@tinycloud/operations 0.1.0-beta.1 → 0.1.0

package/dist/cli-runtime.cjs

@@ -6528,9 +6528,9 @@ function evaluateAuthority(granted, required) {
     missing: canonicalizeCapabilities(result.missing)
   };
 }
-function evaluateOperationAuthority(granted, required, resolveSpace) {
-  const canonicalGranted = canonicalizeOperationCapabilities(granted, resolveSpace);
-  const canonicalRequired = canonicalizeOperationCapabilities(required, resolveSpace);
+function evaluateOperationAuthority(granted, required, resolveSpace2) {
+  const canonicalGranted = canonicalizeOperationCapabilities(granted, resolveSpace2);
+  const canonicalRequired = canonicalizeOperationCapabilities(required, resolveSpace2);
   const missing = [];
   for (const requested of canonicalRequired) {
     const covered = canonicalGranted.some(
@@ -6543,21 +6543,21 @@ function evaluateOperationAuthority(granted, required, resolveSpace) {
     missing: canonicalizeCapabilities(missing)
   };
 }
-function isExactCapabilityMemberSubset(hinted, planned, resolveSpace) {
-  const canonicalHinted = canonicalizeOperationCapabilities(hinted, resolveSpace);
-  const canonicalPlanned = canonicalizeOperationCapabilities(planned, resolveSpace);
+function isExactCapabilityMemberSubset(hinted, planned, resolveSpace2) {
+  const canonicalHinted = canonicalizeOperationCapabilities(hinted, resolveSpace2);
+  const canonicalPlanned = canonicalizeOperationCapabilities(planned, resolveSpace2);
   return canonicalHinted.length > 0 && canonicalHinted.every((hint) => canonicalPlanned.some(
     (plan) => JSON.stringify(hint) === JSON.stringify(plan)
   ));
 }
-function canonicalizeOperationCapabilities(permissions, resolveSpace) {
+function canonicalizeOperationCapabilities(permissions, resolveSpace2) {
   return canonicalizeCapabilities(permissions.map((permission) => {
     const canonicalPath = canonicalizeOperationPath(permission);
-    if (permission.space === void 0 || resolveSpace === void 0) {
+    if (permission.space === void 0 || resolveSpace2 === void 0) {
       return canonicalPath;
     }
     try {
-      return { ...canonicalPath, space: resolveSpace(permission.space) };
+      return { ...canonicalPath, space: resolveSpace2(permission.space) };
     } catch {
       return canonicalPath;
     }
@@ -6611,7 +6611,7 @@ function isExactPermission(value) {
   if (!isExactRecord(value) || Object.getOwnPropertyNames(value).some((key) => !EXACT_PERMISSION_KEYS.has(key)) || Object.getOwnPropertySymbols(value).length > 0) {
     return false;
   }
-  if (!isExactText(value.service) || !isExactPath(value.path) || value.space !== void 0 && !isExactText(value.space) || !Array.isArray(value.actions) || value.actions.length === 0 || !value.actions.every(isExactText) || new Set(value.actions).size !== value.actions.length || value.skipPrefix === true || value.skipPrefix !== void 0 && value.skipPrefix !== false || value.expiry !== void 0 && !isExactText(value.expiry) || value.description !== void 0 && !isExactText(value.description)) {
+  if (!isExactText(value.service) || !isExactPath(value.path, value.actions) || value.space !== void 0 && !isExactText(value.space) || !Array.isArray(value.actions) || value.actions.length === 0 || !value.actions.every(isExactText) || new Set(value.actions).size !== value.actions.length || value.skipPrefix === true || value.skipPrefix !== void 0 && value.skipPrefix !== false || value.expiry !== void 0 && !isExactText(value.expiry) || value.description !== void 0 && !isExactText(value.description)) {
     return false;
   }
   return !("caveats" in value);
@@ -6624,8 +6624,12 @@ function isExactRecord(value) {
 function isExactText(value) {
   return typeof value === "string" && value.length > 0 && !value.includes("*");
 }
-function isExactPath(value) {
-  return isExactText(value) && value !== "/" && !value.endsWith("/");
+function isExactPath(value, actions) {
+  if (typeof value !== "string" || value === "/" || value.includes("*")) return false;
+  if (value === "" || value.endsWith("/")) {
+    return Array.isArray(actions) && actions.includes("tinycloud.kv/list");
+  }
+  return true;
 }
 function canonicalizeCaveats(caveats) {
   return [...caveats].map((caveat) => ({
@@ -7126,8 +7130,8 @@ function permissionRequestArtifactIdentity(record) {
     missing: record.requested
   });
 }
-function evaluateArtifactAuthority(granted, required, resolveSpace) {
-  return resolveSpace === void 0 ? evaluateAuthority(granted, required) : evaluateOperationAuthority(granted, required, resolveSpace);
+function evaluateArtifactAuthority(granted, required, resolveSpace2) {
+  return resolveSpace2 === void 0 ? evaluateAuthority(granted, required) : evaluateOperationAuthority(granted, required, resolveSpace2);
 }
 function defaultRequestId(now) {
   return `req_${now.getTime().toString(36)}_${(0, import_node_crypto2.randomUUID)().replace(/-/g, "")}`;
@@ -7252,7 +7256,7 @@ function operationSpaceResolver(node, ownerSpace) {
 function resolveOperationSpace(space, node, ownerSpace) {
   if (space.startsWith("tinycloud:")) return canonicalizeSpaceUri(space);
   const ownerSpaceId = ownerSpace === void 0 ? void 0 : ownedSpaceForName(ownerSpace, space);
-  if (ownerSpaceId !== void 0) return ownerSpaceId;
+  if (ownerSpaceId !== void 0) return canonicalizeSpaceUri(ownerSpaceId);
   const candidate = node;
   try {
     const resolved = candidate.resolveOwnedSpace?.(space);
@@ -7263,7 +7267,7 @@ function resolveOperationSpace(space, node, ownerSpace) {
   }
