@tinycloud/node-sdk 3.4.0 → 3.5.0-beta.0

package/dist/core.d.cts

@@ -1,11 +1,11 @@
 import { ReplicationOptions } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
 import { _ as __gated_network } from './gated-network-BEF2XSTC.cjs';
-import { _ as __authority } from './authority-BO2VqGnD.cjs';
+import { _ as __authority } from './authority-BgZpUFss.cjs';
 import { _ as __runtime } from './runtime-D1o9Eybt.cjs';
 import { ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
 export { F as FileSessionStorage, M as MemorySessionStorage, W as WasmKeyProvider, a as WasmKeyProviderConfig, c as createWasmKeyProvider } from './WasmKeyProvider-5Ee7fcAw.cjs';
-export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, l as NodeUserAuthorizationConfig, p as OwnerDelegationReceipt, P as PortableDelegation, u as RuntimePermissionGrantOptions, S as SecretPermissionHint, v as SecretReadInput, w as SecretReadResult, y as SignStrategy, T as TinyCloudNode, z as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, F as UnifiedOwnerRootReceipt, G as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, J as activateCompactRuntimeDelegation, L as defaultSignStrategy, M as deserializeDelegation, W as serializeDelegation } from './TinyCloudNode-DeV-L_14.cjs';
+export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, l as NodeUserAuthorizationConfig, p as OwnerDelegationReceipt, P as PortableDelegation, u as RuntimePermissionGrantOptions, S as SecretPermissionHint, v as SecretReadInput, w as SecretReadResult, y as SignStrategy, T as TinyCloudNode, z as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, F as UnifiedOwnerRootReceipt, G as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, J as activateCompactRuntimeDelegation, L as defaultSignStrategy, M as deserializeDelegation, W as serializeDelegation } from './TinyCloudNode-N4mfZI_k.cjs';
 import '@tinycloud/sdk-services';
 import 'events';
 

package/dist/core.d.ts

@@ -1,11 +1,11 @@
 import { ReplicationOptions } from '@tinycloud/sdk-core';
 export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AccountApplication, AccountApplicationListOptions, AccountApplicationRegisterOptions, AccountDelegation, AccountDelegationListOptions, AccountDelegationRevokeOptions, AccountIndexEnsureResult, AccountIndexRebuildResult, AccountIndexStatus, AccountIndexedReadOptions, AccountService, AccountServiceConfig, AccountSpace, AccountSpaceListOptions, AccountStatus, AuthorityRefusal, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CanonicalAddress, CanonicalParsedNetworkId, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DataVaultConfig, DataVaultService, DatabaseHandle, DelegateReceivedShareParams, DelegatedShareAccess, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DidCacheKeyOptions, DidEqualsOptions, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISecretsService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IdentityParseError, IngestOptions, InvokeFunction, JWK, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVListPage, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVService, KVServiceConfig, KVSignedReadUrlResponse, KeyInfo, KeyProvider, KeyType, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestSecretActions, ManifestValidationError, OpenKeyCallbackStrategy, OpenKeySigningRequestBody, OpenKeySigningResponseBody, OpenKeySigningStrategyOptions, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PinnedKey, PkhDidParts, PrefixedKVService, ProtocolMismatchError, PurgeTarget, QueryOptions, QueryResponse, ReceiveOptions, RegisterBatchSuccess, RegisterPolicyV3Input, RegisterPolicyV3Receipt, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedCapabilities, ResolvedDelegate, ResolvedReplicationOptions, ResolvedSecretPath, ResourceCapability, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloud, TinyCloudConfig, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, TinyCloudSession, UnsupportedFeatureError, VAULT_PERMISSION_SERVICE, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, addressStorageKey, buildSpaceUri, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeSecretScope, checkNodeInfo, clearTinyCloudDebugLogs, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, didCacheKey, didEquals, disableTinyCloudDebug, enableTinyCloudDebug, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isCapabilitySubset, isEvmAddress, loadManifest, makePkhSpaceId, makePublicSpaceId, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseSecretCatalogKey, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveManifest, resolveSecretListPrefix, resolveSecretPath, resourceCapabilitiesToSpaceAbilitiesMap, tinyCloudDebugLogger, validateManifest } from '@tinycloud/sdk-core';
 import { _ as __gated_network } from './gated-network-BEF2XSTC.js';
