviceContext = new import_sdk_core5.ServiceContext({
+    this._serviceContext = new import_sdk_core6.ServiceContext({
       invoke: invoke2,
       invokeAny: invokeAny2,
       fetch: globalThis.fetch.bind(globalThis),
@@ -19316,16 +19975,16 @@ var DelegatedAccess = class {
       telemetry
     });
     const prefix = this._delegation.path.replace(/\/$/, "");
-    this._kv = new import_sdk_core5.KVService({ prefix });
+    this._kv = new import_sdk_core6.KVService({ prefix });
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
-    this._sql = new import_sdk_core5.SQLService({});
+    this._sql = new import_sdk_core6.SQLService({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
-    this._duckdb = new import_sdk_core5.DuckDbService({});
+    this._duckdb = new import_sdk_core6.DuckDbService({});
     this._duckdb.initialize(this._serviceContext);
     this._serviceContext.registerService("duckdb", this._duckdb);
-    this._hooks = new import_sdk_core5.HooksService({});
+    this._hooks = new import_sdk_core6.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -19475,7 +20134,7 @@ function createWasmKeyProvider(sessionManager) {
 }
 
 // src/delegateToHelpers.ts
-var import_sdk_core6 = require("@tinycloud/sdk-core");
+var import_sdk_core7 = require("@tinycloud/sdk-core");
 function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   const byService = /* @__PURE__ */ new Map();
   for (const a of actions) {
@@ -19506,7 +20165,7 @@ function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   }
   return entries;
 }
-var DEFAULT_DELEGATION_EXPIRY_MS = import_sdk_core6.EXPIRY.SESSION_MS;
+var DEFAULT_DELEGATION_EXPIRY_MS = import_sdk_core7.EXPIRY.SESSION_MS;
 function resolveExpiryMs(expiry) {
   if (expiry === void 0) {
     return DEFAULT_DELEGATION_EXPIRY_MS;
@@ -19519,10 +20178,10 @@ function resolveExpiryMs(expiry) {
     }
     return expiry;
   }
-  return (0, import_sdk_core6.parseExpiry)(expiry);
+  return (0, import_sdk_core7.parseExpiry)(expiry);
 }
 function extractSiweExpiration(siwe) {
-  const parsed = new import_sdk_core6.SiweMessage(siwe);
+  const parsed = new import_sdk_core7.SiweMessage(siwe);
   if (parsed.expirationTime === void 0 || parsed.expirationTime === null) {
     return void 0;
   }
@@ -19536,7 +20195,7 @@ function extractSiweExpiration(siwe) {
 }
 
 // src/NodeSecretsService.ts
-var import_sdk_core7 = require("@tinycloud/sdk-core");
+var import_sdk_core8 = require("@tinycloud/sdk-core");
 var SECRETS_SPACE = "secrets";
 function ok() {
   return { ok: true, data: void 0 };
@@ -19569,7 +20228,7 @@ function secretActionName(action) {
 }
 function secretPermissionEntries(name, options, action, space, encryptionNetworkId) {
   const entries = [];
-  const path = action === "list" ? (0, import_sdk_core7.resolveSecretListPrefix)(options) : (0, import_sdk_core7.resolveSecretPath)(name, options).permissionPaths.vault;
+  const path = action === "list" ? (0, import_sdk_core8.resolveSecretListPrefix)(options) : (0, import_sdk_core8.resolveSecretPath)(name, options).permissionPaths.vault;
   entries.push({
     service: "tinycloud.kv",
     space,
@@ -19666,7 +20325,7 @@ var NodeSecretsService = class {
       );
     } catch (error) {
       return secretsError(
-        import_sdk_core7.ErrorCodes.INVALID_INPUT,
+        import_sdk_core8.ErrorCodes.INVALID_INPUT,
         error instanceof Error ? error.message : String(error),
         error instanceof Error ? error : void 0
       );
@@ -19676,7 +20335,7 @@ var NodeSecretsService = class {
     }
     if (!this.config.canEscalate()) {
       return secretsError(
-        import_sdk_core7.ErrorCodes.PERMISSION_DENIED,
+        import_sdk_core8.ErrorCodes.PERMISSION_DENIED,
         `Cannot autosign ${displayActionUrn(action)} for ${target}; TinyCloudNode needs wallet mode with a signer or privateKey.`
       );
     }
@@ -19685,7 +20344,7 @@ var NodeSecretsService = class {
       return this.restoreUnlockAfterEscalation();
     } catch (error) {
       return secretsError(
-        import_sdk_core7.ErrorCodes.PERMISSION_DENIED,
+        import_sdk_core8.ErrorCodes.PERMISSION_DENIED,
         error instanceof Error ? error.message : `Autosign escalation for ${displayActionUrn(action)} on ${target} failed.`,
         error instanceof Error ? error : void 0
       );
@@ -19706,10 +20365,10 @@ var NodeSecretsService = class {
       return false;
     }
     const manifests = Array.isArray(manifest) ? manifest : [manifest];
-    const requestedEntries = (0, import_sdk_core7.expandPermissionEntries)(permissionEntries);
+    const requestedEntries = (0, import_sdk_core8.expandPermissionEntries)(permissionEntries);
     return requestedEntries.every(
       (entry) => manifests.some((candidate) => {
-        const resolved = (0, import_sdk_core7.resolveManifest)(candidate);
+        const resolved = (0, import_sdk_core8.resolveManifest)(candidate);
         return resolved.resources.some(
           (resource) => resource.service === entry.service && spaceMatches(
             resource.space,
@@ -19725,8 +20384,8 @@ var NodeSecretsService = class {
 // src/TinyCloudNode.ts
 var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
-var NETWORK_CREATE_ACTION2 = import_sdk_core8.ENCRYPTION.NETWORK_CREATE;
-var DECRYPT_ACTION2 = import_sdk_core8.ENCRYPTION.DECRYPT;
+var NETWORK_CREATE_ACTION2 = import_sdk_core9.ENCRYPTION.NETWORK_CREATE;
+var DECRYPT_ACTION2 = import_sdk_core9.ENCRYPTION.DECRYPT;
 var BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
 var BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
 var ACCEPTED_MARKER_VERSIONS = [BOOTSTRAP_COMPLETION_MARKER_VERSION];
@@ -19735,24 +20394,24 @@ function isSecretPayload(value) {
   return typeof value === "object" && value !== null && "value" in value && typeof value.value === "string" && "createdAt" in value && typeof value.createdAt === "string" && "updatedAt" in value && typeof value.updatedAt === "string";
 }
 var ROOT_DELEGATION_ACTIONS = [
-  import_sdk_core8.KV.PUT,
-  import_sdk_core8.KV.GET,
-  import_sdk_core8.KV.DEL,
-  import_sdk_core8.KV.LIST,
-  import_sdk_core8.KV.METADATA,
-  import_sdk_core8.SQL.READ,
-  import_sdk_core8.SQL.WRITE,
-  import_sdk_core8.SQL.ADMIN,
-  import_sdk_core8.SQL.ALL,
-  import_sdk_core8.DUCKDB.READ,
-  import_sdk_core8.DUCKDB.WRITE,
-  import_sdk_core8.DUCKDB.ADMIN,
-  import_sdk_core8.DUCKDB.DESCRIBE,
-  import_sdk_core8.DUCKDB.EXPORT,
-  import_sdk_core8.DUCKDB.IMPORT,
-  import_sdk_core8.DUCKDB.ALL
+  import_sdk_core9.KV.PUT,
+  import_sdk_core9.KV.GET,
+  import_sdk_core9.KV.DEL,
+  import_sdk_core9.KV.LIST,
+  import_sdk_core9.KV.METADATA,
+  import_sdk_core9.SQL.READ,
+  import_sdk_core9.SQL.WRITE,
+  import_sdk_core9.SQL.ADMIN,
+  import_sdk_core9.SQL.ALL,
+  import_sdk_core9.DUCKDB.READ,
+  import_sdk_core9.DUCKDB.WRITE,
+  import_sdk_core9.DUCKDB.ADMIN,
+  import_sdk_core9.DUCKDB.DESCRIBE,
+  import_sdk_core9.DUCKDB.EXPORT,
+  import_sdk_core9.DUCKDB.IMPORT,
+  import_sdk_core9.DUCKDB.ALL
 ];
-var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core8.EXPIRY.SESSION_MS;
+var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core9.EXPIRY.SESSION_MS;
 function unifiedRootAttenuation(capabilities) {
   const attenuation = {};
   for (const capability of capabilities) {
@@ -19798,7 +20457,7 @@ function isInteractiveSigner(config) {
 }
 function didPrincipalMatches2(actual, expected) {
   try {
-    return (0, import_sdk_core8.principalDidEquals)(actual, expected);
+    return (0, import_sdk_core9.principalDidEquals)(actual, expected);
   } catch {
     return actual === expected;
   }
@@ -20009,7 +20668,7 @@ function ownerDelegationPermissions(params) {
       }
       const slash = action.indexOf("/");
       const service = slash === -1 ? "" : action.slice(0, slash);
-      if (import_sdk_core8.SERVICE_LONG_TO_SHORT[service] === void 0) {
+      if (import_sdk_core9.SERVICE_LONG_TO_SHORT[service] === void 0) {
         throw new Error("Owner delegation capabilities are unsupported");
       }
       const actions = byService.get(service) ?? [];
@@ -20025,7 +20684,7 @@ function ownerDelegationPermissions(params) {
   }
   const resources = /* @__PURE__ */ new Set();
   for (const permission of permissions) {
-    if (typeof permission.service !== "string" || import_sdk_core8.SERVICE_LONG_TO_SHORT[permission.service] === void 0 || typeof permission.path !== "string" || permission.path.length === 0 || permission.path.trim() !== permission.path || /[\u0000-\u001f\u007f\\*]/.test(permission.path) || !Array.isArray(permission.actions) || permission.actions.length === 0 || permission.actions.length > 32) {
+    if (typeof permission.service !== "string" || import_sdk_core9.SERVICE_LONG_TO_SHORT[permission.service] === void 0 || typeof permission.path !== "string" || permission.path.length === 0 || permission.path.trim() !== permission.path || /[\u0000-\u001f\u007f\\*]/.test(permission.path) || !Array.isArray(permission.actions) || permission.actions.length === 0 || permission.actions.length > 32) {
       throw new Error("Owner delegation requires bounded capabilities");
     }
     const resourceKey = `${permission.service}\0${permission.path}`;
@@ -20040,9 +20699,9 @@ function ownerDelegationPermissions(params) {
       }
       actions.add(action);
     }
-    if (permission.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE) {
+    if (permission.service === import_sdk_core9.ENCRYPTION_PERMISSION_SERVICE) {
       try {
-        (0, import_sdk_core8.parseNetworkId)(permission.path);
+        (0, import_sdk_core9.parseNetworkId)(permission.path);
       } catch {
         throw new Error("Owner delegation encryption permission requires a canonical network URN");
       }
@@ -20054,11 +20713,11 @@ function ownerPermissionsToAbilities(permissions) {
   const abilities = {};
   const rawAbilities = {};
   for (const permission of permissions) {
-    if (permission.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE) {
+    if (permission.service === import_sdk_core9.ENCRYPTION_PERMISSION_SERVICE) {
       rawAbilities[permission.path] = [...permission.actions];
       continue;
     }
-    const shortService = import_sdk_core8.SERVICE_LONG_TO_SHORT[permission.service];
+    const shortService = import_sdk_core9.SERVICE_LONG_TO_SHORT[permission.service];
     abilities[shortService] ?? (abilities[shortService] = {});
     abilities[shortService][permission.path] = [...permission.actions];
   }
@@ -20190,6 +20849,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
     /** Serializes account-registry writes for the active node instance. */
     this.accountRegistryTail = Promise.resolve();
+    /** Bounds best-effort registry work on the sign-in critical path. */
+    this.accountRegistryDeadlineMs = 4e3;
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -20261,18 +20922,53 @@ var _TinyCloudNode = class _TinyCloudNode {
         if (!granted?.caveats?.length) {
           return entry;
         }
-        if (entry.caveats !== void 0 && !(0, import_sdk_core8.recapCaveatsEqual)(entry.caveats, granted.caveats)) {
+        if (entry.caveats !== void 0 && !(0, import_sdk_core9.recapCaveatsEqual)(entry.caveats, granted.caveats)) {
           throw new Error("Invocation caveats do not match signed ReCap authority.");
         }
         return { ...entry, caveats: cloneRecapCaveats(granted.caveats) };
       });
       return this.wasmBindings.invokeAny(invocationSession, caveatPreservingEntries, facts);
     };
+    assertValidReplicationConfig(config.replication);
     this.explicitHost = config.host;
     this.config = {
       ...config,
       host: config.host ?? DEFAULT_HOST
     };
+    if (this.config.replication?.enabled) {
+      const runtime = getNodeReplicationLoaders().runtime().then(({ ReplicationRuntime: ReplicationRuntime2 }) => {
+        const instance = new ReplicationRuntime2(this.config.replication);
+        this.replicationRuntimeInstance = instance;
+        return instance;
+      });
+      this.replicationRuntime = runtime;
+      this.replicationControl = {
+        status: async () => {
+          const status = await runtime.then((ready) => ready.control.status());
+          const scopeError = this.replicationScopeError;
+          if (!scopeError) return status;
+          return this.config.replication.prefixes.map((prefix) => ({
+            prefix,
+            state: "unavailable",
+            lastError: {
+              at: (/* @__PURE__ */ new Date()).toISOString(),
+              code: "SESSION_SCOPE_MISMATCH",
+              message: scopeError
+            },
+            pending: { inFlight: 0, committed: 0, ambiguous: 0 },
+            pinned: [],
+            lagMs: null
+          }));
+        },
+        sync: async (input) => (await runtime).control.sync(input),
+        purge: (input) => {
+          const instance = this.replicationRuntimeInstance;
+          return instance ? instance.control.purge(input) : runtime.then((ready) => ready.control.purge(input));
+        },
+        clearPending: async () => (await runtime).control.clearPending(),
+        close: async () => (await runtime).control.close()
+      };
+    }
     if (config.wasmBindings) {
       this.wasmBindings = config.wasmBindings;
     } else if (_TinyCloudNode.nodeDefaults) {
@@ -20296,13 +20992,13 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     this.sessionKeyJwk = JSON.parse(jwkStr);
     this._serviceGraph = this.createServiceGraphLifetime();
-    this._capabilityRegistry = new import_sdk_core8.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core9.CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({
       sessionManager: this.sessionManager
     });
-    this.notificationHandler = config.notificationHandler ?? new import_sdk_core8.SilentNotificationHandler();
+    this.notificationHandler = config.notificationHandler ?? new import_sdk_core9.SilentNotificationHandler();
     const receiveOnlyGraph = this._serviceGraph;
-    this._sharingService = new import_sdk_core8.SharingService({
+    this._sharingService = new import_sdk_core9.SharingService({
       hosts: [this.config.host],
       // session: undefined - not needed for receive()
       invoke: receiveOnlyGraph.invoke,
@@ -20318,8 +21014,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       // delegationManager: undefined - not needed for receive()
       createKVService: (config2) => {
         const prefix = config2.pathPrefix?.replace(/\/$/, "");
-        const kvService = new import_sdk_core8.KVService({ prefix });
-        const kvContext = receiveOnlyGraph.track(new import_sdk_core8.ServiceContext({
+        const kvService = new import_sdk_core9.KVService({ prefix });
+        const kvContext = receiveOnlyGraph.track(new import_sdk_core9.ServiceContext({
           invoke: config2.invoke,
           fetch: config2.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config2.hosts,
@@ -20392,10 +21088,17 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: config.nonce,
       siweConfig: config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? config.includeAccountRegistryPermissions === false ? import_sdk_core8.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
-      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : config.includeAccountRegistryPermissions
+      capabilityRequest: useBootstrapSignInRequest ? config.includeAccountRegistryPermissions === false ? import_sdk_core9.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core9.BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
+      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : config.includeAccountRegistryPermissions,
+      // Sign-in needs only the entry inputs (prefixes + secrets opt-in);
+      // storage and scheduling never leave TinyCloudNode.