   if (typeof candidate.spaceId === "string") {
     const resolved = ownedSpaceForName(candidate.spaceId, space);
-    if (resolved !== void 0) return resolved;
+    if (resolved !== void 0) return canonicalizeSpaceUri(resolved);
   }
   const did = typeof candidate.did === "string" ? candidate.did : void 0;
   const pkh = did === void 0 ? null : (0, import_node_sdk.parsePkhDid)(did);
@@ -7501,14 +7505,14 @@ async function importRequestBoundDelegation(context, input) {
       );
     }
     const effectivePermissions = canonicalizeCapabilities(activated.effectivePermissions);
-    const resolveSpace = operationSpaceResolver(
+    const resolveSpace2 = operationSpaceResolver(
       context.runtime.node,
       context.summary.space
     );
     if (request.requested.length === 0 || !evaluateOperationAuthority(
       request.requested,
       effectivePermissions,
-      resolveSpace
+      resolveSpace2
     ).satisfied) {
       return operationFailure(
         "DELEGATION_REJECTED",
@@ -7528,7 +7532,7 @@ async function importRequestBoundDelegation(context, input) {
               result: audienceMismatch(state.sessionDid, sessionDid)
             };
           }
-          if (state.request.profile !== context.summary.profile || !samePrincipal(state.request.sessionDid, sessionDid) || normalizeHost(state.request.host) !== normalizeHost(host) || JSON.stringify(canonicalizeOperationCapabilities(state.request.requested, resolveSpace)) !== JSON.stringify(canonicalizeOperationCapabilities(request.requested, resolveSpace))) {
+          if (state.request.profile !== context.summary.profile || !samePrincipal(state.request.sessionDid, sessionDid) || normalizeHost(state.request.host) !== normalizeHost(host) || JSON.stringify(canonicalizeOperationCapabilities(state.request.requested, resolveSpace2)) !== JSON.stringify(canonicalizeOperationCapabilities(request.requested, resolveSpace2))) {
             return {
               records,
               result: operationFailure(
@@ -7806,6 +7810,374 @@ var init_auth = __esm({
   }
 });
 
+// src/operations/exploration.ts
+async function planAccountRegistryRead(context, path) {
+  return [{
+    service: "tinycloud.kv",
+    space: resolveSpace(context, "account"),
+    path,
+    actions: ["tinycloud.kv/get", "tinycloud.kv/list"]
+  }];
+}
+async function planKvList(context, input) {
+  const space = resolveNonSecretSpace(context, input.space);
+  return [{
+    service: "tinycloud.kv",
+    space,
+    path: input.prefix ?? "",
+    actions: ["tinycloud.kv/list"]
+  }];
+}
+async function planKvGet(context, input) {
+  const space = resolveNonSecretSpace(context, input.space);
+  return [{
+    service: "tinycloud.kv",
+    space,
+    path: input.key,
+    actions: ["tinycloud.kv/get"]
+  }];
+}
+async function executeAccountSpacesList(context, _input) {
+  try {
+    const entries = await readAccountRegistry(context, "spaces/");
+    if (!entries.ok) return nodeFailure("list account spaces");
+    const spaces = entries.records.map(({ key, value }) => projectAccountSpace(key, value)).sort((left, right) => left.name.localeCompare(right.name) || left.spaceId.localeCompare(right.spaceId));
+    return { status: "ok", output: { spaces, count: spaces.length } };
+  } catch {
+    return nodeFailure("list account spaces");
+  }
+}
+async function executeAccountApplicationsList(context, _input) {
+  try {
+    const entries = await readAccountRegistry(context, "applications/");
+    if (!entries.ok) return nodeFailure("list account applications");
+    const applications = entries.records.map(({ key, value }) => projectAccountApplication(key, value)).sort((left, right) => left.appId.localeCompare(right.appId));
+    return { status: "ok", output: { applications, count: applications.length } };
+  } catch {
+    return nodeFailure("list account applications");
+  }
+}
+async function executeKvList(context, input) {
+  try {
+    const runtime = runtimeContext(context);
+    const space = resolveNonSecretSpace(runtime, input.space);
+    const result = await runtimeNode(runtime).kvForSpace(space).list(
+      input.prefix === void 0 ? void 0 : { prefix: input.prefix }
+    );
+    if (!result.ok) return nodeFailure("list KV keys");
+    const keys = [...result.data.keys];
+    return {
+      status: "ok",
+      output: { space, prefix: input.prefix ?? "", keys, count: keys.length }
+    };
+  } catch (error) {
+    if (error instanceof OperationInvocationError) {
+      return { status: "error", error: error.operationError };
+    }
+    return nodeFailure("list KV keys");
+  }
+}
+async function executeKvGet(context, input) {
+  try {
+    const runtime = runtimeContext(context);
+    const space = resolveNonSecretSpace(runtime, input.space);
+    const result = await runtimeNode(runtime).kvForSpace(space).get(input.key);
+    if (!result.ok) return nodeFailure("read the KV value");
+    const encoded = encodeKvValue(result.data.data);
+    return {
+      status: "ok",
+      output: {
+        space,
+        key: input.key,
+        value: encoded.value,
+        encoding: encoded.encoding,
+        metadata: {
+          ...result.data.headers.etag === void 0 ? {} : { etag: result.data.headers.etag },
+          ...result.data.headers.contentType === void 0 ? {} : { contentType: result.data.headers.contentType },
+          ...result.data.headers.lastModified === void 0 ? {} : { lastModified: result.data.headers.lastModified },
