@tinycloud/node-sdk 3.4.0 → 3.5.0-beta.1

package/dist/index.cjs

@@ -17045,7 +17045,7 @@ function augmentSignInEntriesWithReplication(input) {
   for (const prefix of replication.prefixes) {
     (0, import_prefix.assertFolderPrefix)(prefix);
     const path = prefix === "/" ? "" : prefix;
-    if ((0, import_sdk_services.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
+    if ((0, import_sdk_services2.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
       continue;
     }
     if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {
@@ -17071,12 +17071,12 @@ function augmentSignInEntriesWithReplication(input) {
   }
   return out;
 }
-var import_sdk_core2, import_sdk_services, import_prefix, KV_GET, KV_SYNC, KV_SERVICE;
+var import_sdk_core2, import_sdk_services2, import_prefix, KV_GET, KV_SYNC, KV_SERVICE;
 var init_authority_sign_in = __esm({
   "src/replication/authority-sign-in.ts"() {
     "use strict";
     import_sdk_core2 = require("@tinycloud/sdk-core");
-    import_sdk_services = require("@tinycloud/sdk-services");
+    import_sdk_services2 = require("@tinycloud/sdk-services");
     import_prefix = require("@tinycloud/sdk-services/kv/replication/prefix");
     KV_GET = import_sdk_core2.KV.GET;
     KV_SYNC = import_sdk_core2.KV.SYNC;
@@ -18069,6 +18069,167 @@ var PrivateKeySigner = class {
   }
 };
 
+// src/recordingServiceContext.ts
+var import_sdk_services = require("@tinycloud/sdk-services");
+var import_requestLog = require("@tinycloud/sdk-services/telemetry/requestLog");
+
+// src/recordingRegistry.ts
+var unrecordedFetches = /* @__PURE__ */ new WeakMap();
+function registerRecording(context, unrecordedFetch) {
+  unrecordedFetches.set(context, unrecordedFetch);
+}
+function unrecordedFetchOf(context) {
+  const unrecordedFetch = unrecordedFetches.get(context);
+  return unrecordedFetch ? unrecordedFetch() : context.fetch;
+}
+
+// src/recordingServiceContext.ts
+var SYNC_ABILITY = "tinycloud.kv/sync";
+var INFO_PATH = "/info";
+function outcomeCodeOf(response) {
+  return response === void 0 ? "ERROR" : response.ok ? "ok" : `HTTP_${response.status}`;
+}
+function replicationOp(url, meta) {
+  if (meta !== void 0) return meta.action === SYNC_ABILITY ? `${meta.service}/sync` : void 0;
+  return isInfoUrl(url) ? "sync/info" : void 0;
+}
+function isInfoUrl(url) {
+  try {
+    return new URL(url).pathname.replace(/\/+$/, "") === INFO_PATH;
+  } catch {
+    return false;
+  }
+}
+function replicationEvent(sample, op) {
+  return (0, import_requestLog.buildRequestEvent)({
+    service: "sync",
+    op,
+    url: sample.url,
+    bytes: (0, import_requestLog.requestBytesOf)(sample.init?.body, sample.response?.headers.get("content-length")),
+    durationMs: performance.now() - sample.clock,
+    attempts: sample.attempts ?? 1,
+    ok: sample.response?.ok === true,
+    code: outcomeCodeOf(sample.response),
+    at: sample.at
+  });
+}
+function createServiceContext(config) {
+  const { requestSink, ...base2 } = config;
+  return requestSink === void 0 ? new import_sdk_services.ServiceContext(base2) : new RecordingServiceContext(base2, requestSink);
+}
+var RecordingServiceContext = class extends import_sdk_services.ServiceContext {
+  constructor(config, sink) {
+    const pending = {};
+    super({
+      ...config,
+      invoke: rememberInvoke(config.invoke, sink, pending),
+      invokeAny: config.invokeAny ? rememberInvokeAny(config.invokeAny, sink, pending) : void 0
+    });
+    this.requestSink = sink;
+    this.pending = pending;
+    registerRecording(this, () => this.unrecordedFetch);
+  }
+  /** Per-call recording; `_fetch` is read at access time, so overrides apply. */
+  get fetch() {
+    const raw = super.fetch;
+    return (url, init2) => this.recordCall(raw, url, init2);
+  }
+  /** Transport without per-call recording. */
+  get unrecordedFetch() {
+    return super.fetch;
+  }
+  /**
+   * One event per logical request. The first resolved attempt's init is the logged request and
+   * `attempts` counts resolved builds. A retired context throws before the first build and records
+   * nothing, as master does.