+      replication: config.replication?.enabled === true ? {
+        enabled: true,
+        prefixes: config.replication.prefixes,
+        allowSecrets: config.replication.allowSecrets === true
+      } : void 0
     });
-    this.tc = new import_sdk_core8.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core9.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: config.telemetry
     });
@@ -20475,7 +21178,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   /** Publish the active owner Node as a session-signed registry record. */
   async publishActiveNodeLocation(registryUrl, fetchFn = globalThis.fetch.bind(globalThis)) {
     const node = await this.activeNodeIdentity();
-    return (0, import_sdk_core8.publishLocationRecord)({
+    return (0, import_sdk_core9.publishLocationRecord)({
       registryUrl,
       subject: this.credentialHolderDid,
       nodeOrigin: node.origin,
@@ -20492,7 +21195,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   get did() {
     if (this._address) {
-      return (0, import_sdk_core8.pkhDid)(this._address, this._chainId);
+      return (0, import_sdk_core9.pkhDid)(this._address, this._chainId);
     }
     return this.sessionManager.getDID(this.sessionKeyId);
   }
@@ -20529,7 +21232,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
   projectSignedRecapCapabilities(siwe) {
     const projected = this.parseRecapWithCaveats(siwe).map((entry) => {
-      const normalized = (0, import_sdk_core8.parseRecapCapabilities)(() => [entry], siwe)[0];
+      const normalized = (0, import_sdk_core9.parseRecapCapabilities)(() => [entry], siwe)[0];
       if (normalized.service !== "tinycloud.encryption") return normalized;
       if (!this.isEncryptionNetworkOperation("encryption", entry.path, entry.space)) {
         return { ...normalized, space: entry.space };
@@ -20574,14 +21277,14 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._address) {
       return void 0;
     }
-    return this.wasmBindings.makeSpaceId(this._address, this._chainId, import_sdk_core8.ACCOUNT_REGISTRY_SPACE);
+    return this.wasmBindings.makeSpaceId(this._address, this._chainId, import_sdk_core9.ACCOUNT_REGISTRY_SPACE);
   }
   /**
    * Account-level application and delegation helpers.
    */
   get account() {
     if (!this._account) {
-      this._account = new import_sdk_core4.AccountService({
+      this._account = new import_sdk_core5.AccountService({
         getDid: () => this.did,
         getHost: () => this.hosts[0] ?? this.config.host,
         getPrimarySpaceId: () => this.spaceId,
@@ -20627,7 +21330,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     await this.accountRegistryTail;
     await this.wasmBindings.ensureInitialized?.();
-    this._address = (0, import_sdk_core8.canonicalizeAddress)(await this.signer.getAddress());
+    this._address = (0, import_sdk_core9.canonicalizeAddress)(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
     this._kv = void 0;
     this._sql = void 0;
@@ -20644,6 +21347,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.confirmedHostedSpaceIds.clear();
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
+    this.replicationDelegateSession = void 0;
+    this.replicationScopeError = void 0;
+    if (this.replicationRuntime) await (await this.replicationRuntime).unbind();
     const oldGraph = this._serviceGraph;
     this._serviceGraph = this.createServiceGraphLifetime();
     oldGraph.retire();
@@ -20653,7 +21359,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       this.sessionKeyId = signedInSession.sessionKey;
       this.sessionKeyJwk = signedInSession.jwk;
     }
-    this.initializeServices();
+    await this.initializeServices();
     const primarySession = this.currentTinyCloudSession();
     if (primarySession) {
       this.registerPrimarySessionGrant(primarySession);
@@ -20661,10 +21367,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     const bootstrapped = await this.bootstrapAccountIfNeeded();
     await this.ensureRequestedEncryptionNetworks();
     if (!bootstrapped && this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
-      await this.ensureOwnedSpaceHostedById(this.ownedSpaceId(import_sdk_core8.SECRETS_SPACE));
+      await this.ensureOwnedSpaceHostedById(this.ownedSpaceId(import_sdk_core9.SECRETS_SPACE));
     }
     if (!bootstrapped) {
       this.scheduleAccountRegistrySync();
+      await this.accountRegistryTail;
     }
     this.notificationHandler.success("Successfully signed in");
   }
@@ -20692,7 +21399,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       this._bootstrapStatus = { skipped: true, reason: "interactive-signer" };
       return false;
     }
-    const steps = (0, import_sdk_core8.bootstrapSteps)(this._address, this._chainId);
+    const steps = (0, import_sdk_core9.bootstrapSteps)(this._address, this._chainId);
     try {
       const decision = await this.resolveBootstrapDecision(steps);
       if (decision.action === "skip") {
@@ -20730,7 +21437,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!auth) {
       throw new Error("Account bootstrap requires an active wallet session");
     }
-    const accountSpaceId = this.ownedSpaceId(import_sdk_core8.ACCOUNT_REGISTRY_SPACE);
+    const accountSpaceId = this.ownedSpaceId(import_sdk_core9.ACCOUNT_REGISTRY_SPACE);
     const skipped = auth.lastActivationSkippedSpaceIds;
     if (skipped.includes(accountSpaceId)) return { action: "run", mode: "fresh" };
     if (skipped.some((spaceId) => enshrinedSpaceIds.has(spaceId))) {
@@ -20753,7 +21460,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
         return { action: "run", mode: "repair" };
       }
-      if (marker.error.code === import_sdk_core8.ErrorCodes.KV_NOT_FOUND && this.markerReadIsUnhostedSpace(marker.error.meta)) {
+      if (marker.error.code === import_sdk_core9.ErrorCodes.KV_NOT_FOUND && this.markerReadIsUnhostedSpace(marker.error.meta)) {
         return { action: "run", mode: "fresh" };
       }
     } catch (err) {
@@ -20767,7 +21474,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return { action: "run", mode: "repair" };
   }
   async readBootstrapCompletionMarker() {
-    return this.kvForSpace(this.ownedSpaceId(import_sdk_core8.ACCOUNT_REGISTRY_SPACE)).get(
+    return this.kvForSpace(this.ownedSpaceId(import_sdk_core9.ACCOUNT_REGISTRY_SPACE)).get(
       BOOTSTRAP_COMPLETION_MARKER_KEY
     );
   }
@@ -20776,7 +21483,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Bootstrap completion marker requires an active wallet session");
     }
     const canonicalStepIds = new Set(
-      (0, import_sdk_core8.bootstrapSteps)(this._address, this._chainId).map((step) => step.id)
+      (0, import_sdk_core9.bootstrapSteps)(this._address, this._chainId).map((step) => step.id)
     );
     const providedStepIds = new Set(steps.map((step) => step.id));
     if (canonicalStepIds.size !== providedStepIds.size || [...canonicalStepIds].some((stepId) => !providedStepIds.has(stepId))) {
@@ -20787,7 +21494,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       stepIds: [...canonicalStepIds],
       completedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    const written = await this.kvForSpace(this.ownedSpaceId(import_sdk_core8.ACCOUNT_REGISTRY_SPACE)).put(
+    const written = await this.kvForSpace(this.ownedSpaceId(import_sdk_core9.ACCOUNT_REGISTRY_SPACE)).put(
       BOOTSTRAP_COMPLETION_MARKER_KEY,
       marker
     );
@@ -20826,7 +21533,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const warnings = [];
     const primarySession = auth.tinyCloudSession;
     const defaultSpaceId = this.ownedSpaceId("default");
-    const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS.default;
+    const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === import_sdk_core9.BOOTSTRAP_SESSION_REQUESTS.default;
     for (const step of steps) {
       if (step.kind !== "session") continue;
       if (step.space === "default" && canReusePrimaryBootstrapSession && primarySession) {
@@ -20841,7 +21548,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       try {
         session = await auth.createBootstrapSession({
           spaceId: step.spaceId,
-          capabilityRequest: step.request ?? import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS[step.space],
+          capabilityRequest: step.request ?? import_sdk_core9.BOOTSTRAP_SESSION_REQUESTS[step.space],
           rawAbilities
         });
       } catch (err) {
@@ -20871,7 +21578,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (!session) {
         throw new Error(`Missing bootstrap session for ${step.space}`);
       }
-      const activated = await (0, import_sdk_core8.activateSessionWithHost)(host, session.delegationHeader);
+      const activated = await (0, import_sdk_core9.activateSessionWithHost)(host, session.delegationHeader);
       if (!activated.success || activated.skipped?.includes(step.spaceId)) {
         throw Object.assign(
           new Error(
@@ -20882,7 +21589,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       this.registerBootstrapRuntimeGrant(
         session,
-        import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS[step.space],
+        import_sdk_core9.BOOTSTRAP_SESSION_REQUESTS[step.space],
         rawAbilitiesBySpace.get(step.space)
       );
     }
@@ -20931,7 +21638,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       if (step.kind === "seed-applications") {
         const registered = await this.account.applications.register(
-          step.manifests.length > 0 ? [...step.manifests] : import_sdk_core8.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+          step.manifests.length > 0 ? [...step.manifests] : import_sdk_core9.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
           // The write is an INSERT OR REPLACE and is safe to repeat during a
           // repair, so skip the manifest-hash pre-read.
           { assumeUnregistered: true }
@@ -20950,7 +21657,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           migrations: [
             {
               id: "001_initial",
-              sql: [...import_sdk_core8.SECRET_RECORDS_SCHEMA]
+              sql: [...import_sdk_core9.SECRET_RECORDS_SCHEMA]
             }
           ]
         });
@@ -21117,7 +21824,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       provenance: "primary"
     });
   }
-  async writeManifestRegistryRecords() {
+  async writeManifestRegistryRecords(account, signal) {
     const request = this.capabilityRequest;
     if (!request || request.registryRecords.length === 0) {
       return;
@@ -21125,9 +21832,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.signer) {
       throw new Error("Manifest registry write requires wallet mode");
     }
-    const accountSpaceId = this.ownedSpaceId(import_sdk_core8.ACCOUNT_REGISTRY_SPACE);
-    await this.ensureOwnedSpaceHostedById(accountSpaceId);
-    const result = await this.account.applications.register(request.manifests);
+    const accountSpaceId = this.ownedSpaceId(import_sdk_core9.ACCOUNT_REGISTRY_SPACE);
+    await this.ensureOwnedSpaceHostedById(accountSpaceId, signal);
+    if (signal.aborted) throw signal.reason;
+    const result = await account.applications.register(request.manifests);
     if (!result.ok) {
       throw Object.assign(
         new Error(`Failed to write manifest registry records: ${result.error.message}`),
@@ -21135,34 +21843,113 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
   }
+  createAccountRegistryServices(context, signal) {
+    const session = context.session;
+    if (!session) throw new Error("Account registry requires an active service session");
+    const contexts = [context];
+    const accountSpaceId = this.ownedSpaceId(import_sdk_core9.ACCOUNT_REGISTRY_SPACE);
+    const createScopedContext = (spaceId) => {
+      const scoped = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
+        invoke: context.invoke,
+        invokeAny: context.invokeAny,
+        fetch: context.fetch,
+        hosts: context.hosts,
+        telemetry: this.config.telemetry
+      }));
+      scoped.setOperationAbortSignal(signal);
+      scoped.setSession({ ...session, spaceId });
+      contexts.push(scoped);
+      return scoped;
+    };
+    const sql = new import_sdk_core9.SQLService({});
+    const sqlContext = createScopedContext(accountSpaceId);
+    sql.initialize(sqlContext);
+    const spaces = new import_sdk_core9.SpaceService({
+      hosts: context.hosts,
+      session,
+      invoke: context.invoke,
+      fetch: (url, init2) => context.fetch(url, {
+        ...init2,
+        signal: init2?.signal ? AbortSignal.any([init2.signal, signal]) : signal
+      }),
+      userDid: this.did,
+      createKVService: (spaceId) => {
+        const kv = new import_sdk_core9.KVService({});
+        kv.initialize(createScopedContext(spaceId));
+        return kv;
+      }
+    });
+    return {
+      contexts,
+      account: new import_sdk_core5.AccountService({
+        getDid: () => this.did,
+        getHost: () => context.hosts[0] ?? this.config.host,
+        getPrimarySpaceId: () => session.spaceId,
+        getAccountSpaceId: () => accountSpaceId,
+        getSpaces: () => spaces,
+        getAccountDb: () => sql.db("account"),
+        ensureAccountSpaceHosted: () => this.ensureOwnedSpaceHostedById(accountSpaceId, signal)
+      })
+    };
+  }
   scheduleAccountRegistrySync() {
     const session = this.currentTinyCloudSession();
     if (!session || this.pendingAccountRegistrySync?.session === session) {
       return;
     }
+    const controller = new AbortController();
+    const deadline = setTimeout(
+      () => controller.abort(new DOMException("Account registry deadline exceeded", "TimeoutError")),
+      this.accountRegistryDeadlineMs
+    );
     const promise = this.enqueueAccountRegistryOperation(session, async () => {
-      await this.withAccountRegistryRetry(async () => {
-        if (this.currentTinyCloudSession() !== session) {
-          return;
-        }
-        await this.account.index.ensure();
-        if (this.currentTinyCloudSession() !== session) {
-          return;
-        }
-        await this.writeManifestRegistryRecords();
-        if (this.currentTinyCloudSession() !== session) {
-          return;
-        }
-        if (this.currentSessionCanListSpaces()) {
-          const spaces = await this.account.spaces.syncAccessible();
-          if (!spaces.ok) {
-            throw Object.assign(
-              new Error(`Failed to sync account spaces: ${spaces.error.message}`),
-              { cause: spaces.error }
-            );
+      const sharedContext = this._serviceContext;
+      if (!sharedContext) return;
+      const context = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
+        invoke: sharedContext.invoke,
+        invokeAny: sharedContext.invokeAny,
+        fetch: sharedContext.fetch,
+        hosts: sharedContext.hosts,
+        telemetry: this.config.telemetry
+      }));
+      context.setOperationAbortSignal(controller.signal);
+      const current = this.currentTinyCloudSession();
+      if (!current) return;
+      context.setSession({
+        delegationHeader: current.delegationHeader,
+        delegationCid: current.delegationCid,
+        spaceId: current.spaceId,
+        verificationMethod: current.verificationMethod,
+        jwk: current.jwk
+      });
+      const registry = this.createAccountRegistryServices(context, controller.signal);
+      try {
+        await this.withAccountRegistryRetry(async () => {
+          if (controller.signal.aborted) throw controller.signal.reason;
+          if (this.currentTinyCloudSession() !== session) return;
+          await registry.account.index.ensure();
+          if (controller.signal.aborted) throw controller.signal.reason;
+          if (this.currentTinyCloudSession() !== session) return;
+          await this.writeManifestRegistryRecords(registry.account, controller.signal);
+          if (controller.signal.aborted) throw controller.signal.reason;
+          if (this.currentTinyCloudSession() !== session) return;
+          if (this.currentSessionCanListSpaces()) {
+            const result = await registry.account.spaces.syncAccessible();
+            if (controller.signal.aborted) throw controller.signal.reason;
+            if (!result.ok) {
+              throw Object.assign(
+                new Error(`Failed to sync account spaces: ${result.error.message}`),
+                { cause: result.error }
+              );
+            }
           }
+        }, controller.signal);
+      } finally {
+        for (const operationContext of registry.contexts) {
+          operationContext.retire();
         }
-      });
+        clearTimeout(deadline);
+      }
     });
     this.pendingAccountRegistrySync = { session, promise };
     const clearPendingSync = () => {
@@ -21171,6 +21958,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
     void promise.then(clearPendingSync, clearPendingSync);
+    void promise.then(
+      () => clearTimeout(deadline),
+      () => clearTimeout(deadline)
+    );
   }
   enqueueAccountRegistryOperation(session, task) {
     const operation = this.accountRegistryTail.then(async () => {
@@ -21206,15 +21997,23 @@ var _TinyCloudNode = class _TinyCloudNode {
       (operation) => operation.service === "space" && this.actionContains(operation.action, "tinycloud.space/list")
     );
   }
-  async withAccountRegistryRetry(task) {
+  async withAccountRegistryRetry(task, signal) {
     const delays = [250, 1e3, 3e3];
     let lastError;
     for (let attempt = 0; attempt < delays.length; attempt += 1) {
+      if (signal.aborted) {
+        console.warn("TinyCloud account registry sync stopped: deadline exceeded", signal.reason);
+        return;
+      }
       try {
         await task();
         return;
       } catch (error) {
-        const verdict = (0, import_sdk_core8.authorizationVerdictOf)(error);
+        if (signal.aborted) {
+          console.warn("TinyCloud account registry sync stopped: deadline exceeded", error);
+          return;
+        }
+        const verdict = (0, import_sdk_core9.authorizationVerdictOf)(error);
         const message = error instanceof Error ? error.message : String(error);
         const isAuthorizationVerdict = verdict === void 0 ? /Unauthorized Action|\b(?:401|403)\b/.test(message) : verdict !== "other";
         if (isAuthorizationVerdict) {
@@ -21224,14 +22023,30 @@ var _TinyCloudNode = class _TinyCloudNode {
           );
           return;
         }
-        if ((0, import_sdk_core8.isStorageFullError)(error) || (0, import_sdk_core8.isStorageFullError)(error?.cause) || message.includes(import_sdk_core8.STORAGE_FULL_MESSAGE) || message.includes(import_sdk_core8.STORAGE_WRITE_TOO_LARGE_MESSAGE)) {
-          console.warn("TinyCloud account registry sync stopped: storage is full", error);
+        if ((0, import_sdk_core9.isStorageFullError)(error) || (0, import_sdk_core9.isStorageFullError)(error?.cause) || message.includes(import_sdk_core9.STORAGE_FULL_MESSAGE) || message.includes(import_sdk_core9.STORAGE_WRITE_TOO_LARGE_MESSAGE)) {
+          console.warn(
+            "TinyCloud account registry sync stopped: storage is full",
+            error
+          );
           return;
         }
         lastError = error;
         if (attempt < delays.length - 1) {
-          await new Promise((resolve) => setTimeout(resolve, delays[attempt]));
-        }
+          await new Promise((resolve, reject2) => {
+            const timer = setTimeout(() => {
+              signal.removeEventListener("abort", onAbort);
+              resolve();
+            }, delays[attempt]);
+            const onAbort = () => {
+              clearTimeout(timer);
+              signal.removeEventListener("abort", onAbort);
+              reject2(signal.reason);
+            };
+            signal.addEventListener("abort", onAbort, { once: true });
+          }).catch((error2) => {
+            if (!signal.aborted) throw error2;
+          });
+        }
       }
     }
     console.warn(
@@ -21246,7 +22061,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const networkIds = /* @__PURE__ */ new Set();
     for (const resource of request.resources) {
-      if (resource.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE && resource.path.startsWith("urn:tinycloud:encryption:") && resource.actions.includes(DECRYPT_ACTION2)) {
+      if (resource.service === import_sdk_core9.ENCRYPTION_PERMISSION_SERVICE && resource.path.startsWith("urn:tinycloud:encryption:") && resource.actions.includes(DECRYPT_ACTION2)) {
         networkIds.add(resource.path);
       }
     }
@@ -21257,7 +22072,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       return;
     }
     for (const networkId of this.requestedEncryptionNetworkIds()) {
-      const parsed = (0, import_sdk_core8.parseNetworkId)(networkId);
+      const parsed = (0, import_sdk_core9.parseNetworkId)(networkId);
       if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
         continue;
       }
@@ -21280,7 +22095,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * self-revealing: the next write to the space fails immediately and loudly
    * with `404 Space not found`.