+          ...result.data.headers.contentLength === void 0 ? {} : { contentLength: result.data.headers.contentLength }
+        }
+      }
+    };
+  } catch (error) {
+    if (error instanceof OperationInvocationError) {
+      return { status: "error", error: error.operationError };
+    }
+    return nodeFailure("read the KV value");
+  }
+}
+function runtimeContext(context) {
+  if (context.runtime === void 0) {
+    throw new TypeError("Authenticated operation runtime is unavailable.");
+  }
+  return context;
+}
+function runtimeNode(context) {
+  return runtimeContext(context).runtime.node;
+}
+function resolveSpace(context, space) {
+  return operationSpaceResolver(context.runtime.node, context.summary.space)(space);
+}
+function resolveNonSecretSpace(context, space) {
+  const resolved = resolveSpace(context, space);
+  if (resolved.split(":").at(-1)?.toLowerCase() === "secrets") {
+    throw new OperationInvocationError(operationError(
+      "INPUT_INVALID",
+      "Generic KV operations cannot access the TinyCloud secrets space; use tinycloud.secrets.get."
+    ));
+  }
+  return resolved;
+}
+async function readAccountRegistry(context, prefix) {
+  const runtime = runtimeContext(context);
+  const accountSpace = resolveSpace(runtime, "account");
+  const kv = runtimeNode(runtime).kvForSpace(accountSpace);
+  const listed = await kv.list({ prefix });
+  if (!listed.ok) return { ok: false };
+  const records = [];
+  for (const key of listed.data.keys) {
+    const loaded = await kv.get(key);
+    if (!loaded.ok || !isRecord2(loaded.data.data)) return { ok: false };
+    records.push({ key, value: loaded.data.data });
+  }
+  return { ok: true, records };
+}
+function projectAccountSpace(key, record) {
+  const suffix = key.startsWith("spaces/") ? key.slice("spaces/".length) : key;
+  const rawSpaceId = stringField2(record, "space_id", "spaceId") ?? suffix;
+  const rawName = stringField2(record, "name") ?? rawSpaceId.split(":").at(-1) ?? rawSpaceId;
+  const rawType = stringField2(record, "type");
+  const rawStatus = stringField2(record, "status");
+  const rawExpiresAt = record.expires_at ?? record.expiresAt;
+  const expiresAt = rawExpiresAt instanceof Date ? rawExpiresAt.toISOString() : typeof rawExpiresAt === "string" && !Number.isNaN(new Date(rawExpiresAt).getTime()) ? new Date(rawExpiresAt).toISOString() : void 0;
+  return {
+    spaceId: rawSpaceId,
+    name: rawName,
+    ownerDid: stringField2(record, "owner_did", "ownerDid", "owner") ?? "",
+    type: rawType === "owned" || rawType === "delegated" ? rawType : "discovered",
+    permissions: Array.isArray(record.permissions) ? record.permissions.filter((value) => typeof value === "string") : [],
+    status: rawStatus === "archived" ? "archived" : "active",
+    ...stringField2(record, "registered_at", "registeredAt") === void 0 ? {} : { registeredAt: stringField2(record, "registered_at", "registeredAt") },
+    ...stringField2(record, "updated_at", "updatedAt") === void 0 ? {} : { updatedAt: stringField2(record, "updated_at", "updatedAt") },
+    ...expiresAt === void 0 ? {} : { expiresAt }
+  };
+}
+function projectAccountApplication(key, record) {
+  const manifests = Array.isArray(record.manifests) ? record.manifests.filter(isRecord2) : [];
+  const first = manifests[0];
+  return {
+    appId: stringField2(record, "app_id", "appId") ?? stringField2(first, "app_id") ?? (key.startsWith("applications/") ? key.slice("applications/".length) : key),
+    manifests,
+    ...stringField2(record, "updated_at", "updatedAt") === void 0 ? {} : { updatedAt: stringField2(record, "updated_at", "updatedAt") },
+    ...stringField2(first, "name") === void 0 ? {} : { name: stringField2(first, "name") },
+    ...stringField2(first, "description") === void 0 ? {} : { description: stringField2(first, "description") },
+    ...stringField2(record, "manifest_hash", "manifestHash") === void 0 ? {} : { manifestHash: stringField2(record, "manifest_hash", "manifestHash") }
+  };
+}
+function stringField2(record, ...keys) {
+  if (record === void 0) return void 0;
+  for (const key of keys) {
+    if (typeof record[key] === "string") return record[key];
+  }
+  return void 0;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function encodeKvValue(value) {
+  if (value instanceof Uint8Array) {
+    return { value: Buffer.from(value).toString("base64"), encoding: "base64" };
+  }
+  return {
+    value,
+    encoding: typeof value === "string" ? "text" : "json"
+  };
+}
+function nodeFailure(action) {
+  return {
+    status: "error",
+    error: operationError(
+      "NODE_ERROR",
+      `The TinyCloud node could not ${action}.`,
+      { retryable: true }
+    )
+  };
+}
+var import_zod4, EmptyInputSchema2, SpaceSchema, PrefixSchema, KeySchema, AccountSpaceSchema, AccountSpacesOutputSchema, AccountApplicationSchema, AccountApplicationsOutputSchema, KvListInputSchema, KvListOutputSchema, KvGetInputSchema, KvGetOutputSchema, AUTHENTICATED_POSTURES, EXPLORATION_EXPOSURE, ACCOUNT_SPACES_SENSITIVITY, ACCOUNT_APPLICATIONS_SENSITIVITY, KV_LIST_SENSITIVITY, KV_GET_SENSITIVITY, explorationOperationDefinitions;
+var init_exploration = __esm({
+  "src/operations/exploration.ts"() {
+    "use strict";
+    import_zod4 = require("zod");
+    init_errors();
+    init_secrets();
+    EmptyInputSchema2 = import_zod4.z.object({}).strict();
+    SpaceSchema = import_zod4.z.string().min(1).refine(
+      (space) => (/^[A-Za-z0-9_-]+$/.test(space) || space.startsWith("tinycloud:")) && !space.includes("*"),
+      "Invalid TinyCloud space."