+   */
+  async invokeWithRetry(url, build) {
+    const at = Date.now();
+    const clock = performance.now();
+    let reached = false;
+    let attempts = 0;
+    let first;
+    let firstMeta;
+    let response;
+    const attempt = async () => {
+      reached = true;
+      this.pending.meta = void 0;
+      const built = build();
+      const meta = this.pending.meta;
+      const init2 = await built;
+      attempts += 1;
+      if (first === void 0) {
+        first = init2;
+        firstMeta = meta;
+      }
+      return init2;
+    };
+    try {
+      response = await super.invokeWithRetry(url, attempt);
+      return response;
+    } finally {
+      if (reached) {
+        this.observeAttempt({ url, init: first, response, meta: firstMeta, at, clock, attempts });
+      }
+    }
+  }
+  async recordCall(fetchFn, url, init2) {
+    const at = Date.now();
+    const clock = performance.now();
+    let response;
+    try {
+      response = await fetchFn(url, init2);
+      return response;
+    } finally {
+      this.observeAttempt({ url, init: init2, response, at, clock });
+    }
+  }
+  observeAttempt(sample) {
+    try {
+      const replication = replicationOp(sample.url, sample.meta ?? (0, import_requestLog.invocationMetaOf)(sample.init?.headers));
+      if (replication !== void 0) {
+        this.requestSink.record(replicationEvent(sample, replication));
+        return;
+      }
+      const headers = sample.init?.headers;
+      if (sample.meta !== void 0 && typeof headers === "object" && headers !== null) {
+        this.requestSink.remember(headers, sample.meta);
+      }
+      this.requestSink.observe({
+        url: sample.url,
+        requestHeaders: headers,
+        requestBody: sample.init?.body,
+        responseContentLength: sample.response?.headers.get("content-length"),
+        ok: sample.response?.ok === true,
+        code: outcomeCodeOf(sample.response),
+        durationMs: performance.now() - sample.clock,
+        attempts: sample.attempts ?? 1,
+        at: sample.at
+      });
+    } catch {
+    }
+  }
+};
+function rememberInvoke(invoke2, sink, pending) {
+  return (session, service, path, action, facts) => {
+    const headers = invoke2(session, service, path, action, facts);
+    const meta = { service, path, action, spaceId: session.spaceId };
+    pending.meta = meta;
+    sink.remember(headers, meta);
+    return headers;
+  };
+}
+function rememberInvokeAny(invokeAny2, sink, pending) {
+  return (session, entries, facts) => {
+    const headers = invokeAny2(session, entries, facts);
+    const first = entries[0];
+    const meta = first === void 0 ? void 0 : { service: first.service, path: first.path, action: first.action, spaceId: first.spaceId ?? session.spaceId };
+    pending.meta = meta;
+    if (meta !== void 0) sink.remember(headers, meta);
+    return headers;
+  };
+}
+
 // src/delegation.ts
 var import_sdk_core = require("@tinycloud/sdk-core");
 var RUNTIME_DELEGATION_REJECTIONS = [
@@ -18625,7 +18786,8 @@ function getNodeReplicationLoaders() {
 
 // src/TinyCloudNode.ts
 var import_sdk_core9 = require("@tinycloud/sdk-core");
-var import_sdk_services2 = require("@tinycloud/sdk-services");
+var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_requestLog2 = require("@tinycloud/sdk-services/telemetry/requestLog");
 
 // src/authorization/NodeUserAuthorization.ts
 var import_node_crypto = require("crypto");
@@ -20448,12 +20610,13 @@ var DelegatedAccess = class {
     this.session = session;
     this._delegation = delegation;
     this.host = host;
-    const context = new import_sdk_core6.ServiceContext({
+    const context = createServiceContext({
       invoke: invoke2,
       invokeAny: invokeAny2,
       fetch: lifetime?.fetch ?? globalThis.fetch.bind(globalThis),
       hosts: [host],
-      telemetry
+      telemetry,
+      requestSink: lifetime?.requestSink
     });
     this._serviceContext = lifetime ? lifetime.track(context) : context;
     const prefix = this._delegation.path.replace(/\/$/, "");
@@ -20648,6 +20811,16 @@ function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   return entries;