-import { _ as __authority } from './authority-CtsxSAoP.js';
+import { _ as __authority } from './authority-C670-9su.js';
 import { _ as __runtime } from './runtime-v62FzQHz.js';
 import { ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
 export { F as FileSessionStorage, M as MemorySessionStorage, W as WasmKeyProvider, a as WasmKeyProviderConfig, c as createWasmKeyProvider } from './WasmKeyProvider-5Ee7fcAw.js';
-export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, l as NodeUserAuthorizationConfig, p as OwnerDelegationReceipt, P as PortableDelegation, u as RuntimePermissionGrantOptions, S as SecretPermissionHint, v as SecretReadInput, w as SecretReadResult, y as SignStrategy, T as TinyCloudNode, z as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, F as UnifiedOwnerRootReceipt, G as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, J as activateCompactRuntimeDelegation, L as defaultSignStrategy, M as deserializeDelegation, W as serializeDelegation } from './TinyCloudNode-DeV-L_14.js';
+export { e as BootstrapWarning, C as CompactRuntimeDelegationInput, f as CreateOwnerDelegationParams, D as DelegateToOptions, g as DelegateToResult, h as DelegatedAccess, E as EnsureEncryptionNetworkOptions, I as InvalidRestoredSessionError, N as NodeEventEmitterStrategy, j as NodeUserAuthorization, l as NodeUserAuthorizationConfig, p as OwnerDelegationReceipt, P as PortableDelegation, u as RuntimePermissionGrantOptions, S as SecretPermissionHint, v as SecretReadInput, w as SecretReadResult, y as SignStrategy, T as TinyCloudNode, z as TinyCloudNodeConfig, U as UnifiedOwnerRootInput, F as UnifiedOwnerRootReceipt, G as UnsupportedSessionRestoreError, V as ValidatedRuntimeDelegation, J as activateCompactRuntimeDelegation, L as defaultSignStrategy, M as deserializeDelegation, W as serializeDelegation } from './TinyCloudNode-N4mfZI_k.js';
 import '@tinycloud/sdk-services';
 import 'events';
 

package/dist/core.js

@@ -2053,6 +2053,173 @@ var NodeUserAuthorization = class {
   }
 };
 
+// src/recordingServiceContext.ts
+import {
+  ServiceContext
+} from "@tinycloud/sdk-services";
+import {
+  buildRequestEvent,
+  invocationMetaOf,
+  requestBytesOf
+} from "@tinycloud/sdk-services/telemetry/requestLog";
+
+// src/recordingRegistry.ts
+var unrecordedFetches = /* @__PURE__ */ new WeakMap();
+function registerRecording(context, unrecordedFetch) {
+  unrecordedFetches.set(context, unrecordedFetch);
+}
+function unrecordedFetchOf(context) {
+  const unrecordedFetch = unrecordedFetches.get(context);
+  return unrecordedFetch ? unrecordedFetch() : context.fetch;
+}
+
+// src/recordingServiceContext.ts
+var SYNC_ABILITY = "tinycloud.kv/sync";
+var INFO_PATH = "/info";
+function outcomeCodeOf(response) {
+  return response === void 0 ? "ERROR" : response.ok ? "ok" : `HTTP_${response.status}`;
+}
+function replicationOp(url, meta) {
+  if (meta !== void 0) return meta.action === SYNC_ABILITY ? `${meta.service}/sync` : void 0;
+  return isInfoUrl(url) ? "sync/info" : void 0;
+}
+function isInfoUrl(url) {
+  try {
+    return new URL(url).pathname.replace(/\/+$/, "") === INFO_PATH;
+  } catch {
+    return false;
+  }
+}
+function replicationEvent(sample, op) {
+  return buildRequestEvent({
+    service: "sync",
+    op,
+    url: sample.url,
+    bytes: requestBytesOf(sample.init?.body, sample.response?.headers.get("content-length")),
+    durationMs: performance.now() - sample.clock,
+    attempts: sample.attempts ?? 1,
+    ok: sample.response?.ok === true,
+    code: outcomeCodeOf(sample.response),
+    at: sample.at
+  });
+}
+function createServiceContext(config) {
+  const { requestSink, ...base } = config;
+  return requestSink === void 0 ? new ServiceContext(base) : new RecordingServiceContext(base, requestSink);
+}
+var RecordingServiceContext = class extends ServiceContext {
+  constructor(config, sink) {
+    const pending = {};
+    super({
+      ...config,
+      invoke: rememberInvoke(config.invoke, sink, pending),
+      invokeAny: config.invokeAny ? rememberInvokeAny(config.invokeAny, sink, pending) : void 0
+    });
+    this.requestSink = sink;
+    this.pending = pending;
+    registerRecording(this, () => this.unrecordedFetch);
+  }
+  /** Per-call recording; `_fetch` is read at access time, so overrides apply. */
+  get fetch() {
+    const raw = super.fetch;
+    return (url, init) => this.recordCall(raw, url, init);
+  }
+  /** Transport without per-call recording. */
+  get unrecordedFetch() {
+    return super.fetch;
+  }
+  /**
+   * One event per logical request. The first resolved attempt's init is the logged request and
+   * `attempts` counts resolved builds. A retired context throws before the first build and records
+   * nothing, as master does.