    */
-  async ensureOwnedSpaceHostedById(spaceId) {
+  async ensureOwnedSpaceHostedById(spaceId, signal) {
     if (!this.auth) {
       throw new Error("Owned space hosting requires wallet mode");
     }
@@ -21295,7 +22110,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!host) {
       throw new Error("Owned space hosting requires a TinyCloud host");
     }
-    const activation = await (0, import_sdk_core8.activateSessionWithHost)(host, session.delegationHeader);
+    const activation = await (0, import_sdk_core9.activateSessionWithHost)(host, session.delegationHeader, signal);
     if (activation.success && !activation.skipped?.includes(spaceId)) {
       this.confirmedHostedSpaceIds.add(spaceId);
       return;
@@ -21306,15 +22121,16 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activation }
       );
     }
-    const created = await this.auth.hostOwnedSpaceResult(spaceId);
+    const authorization = this.auth;
+    const created = signal ? await authorization.hostOwnedSpaceResult(spaceId, void 0, signal) : await authorization.hostOwnedSpaceResult(spaceId);
     if (!created.success) {
       throw Object.assign(
         new Error(`Failed to create owned space ${spaceId}: ${describeHostFailure2(created)}`),
         { cause: created }
       );
     }
-    await new Promise((resolve) => setTimeout(resolve, 100));
-    const retry = await (0, import_sdk_core8.activateSessionWithHost)(host, session.delegationHeader);
+    if (signal?.aborted) throw signal.reason;
+    const retry = await (0, import_sdk_core9.activateSessionWithHost)(host, session.delegationHeader, signal);
     if (!retry.success || retry.skipped?.includes(spaceId)) {
       throw Object.assign(
         new Error(
@@ -21362,7 +22178,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: hosted }
       );
     }
-    const activation = await (0, import_sdk_core8.activateSessionWithHost)(
+    const activation = await (0, import_sdk_core9.activateSessionWithHost)(
       host,
       session.delegationHeader
     );
@@ -21550,7 +22366,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     let restoredAddress;
     try {
-      restoredAddress = hasPersistedProof ? (0, import_sdk_core8.canonicalizeAddress)(sessionData.address) : void 0;
+      restoredAddress = hasPersistedProof ? (0, import_sdk_core9.canonicalizeAddress)(sessionData.address) : void 0;
     } catch {
       throw new InvalidRestoredSessionError("Persisted session has an invalid wallet address.");
     }
@@ -21592,7 +22408,35 @@ var _TinyCloudNode = class _TinyCloudNode {
     const stagedHost = resolvedHost ?? this.config.host;
     const stagedAddress = restoredAddress;
     const stagedChainId = sessionData.chainId ?? 1;
-    const stagedNodeDid = stagedAddress ? (0, import_sdk_core8.pkhDid)(stagedAddress, stagedChainId) : canonicalVerificationMethod;
+    let replicationPrincipal;
+    let compactReplicationSession;
+    let replicationScopeError;
+    if (this.config.replication?.enabled) {
+      if (stagedAddress !== void 0) {
+        replicationPrincipal = (0, import_sdk_core9.pkhDid)(stagedAddress, stagedChainId);
+      } else {
+        const { replicationScopeFromSignedSession: replicationScopeFromSignedSession2 } = await getNodeReplicationLoaders().authority();
+        const signedScope = replicationScopeFromSignedSession2({
+          delegationHeader: sessionData.delegationHeader,
+          delegationCid: sessionData.delegationCid,
+          verificationMethod: restoredVerificationMethod,
+          persistedSpace: sessionData.spaceId
+        });
+        if (!signedScope) {
+          replicationScopeError = "Persisted space does not match the locally verified delegation scope.";
+        } else {
+          replicationPrincipal = signedScope.principal;
+          compactReplicationSession = {
+            delegationHeader: sessionData.delegationHeader,
+            delegationCid: sessionData.delegationCid,
+            spaceId: signedScope.space,
+            verificationMethod: restoredVerificationMethod,
+            jwk: stagedJwk
+          };
+        }
+      }
+    }
+    const stagedNodeDid = stagedAddress ? (0, import_sdk_core9.pkhDid)(stagedAddress, stagedChainId) : canonicalVerificationMethod;
     const serviceSession = {
       delegationHeader: sessionData.delegationHeader,
       delegationCid: sessionData.delegationCid,
@@ -21620,7 +22464,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       stagedSessionExpiry,
       stagedRecap
     );
-    const stagedAccountSpaceId = stagedAddress ? this.wasmBindings.makeSpaceId(stagedAddress, stagedChainId, import_sdk_core8.ACCOUNT_REGISTRY_SPACE) : void 0;
+    const stagedAccountSpaceId = stagedAddress ? this.wasmBindings.makeSpaceId(stagedAddress, stagedChainId, import_sdk_core9.ACCOUNT_REGISTRY_SPACE) : void 0;
     const stagedGraph = this.stageRestoredServiceGraph({
       host: stagedHost,
       manager: stagedManager,
@@ -21670,7 +22514,18 @@ var _TinyCloudNode = class _TinyCloudNode {
     } else {
       this._restoredTcSession = stagedTcSession;
     }
+    this.replicationDelegateSession = compactReplicationSession;
+    this.replicationScopeError = replicationScopeError;
+    if (this.replicationRuntime) await (await this.replicationRuntime).unbind();
     oldGraph.retire();
+    if (replicationScopeError) {
+      stagedGraph.serviceContext.emit("replication.state", {
+        state: "unavailable",
+        code: "SESSION_SCOPE_MISMATCH",
+        detail: replicationScopeError
+      });
+    }
+    await this.bindReplicationRuntime(stagedGraph.serviceContext, serviceSession, stagedGraph.kv, replicationPrincipal);
     oldCore?.retireServices?.();
   }
   stagePrimarySessionState(session, verificationMethod, host, sessionExpiry, recap) {
@@ -21721,7 +22576,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   stageRestoredServiceGraph(input) {
     const graph = this.createServiceGraphLifetime();
-    const core = this.auth ? new import_sdk_core8.TinyCloud(this.auth, {
+    const core = this.auth ? new import_sdk_core9.TinyCloud(this.auth, {
       invokeAny: graph.invokeAny,
       telemetry: this.config.telemetry
     }) : null;
@@ -21730,23 +22585,23 @@ var _TinyCloudNode = class _TinyCloudNode {
       const coreContext = graph.track(core.serviceContext);
       coreContext.setSession(input.serviceSession);
     }
-    const serviceContext = graph.track(new import_sdk_core8.ServiceContext({
+    const serviceContext = graph.track(new import_sdk_core9.ServiceContext({
       invoke: graph.invoke,
       invokeAny: graph.invokeAny,
       fetch: graph.fetch,
       hosts: [input.host],
       telemetry: this.config.telemetry
     }));
-    const kv = new import_sdk_core8.KVService({});
+    const kv = new import_sdk_core9.KVService({});
     kv.initialize(serviceContext);
     serviceContext.registerService("kv", kv);
-    const sql = new import_sdk_core8.SQLService({});
+    const sql = new import_sdk_core9.SQLService({});
     sql.initialize(serviceContext);
     serviceContext.registerService("sql", sql);
-    const duckdb = new import_sdk_core8.DuckDbService({});
+    const duckdb = new import_sdk_core9.DuckDbService({});
     duckdb.initialize(serviceContext);
     serviceContext.registerService("duckdb", duckdb);
-    const hooks = new import_sdk_core8.HooksService({});
+    const hooks = new import_sdk_core9.HooksService({});
     hooks.initialize(serviceContext);
     serviceContext.registerService("hooks", hooks);
     serviceContext.setSession(input.serviceSession);
@@ -21769,7 +22624,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     vault.initialize(serviceContext);
     serviceContext.registerService("vault", vault);
-    const capabilityRegistry = new import_sdk_core8.CapabilityKeyRegistry();
+    const capabilityRegistry = new import_sdk_core9.CapabilityKeyRegistry();
     if (input.tinyCloudSession) {
       const session = input.tinyCloudSession;
       const delegations = input.recap.map((entry) => ({
@@ -21793,7 +22648,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }, delegations);
       }
     }
-    const delegationManager = new import_sdk_core8.DelegationManager({
+    const delegationManager = new import_sdk_core9.DelegationManager({
       hosts: [input.host],
       accountSpaceId: input.accountSpaceId,
       session: input.serviceSession,
@@ -21802,7 +22657,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       fetch: graph.fetch
     });
     const keyProvider = new WasmKeyProvider({ sessionManager: input.manager });
-    const sharingService = new import_sdk_core8.SharingService({
+    const sharingService = new import_sdk_core9.SharingService({
       hosts: [input.host],
       invoke: graph.invoke,
       fetch: graph.fetch,
@@ -21815,8 +22670,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         return this.wasmBindings.computeCid(data, codec);
       },
       createKVService: (config) => {
-        const service = new import_sdk_core8.KVService({ prefix: config.pathPrefix?.replace(/\/$/, "") });
-        const context = graph.track(new import_sdk_core8.ServiceContext({
+        const service = new import_sdk_core9.KVService({ prefix: config.pathPrefix?.replace(/\/$/, "") });
+        const context = graph.track(new import_sdk_core9.ServiceContext({
           invoke: config.invoke,
           fetch: config.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config.hosts,
@@ -21824,6 +22679,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }));
         context.setSession(config.session);
         service.initialize(context);
+        this.attachReplicationKV(config.session.spaceId, service);
         return service;
       }
     });
@@ -21845,7 +22701,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return delegation;
       } : void 0
     });
-    const spaceService = new import_sdk_core8.SpaceService({
+    const spaceService = new import_sdk_core9.SpaceService({
       hosts: [input.host],
       session: input.serviceSession,
       invoke: graph.invoke,
@@ -21854,8 +22710,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       userDid: input.nodeDid,
       createKVService: (spaceId) => {
         graph.assertActive();
-        const scopedKv = new import_sdk_core8.KVService({});
-        const context = graph.track(new import_sdk_core8.ServiceContext({
+        const scopedKv = new import_sdk_core9.KVService({});
+        const context = graph.track(new import_sdk_core9.ServiceContext({
           invoke: graph.invoke,
           invokeAny: graph.invokeAny,
           fetch: graph.fetch,
@@ -21864,12 +22720,13 @@ var _TinyCloudNode = class _TinyCloudNode {
         }));
         context.setSession({ ...input.serviceSession, spaceId });
         scopedKv.initialize(context);
+        this.attachReplicationKV(spaceId, scopedKv);
         return scopedKv;
       },
       createVaultService: (spaceId) => {
         graph.assertActive();
-        const scopedKv = new import_sdk_core8.KVService({});
-        const context = graph.track(new import_sdk_core8.ServiceContext({
+        const scopedKv = new import_sdk_core9.KVService({});
+        const context = graph.track(new import_sdk_core9.ServiceContext({
           invoke: graph.invoke,
           invokeAny: graph.invokeAny,
           fetch: graph.fetch,
@@ -21878,6 +22735,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }));
         context.setSession({ ...input.serviceSession, spaceId });
         scopedKv.initialize(context);
+        this.attachReplicationKV(spaceId, scopedKv);
         const scopedVault = this.createVaultService(spaceId, scopedKv, encryption, {
           host: input.host,
           did: input.nodeDid,
@@ -21955,7 +22813,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (address === void 0 || chainId === void 0) {
       return void 0;
     }
-    const resolved = await (0, import_sdk_core8.resolveTinyCloudHosts)((0, import_sdk_core8.pkhDid)(address, chainId), {
+    const resolved = await (0, import_sdk_core9.resolveTinyCloudHosts)((0, import_sdk_core9.pkhDid)(address, chainId), {
       registryUrl: this.config.tinycloudRegistryUrl,
       fallbackHosts: this.config.tinycloudFallbackHosts,
       autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
@@ -22007,7 +22865,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nodeAudience: input.nodeAudience,
       ...input.role === "policy-enforcement" ? { enforcerDid: input.audienceDid } : {}
     };
-    const root = await (0, import_sdk_core8.signCompactUcanRootAuthorization)({
+    const root = await (0, import_sdk_core9.signCompactUcanRootAuthorization)({
       issuerDid: ownerDid,
       audienceDid: input.audienceDid,
       attenuation: unifiedRootAttenuation(input.capabilities),
@@ -22049,7 +22907,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (decision.needsApproval) return void 0;
       throw new Error(decision.reason ?? "OpenKey automatic credential signing was rejected");
     }
-    if (typeof decision.signature !== "string" || !await (0, import_sdk_core8.verifyEip191MessageSignature)(
+    if (typeof decision.signature !== "string" || !await (0, import_sdk_core9.verifyEip191MessageSignature)(
       request.message,
       decision.signature,
       request.address
@@ -22074,7 +22932,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (approval) {
       const decision = await approval(request);
       if (!decision.approved) throw new Error(decision.reason ?? "Credential signing was rejected");
-      if (decision.signature !== void 0 && !await (0, import_sdk_core8.verifyEip191MessageSignature)(
+      if (decision.signature !== void 0 && !await (0, import_sdk_core9.verifyEip191MessageSignature)(
         request.message,
         decision.signature,
         request.address
@@ -22157,10 +23015,15 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core8.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
-      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
+      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core9.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core9.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions,
+      replication: this.config.replication?.enabled === true ? {
+        enabled: true,
+        prefixes: this.config.replication.prefixes,
+        allowSecrets: this.config.replication.allowSecrets === true
+      } : void 0
     });
-    this.tc = new import_sdk_core8.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core9.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: this.config.telemetry
     });
@@ -22210,10 +23073,15 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core8.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
-      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
+      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core9.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core9.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions,
+      replication: this.config.replication?.enabled === true ? {
+        enabled: true,
+        prefixes: this.config.replication.prefixes,
+        allowSecrets: this.config.replication.allowSecrets === true
+      } : void 0
     });
-    this.tc = new import_sdk_core8.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core9.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: this.config.telemetry
     });
@@ -22223,7 +23091,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * Initialize the service context and KV service after sign-in.