 }
 var DEFAULT_DELEGATION_EXPIRY_MS = import_sdk_core7.EXPIRY.SESSION_MS;
+var SHARE_NETWORK_NAME_RE = /^share-[a-z0-9][a-z0-9-]{15,35}$/;
+function grantsCappedDecrypt(path, actions) {
+  if (!actions.some((action) => (0, import_sdk_core7.actionContains)(action, import_sdk_core7.ENCRYPTION.DECRYPT))) {
+    return false;
+  }
+  return !((0, import_sdk_core7.isNetworkId)(path) && SHARE_NETWORK_NAME_RE.test((0, import_sdk_core7.parseNetworkId)(path).name));
+}
+function includesDecrypt(entries) {
+  return entries.some((entry) => grantsCappedDecrypt(entry.path, entry.actions));
+}
 function resolveExpiryMs(expiry) {
   if (expiry === void 0) {
     return DEFAULT_DELEGATION_EXPIRY_MS;
@@ -20815,6 +20988,15 @@ var NodeSecretsService = class {
     if (this.hasPermission(permissionEntries)) {
       return ok();
     }
+    let escalation;
+    try {
+      escalation = this.config.uncoveredEntries?.(permissionEntries) ?? permissionEntries;
+    } catch (error) {
+      return this.escalationError(action, target, error);
+    }
+    if (this.config.uncoveredEntries !== void 0 && escalation.length === 0) {
+      return ok();
+    }
     if (!this.config.canEscalate()) {
       return secretsError(
         import_sdk_core8.ErrorCodes.PERMISSION_DENIED,
@@ -20822,16 +21004,20 @@ var NodeSecretsService = class {
       );
     }
     try {
-      await this.config.grantPermissions(permissionEntries);
+      const grant = action === "get" && this.config.grantGetPermissions !== void 0 ? this.config.grantGetPermissions : this.config.grantPermissions;
+      await grant(escalation);
       return this.restoreUnlockAfterEscalation();
     } catch (error) {
-      return secretsError(
-        import_sdk_core8.ErrorCodes.PERMISSION_DENIED,
-        error instanceof Error ? error.message : `Autosign escalation for ${displayActionUrn(action)} on ${target} failed.`,
-        error instanceof Error ? error : void 0
-      );
+      return this.escalationError(action, target, error);
     }
   }
+  escalationError(action, target, error) {
+    return secretsError(
+      import_sdk_core8.ErrorCodes.PERMISSION_DENIED,
+      error instanceof Error ? error.message : `Autosign escalation for ${displayActionUrn(action)} on ${target} failed.`,
+      error instanceof Error ? error : void 0
+    );
+  }
   async restoreUnlockAfterEscalation() {
     if (!this.shouldRestoreUnlock) {
       return ok();
@@ -21043,11 +21229,12 @@ function createDefaultSessionKey(wasm) {
   return { manager, keyId, jwk: JSON.parse(jwkStr) };
 }
 var ServiceGraphLifetime = class {
-  constructor(invokeFn, invokeAnyFn, fetchFn, observeContext) {
+  constructor(invokeFn, invokeAnyFn, fetchFn, observeContext, requestSink) {
     this.invokeFn = invokeFn;
     this.invokeAnyFn = invokeAnyFn;
     this.fetchFn = fetchFn;
     this.observeContext = observeContext;
+    this.requestSink = requestSink;
     this.abortController = new AbortController();
     this.contexts = /* @__PURE__ */ new Set();
     this.retired = false;
@@ -21236,6 +21423,8 @@ function ownerPermissionsToAbilities(permissions) {
   return { abilities, rawAbilities };
 }
 var TERMINAL_DELEGATION_REQUIRES_SESSION_KEY = "disableSubDelegation requires a session-key delegation to a did:key (not did:pkh); use the session-key DID or drop the flag";
+var DECRYPT_GRANT_MAX_EXPIRY_MS = 60 * 60 * 1e3;
+var SECRET_GET_GRANT_EXPIRY_MS = 59 * 60 * 1e3;
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
@@ -21618,6 +21807,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.sessionManager = sessionKey.manager;
     this.sessionKeyId = sessionKey.keyId;
     this.sessionKeyJwk = sessionKey.jwk;
+    this._requestLog = config.requestLog === true ? new import_requestLog2.RequestLog() : void 0;
     this._serviceGraph = this.createServiceGraphLifetime();
     this._capabilityRegistry = new import_sdk_core9.CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({
@@ -21789,7 +21979,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       createKVService: (config) => {
         const prefix = config.pathPrefix?.replace(/\/$/, "");