+    );
+    PrefixSchema = import_zod4.z.string().refine(
+      (prefix) => prefix !== "/" && !prefix.includes("*"),
+      "Invalid KV prefix."
+    );
+    KeySchema = import_zod4.z.string().min(1).refine(
+      (key) => key !== "/" && !key.endsWith("/") && !key.includes("*"),
+      "Invalid KV key."
+    );
+    AccountSpaceSchema = import_zod4.z.object({
+      spaceId: import_zod4.z.string().min(1),
+      name: import_zod4.z.string().min(1),
+      ownerDid: import_zod4.z.string(),
+      type: import_zod4.z.enum(["owned", "delegated", "discovered"]),
+      permissions: import_zod4.z.array(import_zod4.z.string()),
+      status: import_zod4.z.enum(["active", "archived"]),
+      registeredAt: import_zod4.z.string().optional(),
+      updatedAt: import_zod4.z.string().optional(),
+      expiresAt: import_zod4.z.string().datetime({ offset: true }).optional()
+    }).strict();
+    AccountSpacesOutputSchema = import_zod4.z.object({
+      spaces: import_zod4.z.array(AccountSpaceSchema),
+      count: import_zod4.z.number().int().nonnegative()
+    }).strict();
+    AccountApplicationSchema = import_zod4.z.object({
+      appId: import_zod4.z.string().min(1),
+      manifests: import_zod4.z.array(import_zod4.z.record(import_zod4.z.unknown())),
+      updatedAt: import_zod4.z.string().optional(),
+      name: import_zod4.z.string().optional(),
+      description: import_zod4.z.string().optional(),
+      manifestHash: import_zod4.z.string().optional()
+    }).strict();
+    AccountApplicationsOutputSchema = import_zod4.z.object({
+      applications: import_zod4.z.array(AccountApplicationSchema),
+      count: import_zod4.z.number().int().nonnegative()
+    }).strict();
+    KvListInputSchema = import_zod4.z.object({
+      space: SpaceSchema,
+      prefix: PrefixSchema.optional()
+    }).strict();
+    KvListOutputSchema = import_zod4.z.object({
+      space: import_zod4.z.string().min(1),
+      prefix: import_zod4.z.string(),
+      keys: import_zod4.z.array(import_zod4.z.string()),
+      count: import_zod4.z.number().int().nonnegative()
+    }).strict();
+    KvGetInputSchema = import_zod4.z.object({
+      space: SpaceSchema,
+      key: KeySchema
+    }).strict();
+    KvGetOutputSchema = import_zod4.z.object({
+      space: import_zod4.z.string().min(1),
+      key: import_zod4.z.string().min(1),
+      value: import_zod4.z.union([
+        import_zod4.z.string(),
+        import_zod4.z.number(),
+        import_zod4.z.boolean(),
+        import_zod4.z.null(),
+        import_zod4.z.array(import_zod4.z.unknown()),
+        import_zod4.z.record(import_zod4.z.unknown())
+      ]),
+      encoding: import_zod4.z.enum(["json", "text", "base64"]),
+      metadata: import_zod4.z.object({
+        etag: import_zod4.z.string().optional(),
+        contentType: import_zod4.z.string().optional(),
+        lastModified: import_zod4.z.string().optional(),
+        contentLength: import_zod4.z.number().int().nonnegative().optional()
+      }).strict()
+    }).strict();
+    AUTHENTICATED_POSTURES = [
+      "owner-openkey",
+      "delegate-session",
+      "local-owner-key"
+    ];
+    EXPLORATION_EXPOSURE = {
+      cli: {
+        status: "excluded",
+        reason: "Existing account and KV Commander commands remain the CLI surface."