    * @internal
    */
-  initializeServices() {
+  async initializeServices() {
     const session = this.currentTinyCloudSession();
     if (!session) {
       return;
@@ -22234,28 +23102,28 @@ var _TinyCloudNode = class _TinyCloudNode {
       this._serviceGraph.fetch
     );
     this._serviceGraph.track(this.tc.serviceContext);
-    this._serviceContext = this._serviceGraph.track(new import_sdk_core8.ServiceContext({
+    this._serviceContext = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
       invoke: this._serviceGraph.invoke,
       invokeAny: this._serviceGraph.invokeAny,
       fetch: this._serviceGraph.fetch,
       hosts: [this.config.host],
       telemetry: this.config.telemetry
     }));
-    this._kv = new import_sdk_core8.KVService({});
+    this._kv = new import_sdk_core9.KVService({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
     const features = this.nodeFeatures;
     if (features.length === 0 || features.includes("sql")) {
-      this._sql = new import_sdk_core8.SQLService({});
+      this._sql = new import_sdk_core9.SQLService({});
       this._sql.initialize(this._serviceContext);
       this._serviceContext.registerService("sql", this._sql);
     }
     if (features.length === 0 || features.includes("duckdb")) {
-      this._duckdb = new import_sdk_core8.DuckDbService({});
+      this._duckdb = new import_sdk_core9.DuckDbService({});
       this._duckdb.initialize(this._serviceContext);
       this._serviceContext.registerService("duckdb", this._duckdb);
     }
-    this._hooks = new import_sdk_core8.HooksService({});
+    this._hooks = new import_sdk_core9.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -22266,16 +23134,22 @@ var _TinyCloudNode = class _TinyCloudNode {
       jwk: session.jwk
     };
     this._serviceContext.setSession(serviceSession);
+    await this.bindReplicationRuntime(this._serviceContext, serviceSession, this._kv);
     this.tc.serviceContext.setSession(serviceSession);
     this._vault = this.createVaultService(session.spaceId, this._kv);
     this._vault.initialize(this._serviceContext);
     this._serviceContext.registerService("vault", this._vault);
     this.initializeV2Services(serviceSession);
   }
+  attachReplicationKV(spaceId, kvService) {
+    if (!this.replicationRuntime) return;
+    const attached = this.replicationRuntime.then((runtime) => runtime.attach(spaceId, kvService));
+    kvService.setReadThroughReady(attached);
+  }
   createSpaceScopedKVService(spaceId) {
-    const kvService = new import_sdk_core8.KVService({});
+    const kvService = new import_sdk_core9.KVService({});
     if (this._serviceContext) {
-      const spaceScopedContext = this._serviceGraph.track(new import_sdk_core8.ServiceContext({
+      const spaceScopedContext = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
         invoke: this._serviceContext.invoke,
         invokeAny: this._serviceContext.invokeAny,
         fetch: this._serviceContext.fetch,
@@ -22287,6 +23161,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         spaceScopedContext.setSession({ ...session, spaceId });
       }
       kvService.initialize(spaceScopedContext);
+      this.attachReplicationKV(spaceId, kvService);
     }
     return kvService;
   }
@@ -22367,7 +23242,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         const shared = wasm.vault_x25519_dh(receiverPrivateKey, peerPublic);
         return columnDecrypt(shared, ciphertext);
       },
-      verifyNodeSignature: (nodeId, message, signature2) => (0, import_sdk_core8.verifyDidKeyEd25519Signature)(nodeId, message, signature2)
+      verifyNodeSignature: (nodeId, message, signature2) => (0, import_sdk_core9.verifyDidKeyEd25519Signature)(nodeId, message, signature2)
     };
   }
   /**
@@ -22383,7 +23258,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (cached) return cached;
     const response = await fetch(`${this.config.host}/info`);
     if (!response.ok) {
-      throw await (0, import_sdk_core8.httpResponseError)(response, "Failed to fetch node info");
+      throw await (0, import_sdk_core9.httpResponseError)(response, "Failed to fetch node info");
     }
     const info = await response.json();
     if (typeof info.nodeId !== "string" || info.nodeId.length === 0) {
@@ -22433,7 +23308,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     );
     if (response.status === 404) return null;
     if (!response.ok) {
-      throw await (0, import_sdk_core8.httpResponseError)(response, `Failed to fetch encryption network ${networkId}`);
+      throw await (0, import_sdk_core9.httpResponseError)(response, `Failed to fetch encryption network ${networkId}`);
     }
     const body = await response.json();
     return "descriptor" in body && body.descriptor ? body.descriptor : body;
@@ -22464,17 +23339,17 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services.parsePermissionHint)({
+          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services3.parsePermissionHint)({
             service: "tinycloud.encryption",
             path: networkId,
             actions: ["tinycloud.encryption/decrypt"]
           }) : void 0;
-          throw new import_sdk_core8.DecryptTransportResponseError(response.status, permissionHint);
+          throw new import_sdk_core9.DecryptTransportResponseError(response.status, permissionHint);
         }
         return await response.json();
       }
     };
-    return new import_sdk_core8.EncryptionService({
+    return new import_sdk_core9.EncryptionService({
       crypto: crypto3,
       signer: {
         signDecryptInvocation: async (input) => {
@@ -22488,7 +23363,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           graph.assertActive();
           return {
             ...signed2,
-            canonicalBody: (0, import_sdk_core8.canonicalizeEncryptionJson)(
+            canonicalBody: (0, import_sdk_core9.canonicalizeEncryptionJson)(
               input.body
             )
           };
@@ -22520,7 +23395,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           if (!address || !didPrincipalMatches2(principal, did)) {
             return null;
           }
-          const publicSpaceId = (0, import_sdk_core8.makePublicSpaceId)(address, chainId);
+          const publicSpaceId = (0, import_sdk_core9.makePublicSpaceId)(address, chainId);
           const encodedKey = discoveryKey.split("/").map(encodeURIComponent).join("/");
           const response = await graph.fetch(
             `${host}/public/${encodeURIComponent(publicSpaceId)}/kv/${encodedKey}`,
@@ -22552,7 +23427,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   createVaultService(spaceId, kv, encryptionService = this.getEncryptionService(), nodeContext) {
     const wasm = this.wasmBindings;
     const serviceGraph = nodeContext?.serviceGraph ?? this._serviceGraph;
-    const vaultCrypto = (0, import_sdk_core8.createVaultCrypto)({
+    const vaultCrypto = (0, import_sdk_core9.createVaultCrypto)({
       vault_encrypt: wasm.vault_encrypt,
       vault_decrypt: wasm.vault_decrypt,
       vault_derive_key: wasm.vault_derive_key,
@@ -22567,7 +23442,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const chainId = nodeContext?.chainId ?? this._chainId;
     const host = nodeContext?.host ?? this.config.host;
     const ownerDid = this.ownerDidFromSpaceId(spaceId) ?? did;
-    return new import_sdk_core8.DataVaultService({
+    return new import_sdk_core9.DataVaultService({
       spaceId,
       crypto: vaultCrypto,
       encryption: {
@@ -22592,8 +23467,8 @@ var _TinyCloudNode = class _TinyCloudNode {
           serviceGraph.assertActive();
           return self2._publicKV ?? self2.tc.publicKV;
         },
-        readPublicSpace: (host2, targetSpaceId, key2) => import_sdk_core8.TinyCloud.readPublicSpace(host2, targetSpaceId, key2),
-        makePublicSpaceId: import_sdk_core8.TinyCloud.makePublicSpaceId,
+        readPublicSpace: (host2, targetSpaceId, key2) => import_sdk_core9.TinyCloud.readPublicSpace(host2, targetSpaceId, key2),
+        makePublicSpaceId: import_sdk_core9.TinyCloud.makePublicSpaceId,
         did,
         address: address ?? "",
         chainId,
@@ -22607,7 +23482,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   initializeV2Services(serviceSession) {
     const graph = this._serviceGraph;
-    this._capabilityRegistry = new import_sdk_core8.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core9.CapabilityKeyRegistry();
     const tcSession = this.auth?.tinyCloudSession;
     if (tcSession && this._address) {
       const sessionKey = {
@@ -22647,7 +23522,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       this._capabilityRegistry.registerKey(sessionKey, delegations);
     }
-    this._delegationManager = new import_sdk_core8.DelegationManager({
+    this._delegationManager = new import_sdk_core9.DelegationManager({
       hosts: [this.config.host],
       accountSpaceId: this.accountSpaceId,
       session: serviceSession,
@@ -22655,7 +23530,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       invokeAny: graph.invokeAny,
       fetch: graph.fetch
     });
-    this._spaceService = new import_sdk_core8.SpaceService({
+    this._spaceService = new import_sdk_core9.SpaceService({
       hosts: [this.config.host],
       session: serviceSession,
       invoke: graph.invoke,
@@ -22720,7 +23595,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         await this.account.spaces.register(space);
       }
     });
-    this._sharingService = new import_sdk_core8.SharingService({
+    this._sharingService = new import_sdk_core9.SharingService({
       hosts: [this.config.host],
       session: serviceSession,
       invoke: graph.invoke,
@@ -22740,8 +23615,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       createKVService: (config) => {
         graph.assertActive();
-        const service = new import_sdk_core8.KVService({ prefix: config.pathPrefix?.replace(/\/$/, "") });
-        const context = graph.track(new import_sdk_core8.ServiceContext({
+        const service = new import_sdk_core9.KVService({ prefix: config.pathPrefix?.replace(/\/$/, "") });
+        const context = graph.track(new import_sdk_core9.ServiceContext({
           invoke: config.invoke,
           fetch: config.fetch ?? graph.fetch,
           hosts: config.hosts,
@@ -22749,6 +23624,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }));
         context.setSession(config.session);
         service.initialize(context);
+        this.attachReplicationKV(config.session.spaceId, service);
         return service;
       },
       onRootDelegationNeeded: this.signer ? async (params) => {
@@ -22834,15 +23710,15 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const permissions = ownerDelegationPermissions(params);
     const now = /* @__PURE__ */ new Date();
-    if (!(params.expiresAt instanceof Date) || params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > import_sdk_core8.EXPIRY.MAX_MS) {
+    if (!(params.expiresAt instanceof Date) || params.expiresAt.getTime() <= now.getTime() || params.expiresAt.getTime() - now.getTime() > import_sdk_core9.EXPIRY.MAX_MS) {
       throw new Error("Owner delegation expiry must be explicit, future, and within EXPIRY.MAX_MS");
     }
     if (!this.signer) throw new Error("Owner wallet signer is required");
     const session = this.currentTinyCloudSession();
     if (!session) throw new Error("Owner session is required");
-    const ownerDid = (0, import_sdk_core8.pkhDid)(session.address, session.chainId);
+    const ownerDid = (0, import_sdk_core9.pkhDid)(session.address, session.chainId);
     for (const permission of permissions) {
-      if (permission.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE && !(0, import_sdk_core8.principalDidEquals)((0, import_sdk_core8.parseNetworkId)(permission.path).ownerDid, ownerDid)) {
+      if (permission.service === import_sdk_core9.ENCRYPTION_PERMISSION_SERVICE && !(0, import_sdk_core9.principalDidEquals)((0, import_sdk_core9.parseNetworkId)(permission.path).ownerDid, ownerDid)) {
         throw new Error("Owner delegation cannot grant a foreign encryption network");
       }
     }
@@ -22863,7 +23739,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const signature2 = await this.signer.signMessage(prepared.siwe);
     assertOwnerGraphActive();
     const delegationSession = this.wasmBindings.completeSessionSetup({ ...prepared, signature: signature2 });
-    const activation = await (0, import_sdk_core8.activateSessionWithHost)(host, delegationSession.delegationHeader);
+    const activation = await (0, import_sdk_core9.activateSessionWithHost)(host, delegationSession.delegationHeader);
     assertOwnerGraphActive();
     if (!activation.success) {
       throw Object.assign(
@@ -22899,7 +23775,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   /** Register a signed policy and sibling roots with this Node's Policy/v3 runtime. */
   async registerPolicy(params) {
     this._serviceGraph.assertActive();
-    return (0, import_sdk_core8.registerPolicyV3)({
+    return (0, import_sdk_core9.registerPolicyV3)({
       ...params,
       nodeOrigin: this.config.host,
       fetch: globalThis.fetch.bind(globalThis)
@@ -22926,23 +23802,23 @@ var _TinyCloudNode = class _TinyCloudNode {
       jti: base64UrlEncode(jtiDigest.slice(0, 16)),
       expiresAt: new Date(input.expiresAt).toISOString().replace(/\.\d{3}Z$/, "Z")
     };
-    const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, import_sdk_core8.canonicalizeEncryptionJson)(body)))));
+    const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode((0, import_sdk_core9.canonicalizeEncryptionJson)(body)))));
     const request = { ...body, requestBodyDigest };
     const authorization = authorizationHeader(this.invokeAnyWithRuntimePermissions(serviceSession, [{ spaceId: session.spaceId, service: "kv", path: input.resourcePath, action: "tinycloud.kv/get" }]));
     const response = await fetch(`${this.config.host}/policy/v3/deliveries/authorize`, {
       method: "POST",
       headers: { accept: "application/json", "content-type": "application/json", authorization },
-      body: (0, import_sdk_core8.canonicalizeEncryptionJson)(request)
+      body: (0, import_sdk_core9.canonicalizeEncryptionJson)(request)
     });
-    if (!response.ok) throw await (0, import_sdk_core8.httpResponseError)(response, "V3 share delivery authorization failed");
-    const verified = (0, import_sdk_core8.validateShareDeliveryAuthorizationV3Bytes)(new Uint8Array(await response.arrayBuffer()), {
+    if (!response.ok) throw await (0, import_sdk_core9.httpResponseError)(response, "V3 share delivery authorization failed");
+    const verified = (0, import_sdk_core9.validateShareDeliveryAuthorizationV3Bytes)(new Uint8Array(await response.arrayBuffer()), {
       request,
       senderKeyDid: this.credentialHolderDid,
       deliveryAudience: input.deliveryAudience
     });
     const requestDigest = new Uint8Array(await crypto.subtle.digest(
       "SHA-256",
-      new TextEncoder().encode(`${import_sdk_core8.CREDENTIAL_INVITATION_REQUEST_DOMAIN}${(0, import_sdk_core8.canonicalizeEncryptionJson)(verified.request)}`)
+      new TextEncoder().encode(`${import_sdk_core9.CREDENTIAL_INVITATION_REQUEST_DOMAIN}${(0, import_sdk_core9.canonicalizeEncryptionJson)(verified.request)}`)
     ));
     return {
       ...verified,
@@ -23010,7 +23886,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._sql) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("sql")) {
-        throw new import_sdk_core8.UnsupportedFeatureError("sql", this.config.host, features);
+        throw new import_sdk_core9.UnsupportedFeatureError("sql", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -23034,8 +23910,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._serviceContext || !this._serviceContext.session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    const sql = new import_sdk_core8.SQLService({});
-    const spaceScopedContext = this._serviceGraph.track(new import_sdk_core8.ServiceContext({
+    const sql = new import_sdk_core9.SQLService({});
+    const spaceScopedContext = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
       invoke: this._serviceContext.invoke,
       invokeAny: this._serviceContext.invokeAny,
       fetch: this._serviceContext.fetch,
@@ -23064,8 +23940,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._serviceContext || !this._serviceContext.session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    const kv = new import_sdk_core8.KVService({});
-    const spaceScopedContext = this._serviceGraph.track(new import_sdk_core8.ServiceContext({
+    const kv = new import_sdk_core9.KVService({});
+    const spaceScopedContext = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
       invoke: this._serviceContext.invoke,
       invokeAny: this._serviceContext.invokeAny,
       fetch: this._serviceContext.fetch,
@@ -23073,6 +23949,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     }));
     spaceScopedContext.setSession({ ...this._serviceContext.session, spaceId });
     kv.initialize(spaceScopedContext);
+    this.attachReplicationKV(spaceId, kv);
     return kv;
   }
   /**
@@ -23082,7 +23959,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._duckdb) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("duckdb")) {
-        throw new import_sdk_core8.UnsupportedFeatureError("duckdb", this.config.host, features);
+        throw new import_sdk_core9.UnsupportedFeatureError("duckdb", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -23126,7 +24003,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       type: NETWORK_ADMIN_TYPE,
       targetNode,
       networkId,
-      bodyHash: (0, import_sdk_core8.canonicalHashHex)(
+      bodyHash: (0, import_sdk_core9.canonicalHashHex)(
         crypto3.sha256,
         body
       ),
@@ -23144,7 +24021,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         Authorization: signed2.authorization,
         "Content-Type": "application/json"
       },
-      body: (0, import_sdk_core8.canonicalizeEncryptionJson)(
+      body: (0, import_sdk_core9.canonicalizeEncryptionJson)(
         body
       )
     });
@@ -23156,7 +24033,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     if (!response.ok) {
-      throw await (0, import_sdk_core8.httpResponseError)(response, `Failed to create encryption network ${networkId}`);
+      throw await (0, import_sdk_core9.httpResponseError)(response, `Failed to create encryption network ${networkId}`);
     }
     const created = await response.json();
     return created.descriptor;
@@ -23175,7 +24052,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return existing;
       }
     }
-    const parsed = (0, import_sdk_core8.parseNetworkId)(networkId);
+    const parsed = (0, import_sdk_core9.parseNetworkId)(networkId);
     if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
       throw new Error(
         `Cannot create encryption network ${networkId}: owner ${parsed.ownerDid} does not match signed-in DID ${this.did}`
@@ -23223,14 +24100,14 @@ var _TinyCloudNode = class _TinyCloudNode {
    * normal KV and encryption invocation paths.