         const kvService = new import_sdk_core9.KVService({ prefix });
-        const kvContext = receiveOnlyGraph.track(new import_sdk_core9.ServiceContext({
+        const kvContext = receiveOnlyGraph.track(createServiceContext({
+          requestSink: receiveOnlyGraph.requestSink,
           invoke: config.invoke,
           fetch: config.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config.hosts,
@@ -21852,6 +22043,10 @@ var _TinyCloudNode = class _TinyCloudNode {
   shouldUseBootstrapSignInRequest(config) {
     return config.autoBootstrapAccount !== false && config.manifest === void 0 && config.capabilityRequest === void 0 && (config.prefix ?? "default") === "default" && isOpenKeyAutoSignStrategy(config.signStrategy);
   }
+  /** Sanitized developer request events; undefined unless the node was built with `requestLog: true`. */
+  get requests() {
+    return this._requestLog === void 0 ? void 0 : (0, import_requestLog2.readOnlyRequestLog)(this._requestLog);
+  }
   createServiceGraphLifetime() {
     return new ServiceGraphLifetime(
       this.invokeWithRuntimePermissions,
@@ -21862,7 +22057,9 @@ var _TinyCloudNode = class _TinyCloudNode {
       (url, init2) => globalThis.fetch(url, init2),
       (context) => {
         this.storageFull.observe(context);
-      }
+        if (this._requestLog) (0, import_requestLog2.observeReplicaReads)(context, this._requestLog);
+      },
+      this._requestLog
     );
   }
   syncResolvedHostFromAuth() {
@@ -22185,6 +22382,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.hostedOwnedSpaceIds.clear();
     this.cancelOwnedSpaceHosts();
     this.storageFull.clear();
+    this._requestLog?.clear();
     this._bootstrapSkipped = false;
     this._bootstrapStatus = { skipped: false };
     this.replicationDelegateSession = void 0;
@@ -22276,7 +22474,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       const denial = await this.denyReplicaGate({ reason: "account_switch", principal: priorPrincipal, next: nextPrincipal });
       this.replicaRestoreGate = denial?.status === "unguarded" ? "gate_unavailable" : "stamp_stale";
     }
-    if (address !== this._address || chainId !== this._chainId) this.storageFull.clear();
+    if (address !== this._address || chainId !== this._chainId) {
+      this.storageFull.clear();
+      this._requestLog?.clear();
+    }
     this._address = address;
     this._chainId = chainId;
     this._kv = void 0;
@@ -22855,10 +23056,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     const contexts = [context];
     const accountSpaceId = this.ownedSpaceId(import_sdk_core9.ACCOUNT_REGISTRY_SPACE);
     const createScopedContext = (spaceId) => {
-      const scoped = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
+      const scoped = this._serviceGraph.track(createServiceContext({
+        requestSink: this._serviceGraph.requestSink,
         invoke: context.invoke,
         invokeAny: context.invokeAny,
-        fetch: context.fetch,
+        fetch: unrecordedFetchOf(context),
         hosts: context.hosts,
         telemetry: this.config.telemetry,
         retryPolicy: this.config.retryPolicy
@@ -22910,7 +23112,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.currentSessionCoversAccountRegistry()) {
       if (!_TinyCloudNode.accountRegistrySkipLogged) {
         _TinyCloudNode.accountRegistrySkipLogged = true;
-        import_sdk_services2.tinyCloudDebugLogger.log("registry.skip");
+        import_sdk_services3.tinyCloudDebugLogger.log("registry.skip");
       }
       return;
     }
@@ -22922,10 +23124,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     const promise = this.enqueueAccountRegistryOperation(session, async () => {
       const sharedContext = this._serviceContext;
       if (!sharedContext) return;
-      const context = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
+      const context = this._serviceGraph.track(createServiceContext({
+        requestSink: this._serviceGraph.requestSink,
         invoke: sharedContext.invoke,
         invokeAny: sharedContext.invokeAny,
-        fetch: sharedContext.fetch,
+        fetch: unrecordedFetchOf(sharedContext),