+      },
+      mcp: { status: "required" },
+      skill: { status: "required" },
+      docs: { status: "required" }
+    };
+    ACCOUNT_SPACES_SENSITIVITY = {
+      input: [],
+      output: ["/spaces"]
+    };
+    ACCOUNT_APPLICATIONS_SENSITIVITY = {
+      input: [],
+      output: ["/applications"]
+    };
+    KV_LIST_SENSITIVITY = {
+      input: ["/prefix"],
+      output: ["/keys"]
+    };
+    KV_GET_SENSITIVITY = {
+      input: ["/key"],
+      output: ["/value"]
+    };
+    explorationOperationDefinitions = [
+      {
+        id: "tinycloud.account.spaces.list",
+        version: 1,
+        title: "List TinyCloud account spaces",
+        description: "List the spaces registered in the selected owner's TinyCloud account.",
+        input: EmptyInputSchema2,
+        output: AccountSpacesOutputSchema,
+        effects: ["read"],
+        runtime: "authenticated",
+        postures: AUTHENTICATED_POSTURES,
+        exposure: EXPLORATION_EXPOSURE,
+        sensitivity: ACCOUNT_SPACES_SENSITIVITY,
+        authority: (context) => planAccountRegistryRead(context, "spaces/"),
+        execute: executeAccountSpacesList
+      },
+      {
+        id: "tinycloud.account.applications.list",
+        version: 1,
+        title: "List TinyCloud account applications",
+        description: "List the application manifests registered in the selected owner's TinyCloud account.",
+        input: EmptyInputSchema2,
+        output: AccountApplicationsOutputSchema,
+        effects: ["read"],
+        runtime: "authenticated",
+        postures: AUTHENTICATED_POSTURES,
+        exposure: EXPLORATION_EXPOSURE,
+        sensitivity: ACCOUNT_APPLICATIONS_SENSITIVITY,
+        authority: (context) => planAccountRegistryRead(context, "applications/"),
+        execute: executeAccountApplicationsList
+      },
+      {
+        id: "tinycloud.kv.list",
+        version: 1,
+        title: "List TinyCloud KV keys",
+        description: "List keys at one exact prefix in a delegated TinyCloud space.",
+        input: KvListInputSchema,
+        output: KvListOutputSchema,
+        effects: ["read"],
+        runtime: "authenticated",
+        postures: AUTHENTICATED_POSTURES,
+        exposure: EXPLORATION_EXPOSURE,
+        sensitivity: KV_LIST_SENSITIVITY,
+        authority: planKvList,
+        execute: executeKvList
+      },
+      {
+        id: "tinycloud.kv.get",
+        version: 1,
+        title: "Get a TinyCloud KV value",
+        description: "Read one exact key from a delegated non-secrets TinyCloud space.",
+        input: KvGetInputSchema,
+        output: KvGetOutputSchema,
+        effects: ["read"],
+        runtime: "authenticated",
+        postures: AUTHENTICATED_POSTURES,
+        exposure: EXPLORATION_EXPOSURE,
+        sensitivity: KV_GET_SENSITIVITY,
+        authority: planKvGet,
+        execute: executeKvGet
+      }
+    ];
+  }
+});
+
 // src/operations/secrets-get.ts
 async function planSecretGet(context, input) {
   const reference = resolveSecretReferenceForOperation(
@@ -7958,26 +8330,26 @@ function resolveEncryptionNetworkId(node, space) {
     )
   );
 }
-var import_zod4, SecretsGetInputSchema, SecretsGetOutputSchema, SECRETS_GET_POSTURES, SECRETS_GET_EXPOSURE, SECRETS_GET_SENSITIVITY, secretsGetOperationDefinition, secretsGetOperationDefinitions;
+var import_zod5, SecretsGetInputSchema, SecretsGetOutputSchema, SECRETS_GET_POSTURES, SECRETS_GET_EXPOSURE, SECRETS_GET_SENSITIVITY, secretsGetOperationDefinition, secretsGetOperationDefinitions;
 var init_secrets_get = __esm({
   "src/operations/secrets-get.ts"() {
     "use strict";
-    import_zod4 = require("zod");
+    import_zod5 = require("zod");
     init_errors();
     init_secrets();
-    SecretsGetInputSchema = import_zod4.z.object({
-      name: import_zod4.z.string(),
-      scope: import_zod4.z.string().optional(),
-      space: import_zod4.z.string().optional()
+    SecretsGetInputSchema = import_zod5.z.object({
+      name: import_zod5.z.string(),
+      scope: import_zod5.z.string().optional(),
+      space: import_zod5.z.string().optional()
     }).strict().superRefine((input, context) => {
       try {
         resolveSecretReference(input);
       } catch {
-        context.addIssue({ code: import_zod4.z.ZodIssueCode.custom, message: "Invalid secret reference." });
+        context.addIssue({ code: import_zod5.z.ZodIssueCode.custom, message: "Invalid secret reference." });
       }
     }).transform(normalizeSecretsGetInput);
-    SecretsGetOutputSchema = import_zod4.z.object({
-      value: import_zod4.z.string()
+    SecretsGetOutputSchema = import_zod5.z.object({
+      value: import_zod5.z.string()
     }).strict();
     SECRETS_GET_POSTURES = [
       "owner-openkey",
@@ -8070,7 +8442,7 @@ async function inspectPinnedProfileStatus(context, _input) {
 async function pinnedProfileExists(profile) {
   try {
     const storedProfile = await readProfile(profile);
-    return isRecord2(storedProfile);
+    return isRecord3(storedProfile);
   } catch {
     return false;
   }
@@ -8090,7 +8462,7 @@ async function countLiveAdditionalDelegations(profile) {