    */
   async readSecret(input) {
-    const resolved = (0, import_sdk_core8.resolveSecretPath)(input.name, { scope: input.scope });
+    const resolved = (0, import_sdk_core9.resolveSecretPath)(input.name, { scope: input.scope });
     const targetSpace = input.space.startsWith("tinycloud:") ? input.space : this.ownedSpaceId(input.space);
     const result = await this.getBaseVault(targetSpace).readNetworkEncrypted(
       resolved.vaultKey
     );
     if (result.status !== "ok") {
       if (result.status === "permission_required") {
-        const hint = (0, import_sdk_services.parsePermissionHint)(result.hint);
+        const hint = (0, import_sdk_services3.parsePermissionHint)(result.hint);
         if (hint === void 0) return { status: "read_failed" };
         return {
           status: "permission_required",
@@ -23256,7 +24133,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const resolvedSpace = spaceId.startsWith("tinycloud:") ? spaceId : this.ownedSpaceId(spaceId);
     let secrets = this._baseSecrets.get(resolvedSpace);
     if (!secrets) {
-      secrets = new import_sdk_core8.SecretsService(() => this.getBaseVault(resolvedSpace));
+      secrets = new import_sdk_core9.SecretsService(() => this.getBaseVault(resolvedSpace));
       this._baseSecrets.set(resolvedSpace, secrets);
     }
     return secrets;
@@ -23399,7 +24276,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     for (const grant of this.runtimePermissionGrants) {
       if (grant.provenance === "primary") continue;
       for (const operation of grant.operations) {
-        const service = import_sdk_core8.SERVICE_SHORT_TO_LONG[operation.service];
+        const service = import_sdk_core9.SERVICE_SHORT_TO_LONG[operation.service];
         if (service === void 0 || typeof operation.path !== "string" || typeof operation.action !== "string") {
           continue;
         }
@@ -23417,7 +24294,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           service,
           ...space === void 0 ? {} : { space },
           path: operation.path,
-          caveats: (0, import_sdk_core8.canonicalizeRecapCaveats)(caveats)
+          caveats: (0, import_sdk_core9.canonicalizeRecapCaveats)(caveats)
         });
         const existing = grouped.get(identity);
         if (existing === void 0) {
@@ -23462,7 +24339,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegationCid: grant.delegationCid,
       spaceId: grant.spaceId,
       jwk: this.sessionKeyJwk,
-      address: (0, import_sdk_core8.canonicalizeAddress)(grant.address),
+      address: (0, import_sdk_core9.canonicalizeAddress)(grant.address),
       chainId: grant.chainId,
       siwe: grant.siwe,
       signature: grant.signature
@@ -23483,10 +24360,10 @@ var _TinyCloudNode = class _TinyCloudNode {
   async useRuntimeDelegation(delegation) {
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core8.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core9.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     if (delegation.expiry.getTime() <= Date.now()) {
-      throw new import_sdk_core8.SessionExpiredError(delegation.expiry);
+      throw new import_sdk_core9.SessionExpiredError(delegation.expiry);
     }
     const expectedDids = [session.verificationMethod, this.sessionDid];
     if (!expectedDids.some((did) => didPrincipalMatches2(delegation.delegateDID, did))) {
@@ -23495,10 +24372,18 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     const targetHost = delegation.host ?? this.config.host;
-    const activateResult = await (0, import_sdk_core8.activateSessionWithHost)(
-      targetHost,
-      delegation.delegationHeader
-    );
+    let activateResult;
+    try {
+      activateResult = await (0, import_sdk_core9.activateSessionWithHost)(
+        targetHost,
+        delegation.delegationHeader
+      );
+    } catch (cause) {
+      throw Object.assign(
+        new Error("The TinyCloud host could not be reached to activate the delegation."),
+        { code: "ACTIVATION_TRANSPORT_FAILED", cause }
+      );
+    }
     if (!activateResult.success) {
       if (this.operationsFromDelegation(delegation).some(
         (operation) => operation.resource?.startsWith("urn:cid:") === true && operation.service === "delegation" && operation.action === "tinycloud.delegation/revoke"
@@ -23531,13 +24416,13 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core8.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core9.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     const sessionExpiry = extractSiweExpiration(session.siwe);
     if (sessionExpiry !== void 0) {
       const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
       if (sessionExpiry.getTime() <= Date.now() + marginMs) {
-        throw new import_sdk_core8.SessionExpiredError(sessionExpiry);
+        throw new import_sdk_core9.SessionExpiredError(sessionExpiry);
       }
     }
     const expanded = this.expandPermissionEntries(permissions);
@@ -23613,7 +24498,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...prepared,
         signature: signature2
       });
-      const activateResult = await (0, import_sdk_core8.activateSessionWithHost)(
+      const activateResult = await (0, import_sdk_core9.activateSessionWithHost)(
         this.config.host,
         delegatedSession.delegationHeader
       );
@@ -23786,10 +24671,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Public space not enabled. Set enablePublicSpace: true in config.");
     }
     await this.auth.hostPublicSpace(publicSpaceId);
-    const kvActions = [import_sdk_core8.KV.PUT, import_sdk_core8.KV.GET, import_sdk_core8.KV.DEL, import_sdk_core8.KV.LIST, import_sdk_core8.KV.METADATA];
+    const kvActions = [import_sdk_core9.KV.PUT, import_sdk_core9.KV.GET, import_sdk_core9.KV.DEL, import_sdk_core9.KV.LIST, import_sdk_core9.KV.METADATA];
     const abilities = { kv: { "": kvActions } };
     const now = /* @__PURE__ */ new Date();
-    const expiryMs = import_sdk_core8.EXPIRY.EPHEMERAL_MS;
+    const expiryMs = import_sdk_core9.EXPIRY.EPHEMERAL_MS;
     const expirationTime = new Date(now.getTime() + expiryMs);
     const prepared = this.wasmBindings.prepareSession({
       abilities,
@@ -23807,7 +24692,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core8.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core9.activateSessionWithHost)(
       this.config.host,
       delegationSession.delegationHeader
     );
@@ -23837,8 +24722,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       }]);
     }
     if (this._serviceContext) {
-      const publicKV = new import_sdk_core8.KVService({ prefix: "" });
-      const publicContext = this._serviceGraph.track(new import_sdk_core8.ServiceContext({
+      const publicKV = new import_sdk_core9.KVService({ prefix: "" });
+      const publicContext = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
         invoke: this._serviceGraph.invoke,
         fetch: this._serviceGraph.fetch,
         hosts: this._serviceContext.hosts,
@@ -23990,14 +24875,14 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core8.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core9.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     const sessionExpiry = extractSiweExpiration(session.siwe);
     if (sessionExpiry !== void 0) {
       const now2 = Date.now();
       const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
       if (sessionExpiry.getTime() <= now2 + marginMs) {
-        throw new import_sdk_core8.SessionExpiredError(sessionExpiry);
+        throw new import_sdk_core9.SessionExpiredError(sessionExpiry);
       }
     }
     if (!Array.isArray(permissions) || permissions.length === 0) {
@@ -24027,31 +24912,31 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return { delegation: delegation2, prompted: true };
     }
-    const granted = this.projectSignedRecapCapabilities(session.siwe);
-    const { subset, missing } = this.signedCapabilitySubset(expandedEntries, granted);
-    if (!subset) {
-      const runtimeOperations = this.permissionEntriesToOperations(expandedEntries, session);
-      const runtimeGrant = this.findGrantForOperations(
-        runtimeOperations,
-        { excludePrimary: true }
-      );
-      if (runtimeGrant) {
-        const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
-        if (runtimeGrant.expiresAt.getTime() <= Date.now() + marginMs) {
-          throw new import_sdk_core8.SessionExpiredError(runtimeGrant.expiresAt);
-        }
-        const runtimeExpiration = runtimeGrant.expiresAt < effectiveExpiration ? runtimeGrant.expiresAt : effectiveExpiration;
-        const delegation2 = await this.createDelegationViaRuntimeGrant(
-          did,
-          expandedEntries,
-          runtimeExpiration,
-          runtimeGrant,
-          runtimeOperations,
-          onPrepared
-        );
-        return { delegation: delegation2, prompted: false };
+    const plan = this.planDerivation(
+      expandedEntries,
+      session,
+      effectiveExpiration,
+      Date.now()
+    );
+    if ("refused" in plan) {
+      if (plan.refused === "SESSION_EXPIRING") {
+        throw new import_sdk_core9.SessionExpiredError(plan.expiredAt ?? sessionExpiry ?? /* @__PURE__ */ new Date(0));
       }
-      throw new import_sdk_core8.PermissionNotInManifestError(missing, granted);
+      if (plan.refused === "CAVEATED_AUTHORITY") {
+        throw new import_sdk_core9.CaveatedDelegationUnsupportedError(plan.caveated ?? []);
+      }
+      throw new import_sdk_core9.PermissionNotInManifestError(plan.missing ?? [], plan.granted ?? []);
+    }
+    if (plan.path === "runtime") {
+      const delegation2 = await this.createDelegationViaRuntimeGrant(
+        did,
+        expandedEntries,
+        plan.effectiveExpiration,
+        plan.grant,
+        plan.operations,
+        onPrepared
+      );
+      return { delegation: delegation2, prompted: false };
     }
     const delegation = await this.createDelegationViaWasmPath(
       did,
@@ -24062,6 +24947,149 @@ var _TinyCloudNode = class _TinyCloudNode {
     );
     return { delegation, prompted: false };
   }
+  /**
+   * What `delegateTo` would select for `entries`, without signing or any
+   * network call (TC-858 plan v3 §4.3): the session path when the signed
+   * recap covers every entry, the runtime-grant path otherwise, or a
+   * refusal. A refusal of `CAVEATED_AUTHORITY` means coverage exists only
+   * through caveated branches, which the action-only WASM child-delegation
+   * boundary cannot preserve — replication never derives authority through
+   * them. `expiredAt`/`missing`/`granted`/`caveated` carry the payload
+   * `delegateTo` turns back into its typed errors.
+   * @internal
+   */
+  planDerivation(expandedEntries, session, effectiveExpiration, nowMs) {
+    const caveatedRequest = expandedEntries.filter(
+      (entry) => !(0, import_sdk_core9.recapCaveatsEqual)(entry.caveats, void 0)
+    );
+    if (caveatedRequest.length > 0) {
+      return { refused: "CAVEATED_AUTHORITY", caveated: caveatedRequest };
+    }
+    const granted = this.projectSignedRecapCapabilities(session.siwe);
+    const { subset, missing } = this.signedCapabilitySubset(expandedEntries, granted);
+    if (subset) {
+      return {
+        path: "session",
+        parentCid: session.delegationCid,
+        expiresAt: effectiveExpiration.getTime(),
+        effectiveExpiration
+      };
+    }
+    const runtimeOperations = this.permissionEntriesToOperations(expandedEntries, session);
+    const runtimeGrant = this.findGrantForOperations(
+      runtimeOperations,
+      { excludePrimary: true }
+    );
+    if (runtimeGrant) {
+      const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
+      if (runtimeGrant.expiresAt.getTime() <= nowMs + marginMs) {
+        return { refused: "SESSION_EXPIRING", expiredAt: runtimeGrant.expiresAt };
+      }
+      const caveated = this.caveatedRuntimeGrantEntries(
+        expandedEntries,
+        runtimeOperations,
+        runtimeGrant
+      );
+      if (caveated.length > 0) {
+        return { refused: "CAVEATED_AUTHORITY", caveated };
+      }
+      const runtimeExpiration = runtimeGrant.expiresAt < effectiveExpiration ? runtimeGrant.expiresAt : effectiveExpiration;
+      return {
+        path: "runtime",
+        parentCid: runtimeGrant.session.delegationCid,
+        expiresAt: runtimeExpiration.getTime(),
+        effectiveExpiration: runtimeExpiration,
+        grant: runtimeGrant,
+        operations: runtimeOperations
+      };
+    }
+    const relaxedGranted = granted.map((entry) => ({ ...entry, caveats: void 0 }));
+    const relaxedRequested = expandedEntries.map((entry) => ({ ...entry, caveats: void 0 }));
+    const relaxed = this.signedCapabilitySubset(relaxedRequested, relaxedGranted);
+    if (relaxed.subset) {
+      return {
+        refused: "CAVEATED_AUTHORITY",
+        caveated: missing.map((entry) => ({ ...entry, caveats: [{ via: "session-recap" }] }))
+      };
+    }
+    return { refused: "NOT_COVERED", missing, granted };
+  }
+  /**
+   * The plan `delegateTo(device, entries)` would follow, as a pure lookup:
+   * no WASM sign and no `POST /delegate`. Backs
+   * `ReplicationAuthority.plan` (and `mint` inside it) so a predicted
+   * parent and expiry can never disagree with what a mint would use (§4.3,
+   * §4.4). Session expiry inside the 60 s margin refuses with
+   * `SESSION_EXPIRING`; the same check delegateTo performs.
+   * @internal
+   */
+  planDelegation(entries, options) {
+    if (!Array.isArray(entries) || entries.length === 0) {
+      throw new Error("planDelegation requires a non-empty permissions array");
+    }
+    const session = this.currentTinyCloudSession();
+    if (!session) {
+      return { refused: "SESSION_EXPIRING", expiredAt: /* @__PURE__ */ new Date(0) };
+    }
+    const nowMs = Date.now();
+    const sessionExpiry = extractSiweExpiration(session.siwe);
+    if (sessionExpiry !== void 0 && sessionExpiry.getTime() <= nowMs + _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS) {
+      return { refused: "SESSION_EXPIRING", expiredAt: sessionExpiry };
+    }
+    const expandedEntries = this.expandPermissionEntries(entries);
+    const expiryMs = resolveExpiryMs(options?.expiry);
+    const expirationTime = new Date(nowMs + expiryMs);
+    const effectiveExpiration = sessionExpiry !== void 0 && sessionExpiry < expirationTime ? sessionExpiry : expirationTime;
+    return this.planDerivation(expandedEntries, session, effectiveExpiration, nowMs);
+  }
+  /**
+   * The replication entries this node's sign-in request carries for the
+   * current replication config and the signed-in or restored address: the
+   * output of the same augmentation step `resolveSignInCapabilities` runs,
+   * with the unrestricted-get and secrets gates applied (§4.1, §4.6).
+   * Empty when replication is off or no address is known. Pure.
+   */
+  replicationSignInEntries() {
+    if (this.config.replication?.enabled !== true) return [];
+    const auth = this.auth;
+    if (auth === void 0 || typeof auth.replicationSignInEntries !== "function") {
+      return [];
+    }
+    return auth.replicationSignInEntries();
+  }
+  async replicationAuthority() {
+    const { createReplicationAuthority: createReplicationAuthority2 } = await getNodeReplicationLoaders().authority();
+    return createReplicationAuthority2({
+      replicationSession: () => this.currentTinyCloudSession() ?? this.replicationDelegateSession,
+      siweExpiration: (siwe) => extractSiweExpiration(siwe),
+      planDelegation: (entries, options) => this.planDelegation(entries, options),
+      mintDelegation: async (deviceDid, entries) => {
+        const result = await this.delegateTo((0, import_sdk_core9.principalDid)(deviceDid), entries);
+        return {
+          ucan: result.delegation.delegationHeader.Authorization,
+          expiresAt: result.delegation.expiry.getTime()
+        };
+      }
+    });
+  }
+  async bindReplicationRuntime(context, session, kv, principal) {
+    if (!this.replicationRuntime) return;
+    const identityPrincipal = principal ?? (this._address === void 0 ? void 0 : (0, import_sdk_core9.pkhDid)(this._address, this._chainId));
+    if (identityPrincipal === void 0) return;
+    const runtime = await this.replicationRuntime;
+    const authority = await this.replicationAuthority();
+    await runtime.bind({
+      context,
+      session,
+      principal: identityPrincipal,
+      authority,
+      primaryKV: [{ space: session.spaceId, kv }]
+    });
+  }
+  /** Stable control facade for this node's optional replication runtime. */
+  get replication() {
+    return this.replicationControl;
+  }
   /**
    * Materialize one manifest-declared delegation using the current session key.