         hosts: sharedContext.hosts,
         telemetry: this.config.telemetry,
         retryPolicy: this.config.retryPolicy
@@ -23659,6 +23862,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (resolvedHost) this.config.host = resolvedHost;
     if (spaceOwnerKey(serviceSession.spaceId) !== this.currentStorageOwner()) {
       this.storageFull.clear();
+      this._requestLog?.clear();
     }
     this._address = stagedAddress;
     this._chainId = stagedChainId;
@@ -23778,7 +23982,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       const coreContext = graph.track(core.serviceContext);
       coreContext.setSession(input.serviceSession);
     }
-    const serviceContext = graph.track(new import_sdk_core9.ServiceContext({
+    const serviceContext = graph.track(createServiceContext({
+      requestSink: graph.requestSink,
       invoke: graph.invoke,
       invokeAny: graph.invokeAny,
       fetch: graph.fetch,
@@ -23866,7 +24071,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       },
       createKVService: (config) => {
         const service = new import_sdk_core9.KVService({ prefix: config.pathPrefix?.replace(/\/$/, "") });
-        const context = graph.track(new import_sdk_core9.ServiceContext({
+        const context = graph.track(createServiceContext({
+          requestSink: graph.requestSink,
           invoke: config.invoke,
           fetch: config.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config.hosts,
@@ -23906,7 +24112,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       createKVService: (spaceId) => {
         graph.assertActive();
         const scopedKv = new import_sdk_core9.KVService({});
-        const context = graph.track(new import_sdk_core9.ServiceContext({
+        const context = graph.track(createServiceContext({
+          requestSink: graph.requestSink,
           invoke: graph.invoke,
           invokeAny: graph.invokeAny,
           fetch: graph.fetch,
@@ -23922,7 +24129,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       createVaultService: (spaceId) => {
         graph.assertActive();
         const scopedKv = new import_sdk_core9.KVService({});
-        const context = graph.track(new import_sdk_core9.ServiceContext({
+        const context = graph.track(createServiceContext({
+          requestSink: graph.requestSink,
           invoke: graph.invoke,
           invokeAny: graph.invokeAny,
           fetch: graph.fetch,
@@ -24321,7 +24529,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       this._serviceGraph.fetch
     );
     this._serviceGraph.track(this.tc.serviceContext);
-    this._serviceContext = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
+    this._serviceContext = this._serviceGraph.track(createServiceContext({
+      requestSink: this._serviceGraph.requestSink,
       invoke: this._serviceGraph.invoke,
       invokeAny: this._serviceGraph.invokeAny,
       fetch: this._serviceGraph.fetch,
@@ -24369,10 +24578,11 @@ var _TinyCloudNode = class _TinyCloudNode {
   createSpaceScopedKVService(spaceId) {
     const kvService = new import_sdk_core9.KVService({});
     if (this._serviceContext) {
-      const spaceScopedContext = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
+      const spaceScopedContext = this._serviceGraph.track(createServiceContext({
+        requestSink: this._serviceGraph.requestSink,
         invoke: this._serviceContext.invoke,
         invokeAny: this._serviceContext.invokeAny,
-        fetch: this._serviceContext.fetch,
+        fetch: unrecordedFetchOf(this._serviceContext),
         hosts: this._serviceContext.hosts,
         telemetry: this.config.telemetry,
         retryPolicy: this.config.retryPolicy
@@ -24560,7 +24770,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services2.parsePermissionHint)({
+          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services3.parsePermissionHint)({
             service: "tinycloud.encryption",
             path: networkId,
             actions: ["tinycloud.encryption/decrypt"]
@@ -24838,7 +25048,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       createKVService: (config) => {