 }
 function summarizeSession(session) {
   if (session === null) return { present: false, expired: null, expiresAt: null };
-  if (!isRecord2(session)) throw new TypeError("Invalid session store.");
+  if (!isRecord3(session)) throw new TypeError("Invalid session store.");
   const expiry = extractSessionExpiry(session);
   if (expiry === null) return { present: true, expired: null, expiresAt: null };
   return {
@@ -8100,7 +8472,7 @@ function summarizeSession(session) {
   };
 }
 function storedDelegationExpiry(entry) {
-  if (!isRecord2(entry) || !isRecord2(entry.delegation) || !("expiry" in entry.delegation)) {
+  if (!isRecord3(entry) || !isRecord3(entry.delegation) || !("expiry" in entry.delegation)) {
     throw new TypeError("Invalid stored delegation.");
   }
   return parseExpiry(entry.delegation.expiry);
@@ -8129,37 +8501,37 @@ function profileNotFound(profile) {
     )
   };
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var import_zod5, StatusInputSchema, StatusOutputSchema, STATUS_POSTURES, STATUS_EXPOSURE, STATUS_SENSITIVITY, statusOperationDefinitions;
+var import_zod6, StatusInputSchema, StatusOutputSchema, STATUS_POSTURES, STATUS_EXPOSURE, STATUS_SENSITIVITY, statusOperationDefinitions;
 var init_status = __esm({
   "src/operations/status.ts"() {
     "use strict";
-    import_zod5 = require("zod");
+    import_zod6 = require("zod");
     init_errors();
     init_state();
-    StatusInputSchema = import_zod5.z.object({}).strict();
-    StatusOutputSchema = import_zod5.z.object({
-      profile: import_zod5.z.string().min(1),
-      host: import_zod5.z.string().min(1),
-      posture: import_zod5.z.enum([
+    StatusInputSchema = import_zod6.z.object({}).strict();
+    StatusOutputSchema = import_zod6.z.object({
+      profile: import_zod6.z.string().min(1),
+      host: import_zod6.z.string().min(1),
+      posture: import_zod6.z.enum([
         "owner-openkey",
         "delegate-session",
         "local-owner-key",
         "unauthenticated"
       ]),
-      operatorType: import_zod5.z.enum(["human", "agent"]).optional(),
-      principalDid: import_zod5.z.string().min(1).optional(),
-      sessionDid: import_zod5.z.string().min(1).optional(),
-      ownerDid: import_zod5.z.string().min(1).optional(),
-      space: import_zod5.z.string().min(1).optional(),
-      session: import_zod5.z.object({
-        present: import_zod5.z.boolean(),
-        expired: import_zod5.z.boolean().nullable(),
-        expiresAt: import_zod5.z.string().datetime({ offset: true }).nullable()
+      operatorType: import_zod6.z.enum(["human", "agent"]).optional(),
+      principalDid: import_zod6.z.string().min(1).optional(),
+      sessionDid: import_zod6.z.string().min(1).optional(),
+      ownerDid: import_zod6.z.string().min(1).optional(),
+      space: import_zod6.z.string().min(1).optional(),
+      session: import_zod6.z.object({
+        present: import_zod6.z.boolean(),
+        expired: import_zod6.z.boolean().nullable(),
+        expiresAt: import_zod6.z.string().datetime({ offset: true }).nullable()
       }).strict(),
-      liveAdditionalDelegationCount: import_zod5.z.number().int().nonnegative()
+      liveAdditionalDelegationCount: import_zod6.z.number().int().nonnegative()
     }).strict();
     STATUS_POSTURES = [
       "owner-openkey",
@@ -8199,6 +8571,7 @@ function registeredOperationDefinitions() {
   operationDefinitions ?? (operationDefinitions = [
     ...statusOperationDefinitions,
     ...authOperationDefinitions,
+    ...explorationOperationDefinitions,
     ...secretsGetOperationDefinitions
   ]);
   return operationDefinitions;
@@ -8229,6 +8602,7 @@ var init_registry = __esm({
   "src/registry.ts"() {
     "use strict";
     init_auth();
+    init_exploration();
     init_secrets_get();
     init_status();
   }
@@ -8309,9 +8683,9 @@ function isOperatorType(value) {
   return value === "human" || value === "agent";
 }
 function isStoredProfile(value) {
-  return isRecord3(value) && isNonEmptyString(value.name) && isNonEmptyString(value.host) && typeof value.chainId === "number" && Number.isFinite(value.chainId) && isNonEmptyString(value.spaceName) && isNonEmptyString(value.did) && isNonEmptyString(value.createdAt) && isOptionalNonEmptyString(value.sessionDid) && isOptionalNonEmptyString(value.ownerDid) && isOptionalNonEmptyString(value.spaceId) && isOptionalPosture(value.posture) && isOptionalOperatorType(value.operatorType) && isOptionalAuthMethod(value.authMethod) && isOptionalNonEmptyString(value.defaultSpace) && isOptionalNonEmptyString(value.privateKey) && isOptionalNonEmptyString(value.address) && isOptionalNonEmptyString(value.openkeyHost);
+  return isRecord4(value) && isNonEmptyString(value.name) && isNonEmptyString(value.host) && typeof value.chainId === "number" && Number.isFinite(value.chainId) && isNonEmptyString(value.spaceName) && isNonEmptyString(value.did) && isNonEmptyString(value.createdAt) && isOptionalNonEmptyString(value.sessionDid) && isOptionalNonEmptyString(value.ownerDid) && isOptionalNonEmptyString(value.spaceId) && isOptionalPosture(value.posture) && isOptionalOperatorType(value.operatorType) && isOptionalAuthMethod(value.authMethod) && isOptionalNonEmptyString(value.defaultSpace) && isOptionalNonEmptyString(value.privateKey) && isOptionalNonEmptyString(value.address) && isOptionalNonEmptyString(value.openkeyHost);