+   */
+  async invokeWithRetry(url, build) {
+    const at = Date.now();
+    const clock = performance.now();
+    let reached = false;
+    let attempts = 0;
+    let first;
+    let firstMeta;
+    let response;
+    const attempt = async () => {
+      reached = true;
+      this.pending.meta = void 0;
+      const built = build();
+      const meta = this.pending.meta;
+      const init = await built;
+      attempts += 1;
+      if (first === void 0) {
+        first = init;
+        firstMeta = meta;
+      }
+      return init;
+    };
+    try {
+      response = await super.invokeWithRetry(url, attempt);
+      return response;
+    } finally {
+      if (reached) {
+        this.observeAttempt({ url, init: first, response, meta: firstMeta, at, clock, attempts });
+      }
+    }
+  }
+  async recordCall(fetchFn, url, init) {
+    const at = Date.now();
+    const clock = performance.now();
+    let response;
+    try {
+      response = await fetchFn(url, init);
+      return response;
+    } finally {
+      this.observeAttempt({ url, init, response, at, clock });
+    }
+  }
+  observeAttempt(sample) {
+    try {
+      const replication = replicationOp(sample.url, sample.meta ?? invocationMetaOf(sample.init?.headers));
+      if (replication !== void 0) {
+        this.requestSink.record(replicationEvent(sample, replication));
+        return;
+      }
+      const headers = sample.init?.headers;
+      if (sample.meta !== void 0 && typeof headers === "object" && headers !== null) {
+        this.requestSink.remember(headers, sample.meta);
+      }
+      this.requestSink.observe({
+        url: sample.url,
+        requestHeaders: headers,
+        requestBody: sample.init?.body,
+        responseContentLength: sample.response?.headers.get("content-length"),
+        ok: sample.response?.ok === true,
+        code: outcomeCodeOf(sample.response),
+        durationMs: performance.now() - sample.clock,
+        attempts: sample.attempts ?? 1,
+        at: sample.at
+      });
+    } catch {
+    }
+  }
+};
+function rememberInvoke(invoke, sink, pending) {
+  return (session, service, path, action, facts) => {
+    const headers = invoke(session, service, path, action, facts);
+    const meta = { service, path, action, spaceId: session.spaceId };
+    pending.meta = meta;
+    sink.remember(headers, meta);
+    return headers;
+  };
+}
+function rememberInvokeAny(invokeAny, sink, pending) {
+  return (session, entries, facts) => {
+    const headers = invokeAny(session, entries, facts);
+    const first = entries[0];
+    const meta = first === void 0 ? void 0 : { service: first.service, path: first.path, action: first.action, spaceId: first.spaceId ?? session.spaceId };
+    pending.meta = meta;
+    if (meta !== void 0) sink.remember(headers, meta);
+    return headers;
+  };
+}
+
 // src/delegation.ts
 import {
   canonicalizeRecapCaveats,
@@ -2553,7 +2720,6 @@ import {
   DecryptTransportResponseError,
   SecretsService,
   createVaultCrypto,
-  ServiceContext as ServiceContext2,
   SilentNotificationHandler,
   DelegationManager,
   SpaceService,
@@ -2617,6 +2783,7 @@ import {
   parsePermissionHint,
   tinyCloudDebugLogger
 } from "@tinycloud/sdk-services";
+import { RequestLog, observeReplicaReads, readOnlyRequestLog } from "@tinycloud/sdk-services/telemetry/requestLog";
 
 // src/account/AccountService.ts
 import { AccountService } from "@tinycloud/sdk-core";
@@ -2626,8 +2793,7 @@ import {
   KVService,
   HooksService,
   SQLService,
-  DuckDbService,
-  ServiceContext
+  DuckDbService
 } from "@tinycloud/sdk-core";
 var DelegatedAccess = class {
   /**
@@ -2640,12 +2806,13 @@ var DelegatedAccess = class {
     this.session = session;
     this._delegation = delegation;
     this.host = host;
-    const context = new ServiceContext({
+    const context = createServiceContext({
       invoke,
       invokeAny,