         graph.assertActive();
         const service = new import_sdk_core9.KVService({ prefix: config.pathPrefix?.replace(/\/$/, "") });
-        const context = graph.track(new import_sdk_core9.ServiceContext({
+        const context = graph.track(createServiceContext({
+          requestSink: graph.requestSink,
           invoke: config.invoke,
           fetch: config.fetch ?? graph.fetch,
           hosts: config.hosts,
@@ -25159,10 +25370,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const sql = new import_sdk_core9.SQLService({});
-    const spaceScopedContext = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
+    const spaceScopedContext = this._serviceGraph.track(createServiceContext({
+      requestSink: this._serviceGraph.requestSink,
       invoke: this._serviceContext.invoke,
       invokeAny: this._serviceContext.invokeAny,
-      fetch: this._serviceContext.fetch,
+      fetch: unrecordedFetchOf(this._serviceContext),
       hosts: this._serviceContext.hosts,
       telemetry: this.config.telemetry,
       retryPolicy: this.config.retryPolicy
@@ -25190,10 +25402,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const kv = new import_sdk_core9.KVService({});
-    const spaceScopedContext = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
+    const spaceScopedContext = this._serviceGraph.track(createServiceContext({
+      requestSink: this._serviceGraph.requestSink,
       invoke: this._serviceContext.invoke,
       invokeAny: this._serviceContext.invokeAny,
-      fetch: this._serviceContext.fetch,
+      fetch: unrecordedFetchOf(this._serviceContext),
       hosts: this._serviceContext.hosts
     }));
     spaceScopedContext.setSession({ ...this._serviceContext.session, spaceId });
@@ -25334,6 +25547,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         getManifest: () => this.manifest,
         hasPermissions: (permissions) => this.hasRuntimePermissions(permissions),
         grantPermissions: (additional) => this.grantRuntimePermissions(additional),
+        grantGetPermissions: (additional) => this.grantRuntimePermissions(additional, { expiry: SECRET_GET_GRANT_EXPIRY_MS }),
+        uncoveredEntries: (permissions) => permissions.filter((entry) => !this.hasRuntimePermissions([entry])),
         canEscalate: () => this.signer !== void 0 && this.tc !== void 0,
         getEncryptionNetworkId: () => this.getEncryptionNetworkIdForSpace(resolvedSpace),
         resolveSpace: (space) => space.startsWith("tinycloud:") ? space : this.ownedSpaceId(space),
@@ -25356,7 +25571,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     );
     if (result.status !== "ok") {
       if (result.status === "permission_required") {
-        const hint = (0, import_sdk_services2.parsePermissionHint)(result.hint);
+        const hint = (0, import_sdk_services3.parsePermissionHint)(result.hint);
         if (hint === void 0) return { status: "read_failed" };
         return {
           status: "permission_required",
@@ -25681,6 +25896,13 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     }
     const expanded = this.expandPermissionEntries(permissions);
+    const requestsDecrypt = includesDecrypt(expanded);
+    const requestedExpiryMs = requestsDecrypt && options?.expiry === void 0 ? DECRYPT_GRANT_MAX_EXPIRY_MS : resolveExpiryMs(options?.expiry);
+    if (requestsDecrypt && requestedExpiryMs > DECRYPT_GRANT_MAX_EXPIRY_MS) {
+      throw Object.assign(new Error("decrypt grants last at most one hour"), {
+        code: "DECRYPT_EXPIRY_TOO_LONG"
+      });
+    }
     if (this.sessionCoversPermissionEntries(session, expanded)) {
       return [];
     }
@@ -25711,7 +25933,6 @@ var _TinyCloudNode = class _TinyCloudNode {
       bySpace.set(session.spaceId, []);
     }
     const now = /* @__PURE__ */ new Date();
-    const requestedExpiryMs = resolveExpiryMs(options?.expiry);
     let expiresAt = new Date(now.getTime() + requestedExpiryMs);
     if (sessionExpiry !== void 0 && sessionExpiry < expiresAt) {
       expiresAt = sessionExpiry;
@@ -25979,7 +26200,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     if (this._serviceContext) {