    * Delivery is intentionally out of band; callers decide how to transmit the
@@ -24135,7 +25163,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const spaceId = resolvedSpaces.size === 1 ? [...resolvedSpaces][0] : session.spaceId;
     const abilities = {};
     for (const entry of entries) {
-      const shortService = import_sdk_core8.SERVICE_LONG_TO_SHORT[entry.service];
+      const shortService = import_sdk_core9.SERVICE_LONG_TO_SHORT[entry.service];
       if (shortService === void 0) {
         throw new Error(
           `delegateTo: unknown service '${entry.service}' \u2014 no short-form mapping`
@@ -24192,7 +25220,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (onPrepared) {
       await onPrepared(delegation);
     }
-    const activateResult = await (0, import_sdk_core8.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core9.activateSessionWithHost)(
       this.config.host,
       delegationHeader
     );
@@ -24234,7 +25262,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (onPrepared) {
       await onPrepared(delegation);
     }
-    const activateResult = await (0, import_sdk_core8.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core9.activateSessionWithHost)(
       targetHost,
       delegationHeader
     );
@@ -24263,7 +25291,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this.wasmBindings.makeSpaceId(session.address, session.chainId, space);
   }
   expandPermissionEntries(permissions) {
-    return (0, import_sdk_core8.expandPermissionEntries)(permissions);
+    return (0, import_sdk_core9.expandPermissionEntries)(permissions);
   }
   /**
    * The current WASM child-delegation APIs accept action-only maps. Refuse any
@@ -24271,10 +25299,10 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   assertDelegationCaveatsPreservable(entries) {
     const caveated = entries.filter(
-      (entry) => !(0, import_sdk_core8.recapCaveatsEqual)(entry.caveats, void 0)
+      (entry) => !(0, import_sdk_core9.recapCaveatsEqual)(entry.caveats, void 0)
     );
     if (caveated.length > 0) {
-      throw new import_sdk_core8.CaveatedDelegationUnsupportedError(caveated);
+      throw new import_sdk_core9.CaveatedDelegationUnsupportedError(caveated);
     }
   }
   /**
@@ -24284,6 +25312,18 @@ var _TinyCloudNode = class _TinyCloudNode {
    * it only accepts action maps, so reject the selected constrained branch.
    */
   assertRuntimeGrantCaveatsPreservable(entries, requestedOperations, grant) {
+    const caveated = this.caveatedRuntimeGrantEntries(entries, requestedOperations, grant);
+    if (caveated.length > 0) {
+      throw new import_sdk_core9.CaveatedDelegationUnsupportedError(caveated);
+    }
+  }
+  /**
+   * The entries of `grant` that cover a requested operation while carrying
+   * caveats — the branches {@link assertRuntimeGrantCaveatsPreservable}
+   * rejects and {@link planDerivation} classifies as `CAVEATED_AUTHORITY`.
+   * Shared so the pure plan and the mint path can't disagree.
+   */
+  caveatedRuntimeGrantEntries(entries, requestedOperations, grant) {
     let operationIndex = 0;
     const caveated = [];
     for (const entry of entries) {
@@ -24291,7 +25331,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         const requested = requestedOperations[operationIndex++];
         if (!requested) continue;
         const constrained = grant.operations.find(
-          (granted) => this.operationCovers(granted, requested) && !(0, import_sdk_core8.recapCaveatsEqual)(granted.caveats, void 0)
+          (granted) => this.operationCovers(granted, requested) && !(0, import_sdk_core9.recapCaveatsEqual)(granted.caveats, void 0)
         );
         if (constrained) {
           caveated.push({
@@ -24302,15 +25342,13 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
       }
     }
-    if (caveated.length > 0) {
-      throw new import_sdk_core8.CaveatedDelegationUnsupportedError(caveated);
-    }
+    return caveated;
   }
   /** Reject caveated parent branches before action-only child signing. */
   assertPortableDelegationCaveatsPreservable(delegation) {
     const entries = [];
     const add3 = (service, space, path, actions, caveats) => {
-      if ((0, import_sdk_core8.recapCaveatsEqual)(caveats, void 0)) return;
+      if ((0, import_sdk_core9.recapCaveatsEqual)(caveats, void 0)) return;
       entries.push({
         service: service.startsWith("tinycloud.") ? service : `tinycloud.${service}`,
         space,
@@ -24330,11 +25368,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       add3(resource.service, resource.space, resource.path, resource.actions, resource.caveats);
     }
     if (entries.length > 0) {
-      throw new import_sdk_core8.CaveatedDelegationUnsupportedError(entries);
+      throw new import_sdk_core9.CaveatedDelegationUnsupportedError(entries);
     }
   }
   shortServiceName(service) {
-    const short = import_sdk_core8.SERVICE_LONG_TO_SHORT[service];
+    const short = import_sdk_core9.SERVICE_LONG_TO_SHORT[service];
     if (short === void 0) {
       throw new Error(
         `unknown service '${service}' \u2014 no short-form mapping`
@@ -24361,7 +25399,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return abilities;
   }
   isEncryptionPermissionEntry(entry) {
-    return entry.service === import_sdk_core8.ENCRYPTION_PERMISSION_SERVICE && this.isEncryptionNetworkOperation("encryption", entry.path, entry.space);
+    return entry.service === import_sdk_core9.ENCRYPTION_PERMISSION_SERVICE && this.isEncryptionNetworkOperation("encryption", entry.path, entry.space);
   }
   isRawRevocationPermissionEntry(entry) {
     return entry.service === "tinycloud.delegation" && entry.path === "" && entry.space?.startsWith("urn:cid:") === true && entry.actions.includes("tinycloud.delegation/revoke");
@@ -24409,7 +25447,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const missing = requested.filter((entry) => {
       const raw = this.isEncryptionPermissionEntry(entry) || this.isRawRevocationPermissionEntry(entry);
       const comparable = raw && this.isEncryptionPermissionEntry(entry) ? { ...entry, space: "encryption" } : entry;
-      return !(0, import_sdk_core8.isCapabilitySubset)([comparable], raw ? rawGranted : spaceGranted).subset;
+      return !(0, import_sdk_core9.isCapabilitySubset)([comparable], raw ? rawGranted : spaceGranted).subset;
     });
     return { subset: missing.length === 0, missing };
   }
@@ -24645,7 +25683,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (granted.service !== requested.service || !this.actionContains(granted.action, requested.action)) {
       return false;
     }
-    if (requested.caveats !== void 0 && !(0, import_sdk_core8.recapCaveatsEqual)(granted.caveats, requested.caveats)) {
+    if (requested.caveats !== void 0 && !(0, import_sdk_core9.recapCaveatsEqual)(granted.caveats, requested.caveats)) {
       return false;
     }
     if (granted.resource !== void 0 || requested.resource !== void 0) {
@@ -24667,7 +25705,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (grantedAction === requestedAction) {
       return true;
     }
-    if ((0, import_sdk_core8.isExplicitOnlyAction)(requestedAction)) {
+    if ((0, import_sdk_core9.isExplicitOnlyAction)(requestedAction)) {
       return false;
     }
     if (grantedAction.endsWith("/*")) {
@@ -24779,7 +25817,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (resolvedDelegateDID.endsWith(".eth") && this.config.ensResolver) {
       const address = await this.config.ensResolver.resolveAddress(resolvedDelegateDID);
       if (!address) throw new Error(`Could not resolve ENS name: ${resolvedDelegateDID}`);
-      resolvedDelegateDID = (0, import_sdk_core8.pkhDid)(address, 1);
+      resolvedDelegateDID = (0, import_sdk_core9.pkhDid)(address, 1);
     }
     const entries = legacyParamsToPermissionEntries(
       params.actions,
@@ -24794,7 +25832,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return result.delegation;
     } catch (err) {
-      if (err instanceof import_sdk_core8.PermissionNotInManifestError) {
+      if (err instanceof import_sdk_core9.PermissionNotInManifestError) {
       } else {
         throw err;
       }
@@ -24851,7 +25889,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core8.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core9.activateSessionWithHost)(
       this.config.host,
       delegationSession.delegationHeader
     );
@@ -24876,12 +25914,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     const hasKvActions = params.actions.some((a) => a.startsWith("tinycloud.kv/"));
     if (hasKvActions && params.includePublicSpace !== false) {
-      const publicSpaceId = (0, import_sdk_core8.makePublicSpaceId)(
+      const publicSpaceId = (0, import_sdk_core9.makePublicSpaceId)(
         this.wasmBindings.ensureEip55(session.address),
         session.chainId
       );
       const publicAbilities = {
-        kv: { "": [import_sdk_core8.KV.GET, import_sdk_core8.KV.PUT, import_sdk_core8.KV.METADATA] }
+        kv: { "": [import_sdk_core9.KV.GET, import_sdk_core9.KV.PUT, import_sdk_core9.KV.METADATA] }
       };
       const publicPrepared = this.wasmBindings.prepareSession({
         abilities: publicAbilities,
@@ -24899,7 +25937,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...publicPrepared,
         signature: publicSignature
       });
-      const publicActivateResult = await (0, import_sdk_core8.activateSessionWithHost)(
+      const publicActivateResult = await (0, import_sdk_core9.activateSessionWithHost)(
         this.config.host,
         publicSession.delegationHeader
       );
@@ -24909,7 +25947,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           delegationHeader: publicSession.delegationHeader,
           spaceId: publicSpaceId,
           path: "",
-          actions: [import_sdk_core8.KV.GET, import_sdk_core8.KV.PUT, import_sdk_core8.KV.METADATA],
+          actions: [import_sdk_core9.KV.GET, import_sdk_core9.KV.PUT, import_sdk_core9.KV.METADATA],
           disableSubDelegation: params.disableSubDelegation ?? false,
           expiry: expirationTime,
           delegateDID: params.delegateDID,
@@ -25004,7 +26042,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core8.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core9.activateSessionWithHost)(
       targetHost,
       invokerSession.delegationHeader
     );
@@ -25124,7 +26162,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core8.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core9.activateSessionWithHost)(
       targetHost,
       subDelegationSession.delegationHeader
     );
@@ -25174,12 +26212,18 @@ TinyCloudNode.registerNodeDefaults({
   createSigner: (privateKey, chainId) => new PrivateKeySigner(privateKey, chainId)
 });
 
+// src/replication/node-loader.ts
+registerReplicationLoaders({
+  runtime: () => Promise.resolve().then(() => (init_runtime(), runtime_exports)),
+  authority: () => Promise.resolve().then(() => (init_authority(), authority_exports))
+});
+
 // src/index.ts
-var import_sdk_core10 = require("@tinycloud/sdk-core");
-var import_sdk_core11 = require("@tinycloud/sdk-core");
+var import_sdk_core14 = require("@tinycloud/sdk-core");
+var import_sdk_core15 = require("@tinycloud/sdk-core");
 
 // src/storage/FileSessionStorage.ts
-var import_sdk_core9 = require("@tinycloud/sdk-core");
+var import_sdk_core12 = require("@tinycloud/sdk-core");
 var import_fs = require("fs");
 var import_path = require("path");
 var FileSessionStorage = class {
@@ -25234,7 +26278,7 @@ var FileSessionStorage = class {
     try {
       const data = (0, import_fs.readFileSync)(filePath, "utf-8");
       const parsed = JSON.parse(data);
-      const validation = (0, import_sdk_core9.validatePersistedSessionData)(parsed);
+      const validation = (0, import_sdk_core12.validatePersistedSessionData)(parsed);
       if (!validation.ok) {
         console.warn(`Invalid session data for ${address}:`, validation.error.message);
         (0, import_fs.unlinkSync)(filePath);
@@ -25343,10 +26387,6 @@ function wireOpenKeyAuthorize(openkey) {
 }
 
 // src/index.ts
-var import_sdk_core12 = require("@tinycloud/sdk-core");
-var import_sdk_core13 = require("@tinycloud/sdk-core");
-var import_sdk_core14 = require("@tinycloud/sdk-core");
-var import_sdk_core15 = require("@tinycloud/sdk-core");
 var import_sdk_core16 = require("@tinycloud/sdk-core");
 var import_sdk_core17 = require("@tinycloud/sdk-core");
 var import_sdk_core18 = require("@tinycloud/sdk-core");
@@ -25355,6 +26395,848 @@ var import_sdk_core20 = require("@tinycloud/sdk-core");
 var import_sdk_core21 = require("@tinycloud/sdk-core");
 var import_sdk_core22 = require("@tinycloud/sdk-core");
 var import_sdk_core23 = require("@tinycloud/sdk-core");
+var import_sdk_core24 = require("@tinycloud/sdk-core");
+var import_sdk_core25 = require("@tinycloud/sdk-core");
+var import_sdk_core26 = require("@tinycloud/sdk-core");
+var import_sdk_core27 = require("@tinycloud/sdk-core");
+
+// src/replication/sqlite.ts
+var import_node_crypto2 = require("crypto");
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
+var import_sdk_core13 = require("@tinycloud/sdk-core");
+var import_sdk_services4 = require("@tinycloud/sdk-services");
+init_authority();
+var ReplicaStorageError = class extends Error {
+  constructor(code, message, options) {
+    super(message);
+    this.name = "ReplicaStorageError";
+    this.code = code;
+    this.cause = options?.cause;
+  }
+};
+function storageError(code, action, error) {
+  if (error instanceof ReplicaStorageError) return error;
+  const detail = error instanceof Error ? error.message : String(error);
+  return new ReplicaStorageError(code, `${action} failed: ${detail}`, { cause: error });
+}
+function isNotFound(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+async function pathExists(path) {
+  try {
+    await (0, import_promises.stat)(path);
+    return true;
+  } catch (error) {
+    if (isNotFound(error)) return false;
+    throw storageError("STORAGE_ERROR", `Reading ${path}`, error);
+  }
+}
+function principalOf(did) {
+  return (0, import_sdk_core13.principalDid)(did);
+}
+var BASE32 = "abcdefghijklmnopqrstuvwxyz234567";
+function sha256Base32(material) {
+  const digest = (0, import_node_crypto2.createHash)("sha256").update(material, "utf8").digest();
+  let out = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of digest) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += BASE32[buffer >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += BASE32[buffer << 5 - bits & 31];
+  return out.slice(0, 26);
+}
+function partitionDirOf(root, identity) {
+  return (0, import_node_path.join)(root, sha256Base32((0, import_sdk_services4.replicationIdentityKey)(identity)));
+}
+function replicaHashOf(prefix, deviceDid) {
+  return sha256Base32(`${prefix}
+${principalOf(deviceDid)}`);
+}
+async function writeJsonAtomic(path, value, dirSync = fsyncDir) {
+  const tmp = `${path}.${(0, import_node_crypto2.randomBytes)(6).toString("hex")}.tmp`;
+  let handle;
+  try {
+    handle = await (0, import_promises.open)(tmp, "w", 384);
+    await handle.writeFile(JSON.stringify(value), "utf8");
+    await handle.sync();
+    await handle.close();
+    await (0, import_promises.rename)(tmp, path);