       fetch: lifetime?.fetch ?? globalThis.fetch.bind(globalThis),
       hosts: [host],
-      telemetry
+      telemetry,
+      requestSink: lifetime?.requestSink
     });
     this._serviceContext = lifetime ? lifetime.track(context) : context;
     const prefix = this._delegation.path.replace(/\/$/, "");
@@ -3245,11 +3412,12 @@ function createDefaultSessionKey(wasm) {
   return { manager, keyId, jwk: JSON.parse(jwkStr) };
 }
 var ServiceGraphLifetime = class {
-  constructor(invokeFn, invokeAnyFn, fetchFn, observeContext) {
+  constructor(invokeFn, invokeAnyFn, fetchFn, observeContext, requestSink) {
     this.invokeFn = invokeFn;
     this.invokeAnyFn = invokeAnyFn;
     this.fetchFn = fetchFn;
     this.observeContext = observeContext;
+    this.requestSink = requestSink;
     this.abortController = new AbortController();
     this.contexts = /* @__PURE__ */ new Set();
     this.retired = false;
@@ -3820,6 +3988,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.sessionManager = sessionKey.manager;
     this.sessionKeyId = sessionKey.keyId;
     this.sessionKeyJwk = sessionKey.jwk;
+    this._requestLog = config.requestLog === true ? new RequestLog() : void 0;
     this._serviceGraph = this.createServiceGraphLifetime();
     this._capabilityRegistry = new CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({
@@ -3991,7 +4160,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       createKVService: (config) => {
         const prefix = config.pathPrefix?.replace(/\/$/, "");
         const kvService = new KVService2({ prefix });
-        const kvContext = receiveOnlyGraph.track(new ServiceContext2({
+        const kvContext = receiveOnlyGraph.track(createServiceContext({
+          requestSink: receiveOnlyGraph.requestSink,
           invoke: config.invoke,
           fetch: config.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config.hosts,
@@ -4054,6 +4224,10 @@ var _TinyCloudNode = class _TinyCloudNode {
   shouldUseBootstrapSignInRequest(config) {
     return config.autoBootstrapAccount !== false && config.manifest === void 0 && config.capabilityRequest === void 0 && (config.prefix ?? "default") === "default" && isOpenKeyAutoSignStrategy(config.signStrategy);
   }
+  /** Sanitized developer request events; undefined unless the node was built with `requestLog: true`. */
+  get requests() {
+    return this._requestLog === void 0 ? void 0 : readOnlyRequestLog(this._requestLog);
+  }
   createServiceGraphLifetime() {
     return new ServiceGraphLifetime(
       this.invokeWithRuntimePermissions,
@@ -4064,7 +4238,9 @@ var _TinyCloudNode = class _TinyCloudNode {
       (url, init) => globalThis.fetch(url, init),
       (context) => {
         this.storageFull.observe(context);
-      }
+        if (this._requestLog) observeReplicaReads(context, this._requestLog);
+      },
+      this._requestLog
     );
   }
   syncResolvedHostFromAuth() {
@@ -4387,6 +4563,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.hostedOwnedSpaceIds.clear();
     this.cancelOwnedSpaceHosts();
     this.storageFull.clear();
+    this._requestLog?.clear();
     this._bootstrapSkipped = false;
     this._bootstrapStatus = { skipped: false };
     this.replicationDelegateSession = void 0;
@@ -4478,7 +4655,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       const denial = await this.denyReplicaGate({ reason: "account_switch", principal: priorPrincipal, next: nextPrincipal });
       this.replicaRestoreGate = denial?.status === "unguarded" ? "gate_unavailable" : "stamp_stale";
     }
-    if (address !== this._address || chainId !== this._chainId) this.storageFull.clear();
+    if (address !== this._address || chainId !== this._chainId) {
+      this.storageFull.clear();
+      this._requestLog?.clear();
+    }
     this._address = address;
     this._chainId = chainId;
     this._kv = void 0;