       const publicKV = new import_sdk_core9.KVService({ prefix: "" });
-      const publicContext = this._serviceGraph.track(new import_sdk_core9.ServiceContext({
+      const publicContext = this._serviceGraph.track(createServiceContext({
+        requestSink: this._serviceGraph.requestSink,
         invoke: this._serviceGraph.invoke,
         fetch: this._serviceGraph.fetch,
         hosts: this._serviceContext.hosts,
@@ -27699,7 +27921,7 @@ var import_node_fs = require("fs");
 var import_promises = require("fs/promises");
 var import_node_path = require("path");
 var import_sdk_core13 = require("@tinycloud/sdk-core");
-var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_sdk_services4 = require("@tinycloud/sdk-services");
 var import_contractConstants = require("@tinycloud/sdk-services/kv/replication/contractConstants");
 init_authority();
 var REPLICA_LOGOUT_PENDING_FILE = "replica-logout-pending.json";
@@ -28261,7 +28483,7 @@ function sha256Base32(material) {
   return out.slice(0, 26);
 }
 function partitionDirOf(root, identity) {
-  return (0, import_node_path.join)(root, sha256Base32((0, import_sdk_services3.replicationIdentityKey)(identity)));
+  return (0, import_node_path.join)(root, sha256Base32((0, import_sdk_services4.replicationIdentityKey)(identity)));
 }
 function replicaHashOf(prefix, deviceDid) {
   return sha256Base32(`${prefix}
@@ -28335,8 +28557,8 @@ function deviceRecordOf(value) {
 }
 function sameIdentity(a, b) {
   try {
-    const left = (0, import_sdk_services3.canonicalReplicationIdentity)(a);
-    const right = (0, import_sdk_services3.canonicalReplicationIdentity)(b);
+    const left = (0, import_sdk_services4.canonicalReplicationIdentity)(a);
+    const right = (0, import_sdk_services4.canonicalReplicationIdentity)(b);
     return left.host === right.host && left.space === right.space && left.principal === right.principal;
   } catch {
     return false;
@@ -28352,7 +28574,7 @@ async function ensurePartitionIdentity(dir, identity, dirSync) {
   const file = (0, import_node_path.join)(dir, "identity.json");
   const existing = await readJsonFile(file);
   if (existing === void 0) {
-    await writeJsonAtomic(file, { v: 1, ...(0, import_sdk_services3.canonicalReplicationIdentity)(identity) }, dirSync);
+    await writeJsonAtomic(file, { v: 1, ...(0, import_sdk_services4.canonicalReplicationIdentity)(identity) }, dirSync);
     return;
   }
   const record = identityRecordOf(existing);
@@ -28451,7 +28673,7 @@ withGate_fn = async function(section) {
   if (snapshot === void 0) throw gated("gate_unavailable");
   const [principalHash, identityKeyHash] = await Promise.all([
     gate.principalHashOf(snapshot.salt, this.identity.principal),
-    gate.identityHashOf(snapshot.salt, (0, import_sdk_services3.replicationIdentityKey)(this.identity))
+    gate.identityHashOf(snapshot.salt, (0, import_sdk_services4.replicationIdentityKey)(this.identity))
   ]);
   const access = {
     stamp: __privateGet(this, _stamp),
@@ -28951,7 +29173,7 @@ function createSqliteReplicaStorage(options) {
     if (snapshot === void 0) throw gated("gate_unavailable");
     const [principalHash, identityKeyHash] = await Promise.all([
       gate.principalHashOf(snapshot.salt, principal),
-      identity === void 0 ? Promise.resolve(void 0) : gate.identityHashOf(snapshot.salt, (0, import_sdk_services3.replicationIdentityKey)(identity))
+      identity === void 0 ? Promise.resolve(void 0) : gate.identityHashOf(snapshot.salt, (0, import_sdk_services4.replicationIdentityKey)(identity))
     ]);
     return profileSection(async () => {
       assertLogoutClear(options.logoutPendingFile);
@@ -28974,7 +29196,7 @@ function createSqliteReplicaStorage(options) {
     if (snapshot === void 0) throw gated("gate_unavailable");
     const [principalHash, identityKeyHash] = await Promise.all([
       gate.principalHashOf(snapshot.salt, spec.identity.principal),
-      gate.identityHashOf(snapshot.salt, (0, import_sdk_services3.replicationIdentityKey)(spec.identity))
+      gate.identityHashOf(snapshot.salt, (0, import_sdk_services4.replicationIdentityKey)(spec.identity))