+    await dirSync((0, import_node_path.dirname)(path));
+    await (0, import_promises.chmod)(path, 384).catch(() => void 0);
+  } catch (error) {
+    try {
+      await handle?.close();
+    } catch {
+    }
+    await (0, import_promises.rm)(tmp, { force: true }).catch(() => void 0);
+    throw storageError("STORAGE_ERROR", `Writing ${path}`, error);
+  }
+}
+var DIR_SYNC_UNSUPPORTED = {
+  ENOTSUP: true,
+  ENOSYS: true,
+  EINVAL: true,
+  EISDIR: true,
+  EPERM: true
+};
+async function fsyncDir(dir) {
+  let handle;
+  try {
+    handle = await (0, import_promises.open)(dir, "r");
+    await handle.sync();
+  } catch (error) {
+    const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+    if (typeof code === "string" && DIR_SYNC_UNSUPPORTED[code] === true) return;
+    throw storageError("STORAGE_ERROR", `Syncing ${dir}`, error);
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+async function readJsonFile(path) {
+  try {
+    return JSON.parse(await (0, import_promises.readFile)(path, "utf8"));
+  } catch (error) {
+    if (isNotFound(error)) return void 0;
+    throw storageError("STORAGE_ERROR", `Reading ${path}`, error);
+  }
+}
+function identityRecordOf(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return void 0;
+  }
+  if (!("host" in value) || !("space" in value) || !("principal" in value) || typeof value.host !== "string" || typeof value.space !== "string" || typeof value.principal !== "string") {
+    return void 0;
+  }
+  return { host: value.host, space: value.space, principal: value.principal };
+}
+function deviceRecordOf(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return void 0;
+  }
+  if (!("did" in value) || !("jwk" in value) || typeof value.did !== "string" || value.jwk === null || typeof value.jwk !== "object") {
+    return void 0;
+  }
+  return { did: value.did, jwk: value.jwk };
+}
+function sameIdentity(a, b) {
+  try {
+    const left = (0, import_sdk_services4.canonicalReplicationIdentity)(a);
+    const right = (0, import_sdk_services4.canonicalReplicationIdentity)(b);
+    return left.host === right.host && left.space === right.space && left.principal === right.principal;
+  } catch {
+    return false;
+  }
+}
+async function ensurePartitionIdentity(dir, identity, dirSync) {
+  try {
+    await (0, import_promises.mkdir)(dir, { recursive: true, mode: 448 });
+    await (0, import_promises.chmod)(dir, 448);
+  } catch (error) {
+    throw storageError("STORAGE_ERROR", `Creating ${dir}`, error);
+  }
+  const file = (0, import_node_path.join)(dir, "identity.json");
+  const existing = await readJsonFile(file);
+  if (existing === void 0) {
+    await writeJsonAtomic(file, { v: 1, ...(0, import_sdk_services4.canonicalReplicationIdentity)(identity) }, dirSync);
+    return;
+  }
+  const record = identityRecordOf(existing);
+  if (record === void 0 || !sameIdentity(record, identity)) {
+    throw new ReplicaStorageError(
+      "STORAGE_ERROR",
+      `The partition at ${dir} belongs to a different identity.`
+    );
+  }
+}
+var PENDING_WRITE_LOCKS = /* @__PURE__ */ new Map();
+function serializePendingWrite(file, section) {
+  const tail = PENDING_WRITE_LOCKS.get(file) ?? Promise.resolve();
+  const entered = tail.then(section);
+  const next = entered.then(
+    () => void 0,
+    () => void 0
+  );
+  PENDING_WRITE_LOCKS.set(file, next);
+  void next.then(() => {
+    if (PENDING_WRITE_LOCKS.get(file) === next) PENDING_WRITE_LOCKS.delete(file);
+  });
+  return entered;
+}
+function parsePendingState(text, file, identity) {
+  let state;
+  try {
+    state = JSON.parse(text);
+  } catch (error) {
+    throw storageError("STORAGE_ERROR", `Parsing ${file}`, error);
+  }
+  if (state === null || typeof state !== "object" || !("v" in state) || state.v !== 2 || !("identity" in state) || !("committedEpoch" in state) || typeof state.committedEpoch !== "number" || !("seq" in state) || typeof state.seq !== "number" || !("records" in state) || !Array.isArray(state.records)) {
+    throw new ReplicaStorageError("STORAGE_ERROR", `Pending-write state at ${file} is corrupt.`);
+  }
+  const storedIdentity = identityRecordOf(state.identity);
+  if (storedIdentity === void 0 || !sameIdentity(storedIdentity, identity)) {
+    throw new ReplicaStorageError("STORAGE_ERROR", `Pending-write state at ${file} belongs to a different identity.`);
+  }
+  return state;
+}
+var _dir, _guard, _dirSync, _file, _FilePendingWriteStore_instances, canonicalFile_fn;
+var FilePendingWriteStore = class {
+  constructor(identity, dir, guard, dirSync) {
+    __privateAdd(this, _FilePendingWriteStore_instances);
+    this.durable = true;
+    __privateAdd(this, _dir);
+    __privateAdd(this, _guard);
+    __privateAdd(this, _dirSync);
+    __privateAdd(this, _file);
+    this.identity = identity;
+    __privateSet(this, _dir, dir);
+    __privateSet(this, _guard, guard);
+    __privateSet(this, _dirSync, dirSync);
+  }
+  async read() {
+    const file = await __privateMethod(this, _FilePendingWriteStore_instances, canonicalFile_fn).call(this);
+    let text;
+    try {
+      text = await (0, import_promises.readFile)(file, "utf8");
+    } catch (error) {
+      if (isNotFound(error)) {
+        return { v: 2, identity: this.identity, committedEpoch: 0, seq: 0, records: [] };
+      }
+      throw storageError("STORAGE_ERROR", `Reading ${file}`, error);
+    }
+    return parsePendingState(text, file, this.identity);
+  }
+  async readExisting() {
+    let file;
+    try {
+      file = (0, import_node_path.join)(await (0, import_promises.realpath)(__privateGet(this, _dir)), "pending.json");
+    } catch (error) {
+      if (isNotFound(error)) return void 0;
+      throw storageError("STORAGE_ERROR", `Resolving pending-write state in ${__privateGet(this, _dir)}`, error);
+    }
+    try {
+      const text = await (0, import_promises.readFile)(file, "utf8");
+      return parsePendingState(text, file, this.identity);
+    } catch (error) {
+      if (isNotFound(error)) return void 0;
+      if (error instanceof ReplicaStorageError) throw error;
+      throw storageError("STORAGE_ERROR", `Reading ${file}`, error);
+    }
+  }
+  async update(mutate) {
+    const file = await __privateMethod(this, _FilePendingWriteStore_instances, canonicalFile_fn).call(this);
+    return serializePendingWrite(file, async () => {
+      let currentFile;
+      try {
+        currentFile = (0, import_node_path.join)(await (0, import_promises.realpath)((0, import_node_path.dirname)(file)), (0, import_node_path.basename)(file));
+      } catch (error) {
+        throw storageError("STORAGE_ERROR", "Resolving the open pending-write partition", error);
+      }
+      if (currentFile !== file) {
+        throw new ReplicaStorageError(
+          "STORAGE_ERROR",
+          `The pending-write partition changed while open: ${(0, import_node_path.dirname)(file)}.`
+        );
+      }
+      return __privateGet(this, _guard).call(this, async () => {
+        const state = await this.read();
+        const result = mutate(state);
+        await writeJsonAtomic(file, state, __privateGet(this, _dirSync));
+        return result;
+      });
+    });
+  }
+};
+_dir = new WeakMap();
+_guard = new WeakMap();
+_dirSync = new WeakMap();
+_file = new WeakMap();
+_FilePendingWriteStore_instances = new WeakSet();
+canonicalFile_fn = async function() {
+  __privateGet(this, _file) ?? __privateSet(this, _file, (async () => {
+    await ensurePartitionIdentity(__privateGet(this, _dir), this.identity, __privateGet(this, _dirSync));
+    const file = (0, import_node_path.join)(__privateGet(this, _dir), "pending.json");
+    try {
+      return (0, import_node_path.join)(await (0, import_promises.realpath)((0, import_node_path.dirname)(file)), (0, import_node_path.basename)(file));
+    } catch (error) {
+      throw storageError("STORAGE_ERROR", `Resolving ${file}`, error);
+    }
+  })());
+  return __privateGet(this, _file);
+};
+async function loadOrCreateDevice(idDir, guard, createDevice, dirSync) {
+  return guard(async () => {
+    try {
+      await (0, import_promises.mkdir)(idDir, { recursive: true, mode: 448 });
+      await (0, import_promises.chmod)(idDir, 448);
+    } catch (error) {
+      throw storageError("STORAGE_ERROR", `Creating ${idDir}`, error);
+    }
+    const file = (0, import_node_path.join)(idDir, "device.jwk");
+    const existing = await readJsonFile(file);
+    if (existing !== void 0) {
+      const device2 = deviceRecordOf(existing);
+      if (device2 === void 0) {
+        throw new ReplicaStorageError(
+          "STORAGE_ERROR",
+          `The replica device key at ${file} is unreadable; remove the partition or restore it.`
+        );
+      }
+      return device2;
+    }
+    const device = await createDevice();
+    await writeJsonAtomic(file, { did: device.did, jwk: device.jwk }, dirSync);
+    return device;
+  });
+}
+async function createDeviceKey() {
+  const wasm = await import("@tinycloud/node-sdk-wasm");
+  const manager = new wasm.TCWSessionManager();
+  const keyId = manager.createSessionKey("replica-device") ?? "replica-device";
+  const jwkText = manager.jwk(keyId);
+  if (jwkText === null || jwkText === void 0) {
+    throw new ReplicaStorageError(
+      "STORAGE_ERROR",
+      "The session manager returned no JWK for the replica device key."
+    );
+  }
+  return { did: manager.getDID(keyId), jwk: JSON.parse(jwkText) };
+}
+var SYNC_LEASE_TTL_MS = 12e4;
+var FENCE_FILE = "fence.json";
+async function readFence(replicaDir) {
+  const fence = await readJsonFile((0, import_node_path.join)(replicaDir, FENCE_FILE));
+  return typeof fence === "object" && fence !== null && "syncedThroughEpoch" in fence && typeof fence.syncedThroughEpoch === "number" ? fence.syncedThroughEpoch : 0;
+}
+function newestGrantInfo(replica, record, pending, spec) {
+  if (record === null) return null;
+  const parsed = replica.parseUcanGrant(record.bytes);
+  return {
+    cid: record.cid,
+    parentCid: parsed.prf[0] ?? null,
+    expiresAt: record.expiresAt === null ? null : record.expiresAt * 1e3,
+    state: pending !== null && record === pending ? "pending" : "active",
+    unconstrained: ucanAttUnconstrainedFor(parsed.att, spec.space, spec.prefix)
+  };
+}
+var _device, _store, _replicaDir, _replica, _guard2, _dirSync2, _generation, _ino, _transportOverride, _closed, _inFlight, _transportFactory, _SqliteReplicaHandle_instances, assertOpen_fn, assertLive_fn, transports_fn;
+var SqliteReplicaHandle = class {
+  constructor(input) {
+    __privateAdd(this, _SqliteReplicaHandle_instances);
+    __privateAdd(this, _device);
+    __privateAdd(this, _store);
+    __privateAdd(this, _replicaDir);
+    __privateAdd(this, _replica);
+    __privateAdd(this, _guard2);
+    __privateAdd(this, _dirSync2);
+    /** The replica row generation this handle opened under — the durable fence a purge commits past (browser-parity wipe). */
+    __privateAdd(this, _generation);
+    /** The inode of `replica.db` at open — a directory recreated in place is a different replica. */
+    __privateAdd(this, _ino);
+    __privateAdd(this, _transportOverride);
+    __privateAdd(this, _closed, false);
+    __privateAdd(this, _inFlight, /* @__PURE__ */ new Set());
+    __privateAdd(this, _transportFactory);
+    this.spec = input.spec;
+    __privateSet(this, _device, input.device);
+    this.deviceDid = input.device.did;
+    __privateSet(this, _store, input.store);
+    __privateSet(this, _replicaDir, input.replicaDir);
+    __privateSet(this, _replica, input.replica);
+    __privateSet(this, _guard2, input.guard);
+    __privateSet(this, _transportOverride, input.transportFor);
+    __privateSet(this, _dirSync2, input.dirSync);
+    __privateSet(this, _generation, input.generation);
+    __privateSet(this, _ino, input.ino);
+  }
+  async get(key2) {
+    await __privateMethod(this, _SqliteReplicaHandle_instances, assertLive_fn).call(this);
+    const result = await new (__privateGet(this, _replica)).Replica({ store: __privateGet(this, _store) }).get(key2);
+    const meta = {
+      asOf: result.meta.asOf,
+      coverage: result.meta.coverage,
+      authority: result.meta.authority,
+      syncedThroughEpoch: await readFence(__privateGet(this, _replicaDir))
+    };
+    switch (result.status) {
+      case "present":
+        return {
+          status: "present",
+          key: result.key,
+          value: result.value,
+          etag: result.etag,
+          metadata: result.metadata,
+          meta
+        };
+      case "content_missing":
+        return {
+          status: "content_missing",
+          key: result.key,
+          etag: result.etag,
+          metadata: result.metadata,
+          meta
+        };
+      default:
+        return { status: result.status, key: result.key, meta };
+    }
+  }
+  async list(options) {
+    await __privateMethod(this, _SqliteReplicaHandle_instances, assertLive_fn).call(this);
+    const result = await new (__privateGet(this, _replica)).Replica({ store: __privateGet(this, _store) }).list({
+      prefix: options.prefix,
+      ...options.after === void 0 ? {} : { after: options.after },
+      ...options.limit === void 0 ? {} : { limit: options.limit }
+    });
+    return {
+      keys: result.entries.map((entry) => entry.key),
+      meta: {
+        asOf: result.meta.asOf,
+        coverage: result.meta.coverage,
+        authority: result.meta.authority,
+        syncedThroughEpoch: await readFence(__privateGet(this, _replicaDir))
+      }
+    };
+  }
+  /**
+   * The newest installed grant — the pending one when a not-yet-promoted
+   * install exists — with `parentCid` = signed `prf[0]` and `unconstrained`
+   * computed from the signed `att` (replica's own grantCovers ignores
+   * caveats, so the adapter computes it, §2.1). A constrained installed
+   * grant is still reported (unconstrained: false) and never reused.
+   */
+  async grant() {
+    await __privateMethod(this, _SqliteReplicaHandle_instances, assertLive_fn).call(this);
+    const state = await __privateGet(this, _store).open();
+    if (state === null) return null;
+    return newestGrantInfo(
+      __privateGet(this, _replica),
+      state.pendingGrant ?? state.grant,
+      state.pendingGrant,
+      this.spec
+    );
+  }
+  async installGrant(ucan) {
+    await __privateMethod(this, _SqliteReplicaHandle_instances, assertLive_fn).call(this);
+    const parsed = __privateGet(this, _replica).parseUcanGrant(ucan);
+    const state = await __privateGet(this, _store).open();
+    if (state === null) {
+      throw new (__privateGet(this, _replica)).ReplicaError(
+        __privateGet(this, _replica).ReplicaErrorCode.NOT_FOUND,
+        "The replica has not been created."
+      );
+    }
+    __privateGet(this, _replica).assertGrantInstallable(parsed, {
+      deviceDid: principalOf(__privateGet(this, _device).did),
+      space: this.spec.space,
+      prefix: this.spec.prefix,
+      now: Date.now()
+    });
+    if (!ucanAttUnconstrainedFor(parsed.att, this.spec.space, this.spec.prefix)) {
+      throw new (__privateGet(this, _replica)).ReplicaError(
+        __privateGet(this, _replica).ReplicaErrorCode.GRANT_NOT_COVERING,
+        "The grant's get or sync coverage carries caveats; re-mint instead of installing it."