@@ -5057,10 +5237,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     const contexts = [context];
     const accountSpaceId = this.ownedSpaceId(ACCOUNT_REGISTRY_SPACE2);
     const createScopedContext = (spaceId) => {
-      const scoped = this._serviceGraph.track(new ServiceContext2({
+      const scoped = this._serviceGraph.track(createServiceContext({
+        requestSink: this._serviceGraph.requestSink,
         invoke: context.invoke,
         invokeAny: context.invokeAny,
-        fetch: context.fetch,
+        fetch: unrecordedFetchOf(context),
         hosts: context.hosts,
         telemetry: this.config.telemetry,
         retryPolicy: this.config.retryPolicy
@@ -5124,10 +5305,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     const promise = this.enqueueAccountRegistryOperation(session, async () => {
       const sharedContext = this._serviceContext;
       if (!sharedContext) return;
-      const context = this._serviceGraph.track(new ServiceContext2({
+      const context = this._serviceGraph.track(createServiceContext({
+        requestSink: this._serviceGraph.requestSink,
         invoke: sharedContext.invoke,
         invokeAny: sharedContext.invokeAny,
-        fetch: sharedContext.fetch,
+        fetch: unrecordedFetchOf(sharedContext),
         hosts: sharedContext.hosts,
         telemetry: this.config.telemetry,
         retryPolicy: this.config.retryPolicy
@@ -5861,6 +6043,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (resolvedHost) this.config.host = resolvedHost;
     if (spaceOwnerKey(serviceSession.spaceId) !== this.currentStorageOwner()) {
       this.storageFull.clear();
+      this._requestLog?.clear();
     }
     this._address = stagedAddress;
     this._chainId = stagedChainId;
@@ -5980,7 +6163,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       const coreContext = graph.track(core.serviceContext);
       coreContext.setSession(input.serviceSession);
     }
-    const serviceContext = graph.track(new ServiceContext2({
+    const serviceContext = graph.track(createServiceContext({
+      requestSink: graph.requestSink,
       invoke: graph.invoke,
       invokeAny: graph.invokeAny,
       fetch: graph.fetch,
@@ -6068,7 +6252,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       createKVService: (config) => {
         const service = new KVService2({ prefix: config.pathPrefix?.replace(/\/$/, "") });
-        const context = graph.track(new ServiceContext2({
+        const context = graph.track(createServiceContext({
+          requestSink: graph.requestSink,
           invoke: config.invoke,
           fetch: config.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config.hosts,
@@ -6108,7 +6293,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       createKVService: (spaceId) => {
         graph.assertActive();
         const scopedKv = new KVService2({});
-        const context = graph.track(new ServiceContext2({
+        const context = graph.track(createServiceContext({
+          requestSink: graph.requestSink,
           invoke: graph.invoke,
           invokeAny: graph.invokeAny,
           fetch: graph.fetch,
@@ -6124,7 +6310,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       createVaultService: (spaceId) => {
         graph.assertActive();
         const scopedKv = new KVService2({});
-        const context = graph.track(new ServiceContext2({
+        const context = graph.track(createServiceContext({
+          requestSink: graph.requestSink,
           invoke: graph.invoke,
           invokeAny: graph.invokeAny,
           fetch: graph.fetch,
@@ -6523,7 +6710,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       this._serviceGraph.fetch
     );
     this._serviceGraph.track(this.tc.serviceContext);
-    this._serviceContext = this._serviceGraph.track(new ServiceContext2({
+    this._serviceContext = this._serviceGraph.track(createServiceContext({