     ]);
     const access = {
       stamp: spec.stamp,
@@ -29058,7 +29280,7 @@ function createSqliteReplicaStorage(options) {
       const identity = identityRecordOf(await readJsonFile((0, import_node_path.join)(idDir, "identity.json")));
       if (identity === void 0) throw new ReplicaStorageError("STORAGE_ERROR", `Missing identity at ${idDir}.`);
       if (await gate.principalHashOf(salt, identity.principal) !== principalHash) continue;
-      const identityKeyHash = await gate.identityHashOf(salt, (0, import_sdk_services3.replicationIdentityKey)(identity));
+      const identityKeyHash = await gate.identityHashOf(salt, (0, import_sdk_services4.replicationIdentityKey)(identity));
       const recordedAt = Date.now();
       if (await pathExists((0, import_node_path.join)(idDir, "pending.json")) || await pathExists((0, import_node_path.join)(idDir, "device.jwk"))) {
         intents.push({ id: `pending:${identityKeyHash}`, kind: "pending", identityKeyHash, principalHash, recordedAt });
@@ -29736,7 +29958,7 @@ function createSqliteReplicaStorage(options) {
           for (const dir of await identityDirs()) {
             const identity = identityRecordOf(await readJsonFile((0, import_node_path.join)(dir, "identity.json")));
             if (identity === void 0) throw new ReplicaStorageError("STORAGE_ERROR", `Missing identity at ${dir}.`);
-            const hash3 = await gate.identityHashOf(state.salt, (0, import_sdk_services3.replicationIdentityKey)(identity));
+            const hash3 = await gate.identityHashOf(state.salt, (0, import_sdk_services4.replicationIdentityKey)(identity));
             if (intent.kind === "pending" ? hash3 === intent.identityKeyHash : intent.partitionId.startsWith(`${hash3}:`)) {
               idDir = dir;
               break;
@@ -29882,7 +30104,7 @@ function createSqliteReplicaStorage(options) {
     const gate = await fileGate();
     const snapshot = await gate.readGateSnapshot(profileDir);
     if (snapshot === void 0) throw gated("gate_unavailable");
-    const identityKeyHash = await gate.identityHashOf(snapshot.salt, (0, import_sdk_services3.replicationIdentityKey)(spec.identity));
+    const identityKeyHash = await gate.identityHashOf(snapshot.salt, (0, import_sdk_services4.replicationIdentityKey)(spec.identity));
     const resolvePolicy = async (at, recordFirst) => {
       const policy = spec.grantPolicy;
       if (!Number.isSafeInteger(policy.grantTtlMs) || policy.grantTtlMs <= 0 || policy.grantTtlMs > import_contractConstants.MAX_GRANT_TTL_MS) {
@@ -29904,7 +30126,7 @@ function createSqliteReplicaStorage(options) {
     let partitionId;
     const storeGuard = (section) => guarded(spec.identity.principal, spec.stamp, spec.identity, partitionId, section);
     return guarded(spec.identity.principal, spec.stamp, spec.identity, void 0, async () => {
-      if ((0, import_sdk_services3.requiresSecretsOptIn)(spec.space, spec.prefix) && spec.allowSecrets !== true) {
+      if ((0, import_sdk_services4.requiresSecretsOptIn)(spec.space, spec.prefix) && spec.allowSecrets !== true) {
         throw new replica.ReplicaError(
           replica.ReplicaErrorCode.SECRETS_OPT_IN_REQUIRED,
           `Replicating ${spec.space}/kv/${spec.prefix} copies secret material to disk; pass allowSecrets to opt in.`
@@ -30150,7 +30372,7 @@ function createSqliteReplicaStorage(options) {
               const gate = await fileGate();
               const currentGate = await gate.readGateSnapshot(profileDir);
               if (currentGate !== void 0 && currentGate.principalHash !== null && currentGate.principalHash === await gate.principalHashOf(currentGate.salt, target.identity.principal)) {
-                const identityKeyHash = await gate.identityHashOf(currentGate.salt, (0, import_sdk_services3.replicationIdentityKey)(target.identity));
+                const identityKeyHash = await gate.identityHashOf(currentGate.salt, (0, import_sdk_services4.replicationIdentityKey)(target.identity));
                 await retainGrantInstalls(gate, currentGate, identityKeyHash, store);
               }
               if (state.revoked === null) {