+      );
+    }
+    await __privateGet(this, _store).installGrant(parsed);
+    return newestGrantInfo(__privateGet(this, _replica), parsed, parsed, this.spec);
+  }
+  async sync(options) {
+    await __privateMethod(this, _SqliteReplicaHandle_instances, assertLive_fn).call(this);
+    const transportFor = await __privateMethod(this, _SqliteReplicaHandle_instances, transports_fn).call(this);
+    const abort = new AbortController();
+    options.signal.throwIfAborted();
+    const onAbort = () => abort.abort(options.signal.reason);
+    options.signal.addEventListener("abort", onAbort, { once: true });
+    const engine = new (__privateGet(this, _replica)).Replica({
+      store: __privateGet(this, _store),
+      transportFor
+    });
+    const running = engine.sync({ signal: abort.signal });
+    const registration = { promise: running, abort: () => abort.abort() };
+    __privateGet(this, _inFlight).add(registration);
+    try {
+      const report = await running;
+      await __privateGet(this, _guard2).call(this, () => writeJsonAtomic(
+        (0, import_node_path.join)(__privateGet(this, _replicaDir), FENCE_FILE),
+        { v: 1, syncedThroughEpoch: options.syncStartEpoch },
+        __privateGet(this, _dirSync2)
+      ));
+      return {
+        status: "synced",
+        pages: report.pages,
+        changes: report.changes,
+        deleted: report.deleted,
+        fetched: report.fetched,
+        contentMissing: report.contentMissing,
+        coverage: report.coverage,
+        syncedThroughEpoch: options.syncStartEpoch
+      };
+    } catch (error) {
+      if (__privateGet(this, _replica).isReplicaError(error, __privateGet(this, _replica).ReplicaErrorCode.BUSY)) {
+        return { status: "busy" };
+      }
+      throw error;
+    } finally {
+      __privateGet(this, _inFlight).delete(registration);
+      options.signal.removeEventListener("abort", onAbort);
+    }
+  }
+  async status() {
+    await __privateMethod(this, _SqliteReplicaHandle_instances, assertLive_fn).call(this);
+    const engine = new (__privateGet(this, _replica)).Replica({ store: __privateGet(this, _store) });
+    const status = await engine.status();
+    const syncedThroughEpoch = await readFence(__privateGet(this, _replicaDir));
+    const state = await __privateGet(this, _store).open();
+    const grant = state === null ? null : newestGrantInfo(
+      __privateGet(this, _replica),
+      state.pendingGrant ?? state.grant,
+      state.pendingGrant,
+      this.spec
+    );
+    return {
+      coverage: status.coverage,
+      lastSyncAt: status.lastSyncAt,
+      syncedThroughEpoch,
+      authority: { state: status.authority.state, expiresAt: status.authority.expiresAt },
+      grant,
+      counts: status.counts,
+      bytes: status.bytes,
+      lastError: status.lastError
+    };
+  }
+  async close() {
+    if (__privateGet(this, _closed)) return;
+    __privateSet(this, _closed, true);
+    for (const sync of __privateGet(this, _inFlight)) sync.abort();
+    await Promise.allSettled([...__privateGet(this, _inFlight)].map((sync) => sync.promise));
+    await __privateGet(this, _store).close();
+  }
+};
+_device = new WeakMap();
+_store = new WeakMap();
+_replicaDir = new WeakMap();
+_replica = new WeakMap();
+_guard2 = new WeakMap();
+_dirSync2 = new WeakMap();
+_generation = new WeakMap();
+_ino = new WeakMap();
+_transportOverride = new WeakMap();
+_closed = new WeakMap();
+_inFlight = new WeakMap();
+_transportFactory = new WeakMap();
+_SqliteReplicaHandle_instances = new WeakSet();
+assertOpen_fn = function() {
+  if (__privateGet(this, _closed)) {
+    throw new (__privateGet(this, _replica)).ReplicaError(
+      __privateGet(this, _replica).ReplicaErrorCode.CLOSED,
+      "The replica handle is closed."
+    );
+  }
+};
+assertLive_fn = async function() {
+  __privateMethod(this, _SqliteReplicaHandle_instances, assertOpen_fn).call(this);
+  try {
+    const stats = await (0, import_promises.stat)((0, import_node_path.join)(__privateGet(this, _replicaDir), "replica.db"));
+    if (__privateGet(this, _ino) !== void 0 && stats.ino !== __privateGet(this, _ino)) {
+      throw new (__privateGet(this, _replica)).ReplicaError(
+        __privateGet(this, _replica).ReplicaErrorCode.RESET_REQUIRED,
+        "The replica was recreated; open it again to continue."
+      );
+    }
+  } catch (error) {
+    if (isNotFound(error)) {
+      throw new (__privateGet(this, _replica)).ReplicaError(
+        __privateGet(this, _replica).ReplicaErrorCode.RESET_REQUIRED,
+        "The replica was purged; open it again to continue."
+      );
+    }
+    throw error;
+  }
+  const state = await __privateGet(this, _store).open();
+  if (state !== null && state.generation !== __privateGet(this, _generation)) {
+    throw new (__privateGet(this, _replica)).ReplicaError(
+      __privateGet(this, _replica).ReplicaErrorCode.RESET_REQUIRED,
+      "The replica was purged or reopened; open it again to continue."
+    );
+  }
+};
+transports_fn = async function() {
+  if (__privateGet(this, _transportOverride) !== void 0) {
+    const override = __privateGet(this, _transportOverride);
+    const spec = this.spec;
+    const device = __privateGet(this, _device);
+    return (grant) => override(grant, spec, device);
+  }
+  __privateGet(this, _transportFactory) ?? __privateSet(this, _transportFactory, (async () => {
+    const wasm = await import("@tinycloud/node-sdk-wasm");
+    const kvSyncTransport = __privateGet(this, _replica).kvSyncTransport;
+    const spec = this.spec;
+    const device = __privateGet(this, _device);
+    const fetch2 = spec.fetch ?? globalThis.fetch.bind(globalThis);
+    return (grant) => {
+      const context = new import_sdk_core13.ServiceContext({
+        invoke: wasm.invoke,
+        invokeAny: wasm.invokeAny,
+        fetch: fetch2,
+        hosts: [spec.identity.host]
+      });
+      const kv = new import_sdk_core13.KVService({});
+      kv.initialize(context);
+      context.registerService("kv", kv);
+      context.setSession({
+        delegationHeader: { Authorization: new TextDecoder().decode(grant.bytes) },
+        delegationCid: grant.cid,
+        spaceId: spec.space,
+        verificationMethod: device.did,
+        jwk: device.jwk
+      });
+      return kvSyncTransport(kv);
+    };
+  })());
+  return __privateGet(this, _transportFactory);
+};
+function createSqliteReplicaStorage(options) {
+  const root = options.dir;
+  const guard = options.guard ?? ((section) => section());
+  const createDevice = options.createDevice ?? createDeviceKey;
+  async function openHandle(spec) {
+    const [replica, sqlite] = await Promise.all([
+      // @ts-ignore — TS2307 when replica's dist is absent (CI builds node-sdk first).
+      import("@tinycloud/replica"),
+      // @ts-ignore — same as above.
+      import("@tinycloud/replica/sqlite")
+    ]);
+    if ((0, import_sdk_services4.requiresSecretsOptIn)(spec.space, spec.prefix) && spec.allowSecrets !== true) {
+      throw new replica.ReplicaError(
+        replica.ReplicaErrorCode.SECRETS_OPT_IN_REQUIRED,
+        `Replicating ${spec.space}/kv/${spec.prefix} copies secret material to disk; pass allowSecrets to opt in.`
+      );
+    }
+    const idDir = partitionDirOf(root, spec.identity);
+    await ensurePartitionIdentity(idDir, spec.identity, options.dirSync);
+    const createdDevice = spec.device ?? await loadOrCreateDevice(idDir, guard, createDevice, options.dirSync);
+    const device = { ...createdDevice, did: principalOf(createdDevice.did) };
+    const replicaHash = replicaHashOf(spec.prefix, device.did);
+    const replicaDir = (0, import_node_path.join)(idDir, "replicas", replicaHash);
+    const store = await sqlite.SqliteReplicaStore.open(replicaDir, {
+      create: true,
+      guard
+    });
+    let generation;
+    try {
+      try {
+        await store.init({
+          name: spec.prefix.replace(/\/+$/, "") || "replica",
+          replicaId: replicaHash,
+          host: spec.identity.host,
+          space: spec.space,
+          prefix: spec.prefix,
+          deviceDid: device.did,
+          allowSecrets: spec.allowSecrets,
+          localReadPolicy: "whileGrantValid",
+          retentionGrantCid: null
+        });
+      } catch (error) {
+        if (!replica.isReplicaError(error, replica.ReplicaErrorCode.CONFIG_MISMATCH)) {
+          throw error;
+        }
+      }
+      const state = await store.open();
+      if (state === null) {
+        throw new replica.ReplicaError(
+          replica.ReplicaErrorCode.NOT_FOUND,
+          "The replica row vanished during init."
+        );
+      }
+      const config = state.config;
+      if (config.host !== spec.identity.host || config.space !== spec.space || config.prefix !== spec.prefix) {
+        throw new replica.ReplicaError(
+          replica.ReplicaErrorCode.CONFIG_MISMATCH,
+          `This replica follows ${config.host} ${config.space}/kv/${config.prefix}, not ${spec.identity.host} ${spec.space}/kv/${spec.prefix}.`
+        );
+      }
+      if (principalOf(config.deviceDid) !== principalOf(device.did)) {
+        throw new replica.ReplicaError(
+          replica.ReplicaErrorCode.CONFIG_MISMATCH,
+          "The stored replica belongs to a different device key; purge the partition to rekey."
+        );
+      }
+      generation = state.generation;
+    } catch (error) {
+      await store.close().catch(() => void 0);
+      throw error;
+    }
+    let ino;
+    try {
+      ino = (await (0, import_promises.stat)((0, import_node_path.join)(replicaDir, "replica.db"))).ino;
+    } catch (error) {
+      if (!isNotFound(error)) throw error;
+    }
+    return new SqliteReplicaHandle({
+      spec,
+      device,
+      store,
+      replicaDir,
+      replica,
+      guard,
+      transportFor: options.transportFor,
+      dirSync: options.dirSync,
+      generation,
+      ino
+    });
+  }
+  async function inspectStatus(spec, { signal }) {
+    const checkAbort = () => {
+      if (signal.aborted) throw signal.reason ?? Object.assign(new Error("Replica status inspection was aborted"), { code: "ABORTED" });
+    };
+    checkAbort();
+    const idDir = partitionDirOf(root, spec.identity);
+    if (!await pathExists(idDir)) return void 0;
+    checkAbort();
+    const identityFile = (0, import_node_path.join)(idDir, "identity.json");
+    const storedIdentity = identityRecordOf(await readJsonFile(identityFile));
+    if (storedIdentity === void 0 || !sameIdentity(storedIdentity, spec.identity)) {
+      throw new ReplicaStorageError("STORAGE_ERROR", `The partition at ${idDir} belongs to a different identity or has no identity record.`);
+    }
+    checkAbort();
+    let device = spec.device;
+    if (device === void 0) {
+      const deviceFile = (0, import_node_path.join)(idDir, "device.jwk");
+      const storedDevice = await readJsonFile(deviceFile);
+      if (storedDevice === void 0) return void 0;
+      device = deviceRecordOf(storedDevice);
+      if (device === void 0) throw new ReplicaStorageError("STORAGE_ERROR", `The replica device key at ${deviceFile} is unreadable.`);
+    }
+    checkAbort();
+    const replicaDir = (0, import_node_path.join)(idDir, "replicas", replicaHashOf(spec.prefix, device.did));
+    if (!await pathExists(replicaDir)) return void 0;
+    checkAbort();
+    const [replica, sqlite] = await Promise.all([
+      // @ts-ignore — TS2307 when replica's dist is absent (CI builds node-sdk first).
+      import("@tinycloud/replica"),
+      // @ts-ignore — same as above.
+      import("@tinycloud/replica/sqlite")
+    ]);
+    checkAbort();
+    const inspected = await sqlite.SqliteReplicaStore.inspect(replicaDir, { signal });
+    checkAbort();
+    if (inspected === null) return void 0;
+    const { state, status } = inspected;
+    if (state.config.host !== spec.identity.host || state.config.space !== spec.space || state.config.prefix !== spec.prefix || principalOf(state.config.deviceDid) !== principalOf(device.did)) {
+      throw new ReplicaStorageError("STORAGE_ERROR", `The replica at ${replicaDir} does not match the requested identity, space, prefix, or device.`);
+    }
+    const syncedThroughEpoch = await readFence(replicaDir);
+    checkAbort();
+    return {
+      coverage: status.coverage,
+      lastSyncAt: status.lastSyncAt,
+      syncedThroughEpoch,
+      authority: { state: status.authority.state, expiresAt: status.authority.expiresAt },
+      grant: newestGrantInfo(replica, state.pendingGrant ?? state.grant, state.pendingGrant, spec),
+      counts: status.counts,
+      bytes: status.bytes,
+      lastError: status.lastError
+    };
+  }
+  async function purgePartition(target) {
+    const [replica, sqlite] = await Promise.all([
+      // @ts-ignore — TS2307 when replica's dist is absent (CI builds node-sdk first).
+      import("@tinycloud/replica"),
+      // @ts-ignore — same as above.
+      import("@tinycloud/replica/sqlite")
+    ]);
+    const idDir = partitionDirOf(root, target.identity);
+    if (!await pathExists(idDir)) return;
+    const deviceDids = [];
+    const deviceFile = (0, import_node_path.join)(idDir, "device.jwk");
+    const stored = await readJsonFile(deviceFile);
+    if (stored !== void 0) {
+      const device = deviceRecordOf(stored);
+      if (device === void 0) {
+        throw new ReplicaStorageError(
+          "STORAGE_ERROR",
+          `The replica device key at ${deviceFile} is unreadable.`
+        );
+      }
+      deviceDids.push(device.did);
+    }
+    if (target.sessionDeviceDid !== void 0) deviceDids.push(target.sessionDeviceDid);
+    const devices = [...new Map(deviceDids.map((did) => [principalOf(did), did])).values()];
+    let firstError;
+    for (const deviceDid of devices) {
+      const replicaDir = (0, import_node_path.join)(idDir, "replicas", replicaHashOf(target.prefix, deviceDid));
+      if (!await pathExists(replicaDir)) continue;
+      try {
+        let store;
+        try {
+          store = await sqlite.SqliteReplicaStore.open(replicaDir, { create: false, guard });
+        } catch (error) {
+          if (replica.isReplicaError(error, replica.ReplicaErrorCode.NOT_FOUND)) {
+            await guard(() => (0, import_promises.rm)(replicaDir, { recursive: true, force: true }));
+            continue;
+          }
+          throw error;
+        }
+        try {
+          const state = await store.open();
+          if (state === null) {
+            await store.close().catch(() => void 0);
+            await guard(() => (0, import_promises.rm)(replicaDir, { recursive: true, force: true }));
+            continue;
+          }
+          const lease = await store.acquireSyncLease(SYNC_LEASE_TTL_MS);
+          if (lease === null) {
+            throw new replica.ReplicaError(
+              replica.ReplicaErrorCode.BUSY,
+              "Another process holds this replica's sync lease."
+            );
+          }
+          try {
+            if (state.revoked === null) {
+              await store.reset(lease, "purged");
+            }
+            await store.destroy(lease);
+          } finally {
+            await store.releaseLease(lease).catch(() => void 0);
+          }
+        } finally {
+          await store.close().catch(() => void 0);
+        }
+      } catch (error) {
+        firstError ?? (firstError = error);
+      }
+    }
+    if (firstError !== void 0) throw firstError;
+  }
+  return {
+    kind: "sqlite",
+    open: openHandle,
+    inspectStatus,
+    purge: purgePartition,
+    // Always the durable partitioned file store (review): the runtime
+    // must never fall back to volatile in-memory pending state — a
+    // restart that lost ambiguous write records would serve stale data.
+    // Without a guard the file store still durably serializes each update;
+    // the guard only adds cross-process read-modify-write exclusion.
+    pendingWrites(identity) {
+      return new FilePendingWriteStore(
+        identity,
+        partitionDirOf(root, identity),
+        guard,
+        options.dirSync
+      );
+    }
+  };
+}
+function sqliteReplicaStorage(options) {
+  return createSqliteReplicaStorage(options);
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACCEPTED_MARKER_VERSIONS,
@@ -25394,6 +27276,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   IdentityParseError,
   InvalidRestoredSessionError,
   KVService,
+  MAX_SECRET_SCOPE_LENGTH,
   ManifestValidationError,
   MemorySessionStorage,
   NETWORK_NAME_PATTERN,
@@ -25407,6 +27290,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   RUNTIME_DELEGATION_REJECTIONS,
   RuntimeDelegationRejectedError,
   SECRET_NAME_RE,
+  SECRET_SCOPE_RE,
   SQLAction,
   SQLService,
   STORAGE_FULL_MESSAGE,
@@ -25419,6 +27303,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   Space,
   SpaceErrorCodes,
   SpaceService,
+  TC832_RESERVED_SCOPES,
   TinyCloud,
   TinyCloudDebugLogger,
   TinyCloudNode,
@@ -25432,6 +27317,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   activateCompactRuntimeDelegation,
   activateValidatedRuntimeDelegation,
   addressStorageKey,
+  appSecretScope,
   buildCanonicalDecryptRequest,
   buildDecryptAttenuation,
   buildDecryptFacts,
@@ -25507,6 +27393,7 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation,
   signedCompactUcanExpiry,
+  sqliteReplicaStorage,
   tinyCloudDebugLogger,
   validateEnvelope,
   validateManifest,