+      requestSink: this._serviceGraph.requestSink,
       invoke: this._serviceGraph.invoke,
       invokeAny: this._serviceGraph.invokeAny,
       fetch: this._serviceGraph.fetch,
@@ -6571,10 +6759,11 @@ var _TinyCloudNode = class _TinyCloudNode {
   createSpaceScopedKVService(spaceId) {
     const kvService = new KVService2({});
     if (this._serviceContext) {
-      const spaceScopedContext = this._serviceGraph.track(new ServiceContext2({
+      const spaceScopedContext = this._serviceGraph.track(createServiceContext({
+        requestSink: this._serviceGraph.requestSink,
         invoke: this._serviceContext.invoke,
         invokeAny: this._serviceContext.invokeAny,
-        fetch: this._serviceContext.fetch,
+        fetch: unrecordedFetchOf(this._serviceContext),
         hosts: this._serviceContext.hosts,
         telemetry: this.config.telemetry,
         retryPolicy: this.config.retryPolicy
@@ -7040,7 +7229,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       createKVService: (config) => {
         graph.assertActive();
         const service = new KVService2({ prefix: config.pathPrefix?.replace(/\/$/, "") });
-        const context = graph.track(new ServiceContext2({
+        const context = graph.track(createServiceContext({
+          requestSink: graph.requestSink,
           invoke: config.invoke,
           fetch: config.fetch ?? graph.fetch,
           hosts: config.hosts,
@@ -7361,10 +7551,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const sql = new SQLService2({});
-    const spaceScopedContext = this._serviceGraph.track(new ServiceContext2({
+    const spaceScopedContext = this._serviceGraph.track(createServiceContext({
+      requestSink: this._serviceGraph.requestSink,
       invoke: this._serviceContext.invoke,
       invokeAny: this._serviceContext.invokeAny,
-      fetch: this._serviceContext.fetch,
+      fetch: unrecordedFetchOf(this._serviceContext),
       hosts: this._serviceContext.hosts,
       telemetry: this.config.telemetry,
       retryPolicy: this.config.retryPolicy
@@ -7392,10 +7583,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const kv = new KVService2({});
-    const spaceScopedContext = this._serviceGraph.track(new ServiceContext2({
+    const spaceScopedContext = this._serviceGraph.track(createServiceContext({
+      requestSink: this._serviceGraph.requestSink,
       invoke: this._serviceContext.invoke,
       invokeAny: this._serviceContext.invokeAny,
-      fetch: this._serviceContext.fetch,
+      fetch: unrecordedFetchOf(this._serviceContext),
       hosts: this._serviceContext.hosts
     }));
     spaceScopedContext.setSession({ ...this._serviceContext.session, spaceId });
@@ -8181,7 +8373,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     if (this._serviceContext) {
       const publicKV = new KVService2({ prefix: "" });
-      const publicContext = this._serviceGraph.track(new ServiceContext2({
+      const publicContext = this._serviceGraph.track(createServiceContext({
+        requestSink: this._serviceGraph.requestSink,
         invoke: this._serviceGraph.invoke,
         fetch: this._serviceGraph.fetch,
         hosts: this._serviceContext.hosts,
@@ -9764,7 +9957,7 @@ import {
   UnsupportedFeatureError as UnsupportedFeatureError2,
   checkNodeInfo as checkNodeInfo3
 } from "@tinycloud/sdk-core";
-import { ServiceContext as ServiceContext3 } from "@tinycloud/sdk-core";
+import { ServiceContext as ServiceContext4 } from "@tinycloud/sdk-core";
 export {
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE3 as ACCOUNT_REGISTRY_SPACE,
@@ -9798,7 +9991,7 @@ export {
   SQLAction,
   SQLService3 as SQLService,
   SecretsService2 as SecretsService,
-  ServiceContext3 as ServiceContext,
+  ServiceContext4 as ServiceContext,
   SessionExpiredError2 as SessionExpiredError,
   SharingService2 as SharingService,
   SilentNotificationHandler2 as SilentNotificationHandler,