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNonEmptyString(value) {
@@ -8475,7 +8849,7 @@ function spaceForAuthenticatedPrincipal(principal2) {
 function normalizeSession(session, key) {
   const header = session.delegationHeader;
   const jwk = hasPrivateParameter(session.jwk) ? session.jwk : key;
-  if (!isRecord4(header) || typeof header.Authorization !== "string" || typeof session.delegationCid !== "string" || typeof session.spaceId !== "string" || !hasPrivateParameter(jwk) || typeof session.verificationMethod !== "string") {
+  if (!isRecord5(header) || typeof header.Authorization !== "string" || typeof session.delegationCid !== "string" || typeof session.spaceId !== "string" || !hasPrivateParameter(jwk) || typeof session.verificationMethod !== "string") {
     return void 0;
   }
   return {
@@ -8493,7 +8867,7 @@ function normalizeSession(session, key) {
 }
 function normalizeStoredDelegation(entry) {
   const raw = entry.delegation;
-  if (!isRecord4(raw) || !isRecord4(raw.delegationHeader)) return void 0;
+  if (!isRecord5(raw) || !isRecord5(raw.delegationHeader)) return void 0;
   const expiry = parseExpiry2(raw.expiry);
   if (expiry === void 0 || typeof raw.cid !== "string" || typeof raw.spaceId !== "string" || typeof raw.path !== "string" || !Array.isArray(raw.actions) || !raw.actions.every((action) => typeof action === "string") || typeof raw.delegateDID !== "string" || typeof raw.ownerAddress !== "string" || typeof raw.chainId !== "number" || typeof raw.delegationHeader.Authorization !== "string") {
     return void 0;
@@ -8505,13 +8879,13 @@ function parseExpiry2(value) {
   return expiry !== void 0 && !Number.isNaN(expiry.getTime()) ? expiry : void 0;
 }
 function hasPrivateParameter(value) {
-  return isRecord4(value) && typeof value.d === "string" && value.d.length > 0;
+  return isRecord5(value) && typeof value.d === "string" && value.d.length > 0;
 }
 function normalizeDid(value) {
   if (typeof value !== "string" || value.length === 0) return void 0;
   return value.split("#", 1)[0];
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function failed(context, error) {
@@ -8921,9 +9295,9 @@ async function invokeOperationWithLocalAuthorityRetry(operationId, operationVers
       )
     );
   }
-  const runtimeContext = prepared.runtimeResolution.context;
-  if (runtimeContext.runtime === void 0) return internalOperationErrorResult(prepared);
-  const operationContext = runtimeContext;
+  const runtimeContext2 = prepared.runtimeResolution.context;
+  if (runtimeContext2.runtime === void 0) return internalOperationErrorResult(prepared);
+  const operationContext = runtimeContext2;
   let planned;
   try {
     planned = exactCapabilities2(await prepared.definition.authority(
@@ -8980,7 +9354,7 @@ async function invokeOperationWithLocalAuthorityRetry(operationId, operationVers
       operationContext.runtime.node,
       first.missing
     );
-    const resolveSpace = operationSpaceResolver(
+    const resolveSpace2 = operationSpaceResolver(
       operationContext.runtime.node,
       operationContext.summary.space
     );
@@ -8988,7 +9362,7 @@ async function invokeOperationWithLocalAuthorityRetry(operationId, operationVers
       operationContext.runtime.node,
       first.missing,
       planned,
-      resolveSpace
+      resolveSpace2
     );
     if (refreshedGranted === void 0) {
       return localAuthorityFailure(prepared);
@@ -9128,14 +9502,14 @@ async function prepareInvocation(operationId, operationVersion, invocationTarget
 }
 async function executePreparedInvocation(prepared, options = {}) {
   const { operation, definition, parsedInput, runtimeResolution } = prepared;
-  const runtimeContext = runtimeResolution.context.runtime === void 0 ? void 0 : runtimeResolution.context;
-  const resolveSpace = runtimeContext === void 0 ? void 0 : operationSpaceResolver(
-    runtimeContext.runtime.node,
-    runtimeContext.summary.space
+  const runtimeContext2 = runtimeResolution.context.runtime === void 0 ? void 0 : runtimeResolution.context;
+  const resolveSpace2 = runtimeContext2 === void 0 ? void 0 : operationSpaceResolver(
+    runtimeContext2.runtime.node,
+    runtimeContext2.summary.space
   );
   try {
     const planned = await definition.authority(
-      runtimeContext ?? runtimeResolution.context,
+      runtimeContext2 ?? runtimeResolution.context,
       parsedInput.data
     );
     const required = exactCapabilities2(planned);
@@ -9150,12 +9524,12 @@ async function executePreparedInvocation(prepared, options = {}) {
       );
     }
     const evaluation = evaluateOperationAuthority(
-      runtimeContext?.runtime.granted ?? [],
+      runtimeContext2?.runtime.granted ?? [],
       required,
-      resolveSpace
+      resolveSpace2
     );
     if (!evaluation.satisfied) {
-      if (runtimeContext === void 0) {
+      if (runtimeContext2 === void 0) {
         return errorResult(
           operation,
           runtimeResolution.context.summary,
@@ -9165,13 +9539,13 @@ async function executePreparedInvocation(prepared, options = {}) {
       if (options.deferAuthorityRequest) {
         try {
           const request = buildPermissionRequestArtifact({
-            profile: runtimeContext.summary.profile,
-            host: runtimeContext.summary.host,
-            sessionDid: runtimeContext.summary.sessionDid,
-            posture: runtimeContext.summary.posture,
-            operatorType: runtimeContext.summary.operatorType ?? "human",
-            ...runtimeContext.summary.ownerDid === void 0 ? {} : { ownerDid: runtimeContext.summary.ownerDid },
-            ...runtimeContext.summary.space === void 0 ? {} : { spaceId: runtimeContext.summary.space },
+            profile: runtimeContext2.summary.profile,
+            host: runtimeContext2.summary.host,
+            sessionDid: runtimeContext2.summary.sessionDid,
+            posture: runtimeContext2.summary.posture,
+            operatorType: runtimeContext2.summary.operatorType ?? "human",
+            ...runtimeContext2.summary.ownerDid === void 0 ? {} : { ownerDid: runtimeContext2.summary.ownerDid },
+            ...runtimeContext2.summary.space === void 0 ? {} : { spaceId: runtimeContext2.summary.space },
             missing: evaluation.missing
           });
           return authorityRequiredResult(
@@ -9180,7 +9554,7 @@ async function executePreparedInvocation(prepared, options = {}) {
             parsedInput.data,
             request,
             evaluation.missing,
-            runtimeContext.runtime.node
+            runtimeContext2.runtime.node
           );
         } catch {
           return errorResult(
@@ -9191,7 +9565,7 @@ async function executePreparedInvocation(prepared, options = {}) {
         }
       }
       const authority = await persistAuthorityRequest(
-        runtimeContext,
+        runtimeContext2,
         evaluation.missing
       );
       if (authority.status === "error") {
@@ -9207,7 +9581,7 @@ async function executePreparedInvocation(prepared, options = {}) {
         parsedInput.data,
         authority.request,
         authority.missing,
-        runtimeContext.runtime.node
+        runtimeContext2.runtime.node
       );
     }
     const outcome = await definition.execute(
@@ -9239,7 +9613,7 @@ async function executePreparedInvocation(prepared, options = {}) {
         if (hinted === void 0 || !isExactCapabilityMemberSubset(
           hinted,
           required,
-          resolveSpace
+          resolveSpace2
         )) {
           return errorResult(
             operation,
@@ -9250,7 +9624,7 @@ async function executePreparedInvocation(prepared, options = {}) {
             )
           );
         }
-        if (runtimeContext === void 0) {
+        if (runtimeContext2 === void 0) {
           return errorResult(
             operation,
             runtimeResolution.context.summary,
@@ -9260,13 +9634,13 @@ async function executePreparedInvocation(prepared, options = {}) {
         if (options.deferAuthorityRequest) {
           try {
             const request = buildPermissionRequestArtifact({
-              profile: runtimeContext.summary.profile,
-              host: runtimeContext.summary.host,
-              sessionDid: runtimeContext.summary.sessionDid,
-              posture: runtimeContext.summary.posture,
-              operatorType: runtimeContext.summary.operatorType ?? "human",
-              ...runtimeContext.summary.ownerDid === void 0 ? {} : { ownerDid: runtimeContext.summary.ownerDid },
-              ...runtimeContext.summary.space === void 0 ? {} : { spaceId: runtimeContext.summary.space },
+              profile: runtimeContext2.summary.profile,
+              host: runtimeContext2.summary.host,
+              sessionDid: runtimeContext2.summary.sessionDid,
+              posture: runtimeContext2.summary.posture,
+              operatorType: runtimeContext2.summary.operatorType ?? "human",
+              ...runtimeContext2.summary.ownerDid === void 0 ? {} : { ownerDid: runtimeContext2.summary.ownerDid },
+              ...runtimeContext2.summary.space === void 0 ? {} : { spaceId: runtimeContext2.summary.space },
               missing: hinted
             });
             return authorityRequiredResult(
@@ -9275,7 +9649,7 @@ async function executePreparedInvocation(prepared, options = {}) {
               parsedInput.data,
               request,
               hinted,
-              runtimeContext.runtime.node,
+              runtimeContext2.runtime.node,
               outcome.requiresCallerInput ?? false
             );
           } catch {
@@ -9287,7 +9661,7 @@ async function executePreparedInvocation(prepared, options = {}) {
           }
         }
         const authority = await persistAuthorityRequest(
-          runtimeContext,
+          runtimeContext2,
           hinted,
           true
         );
@@ -9304,7 +9678,7 @@ async function executePreparedInvocation(prepared, options = {}) {
           parsedInput.data,
           authority.request,
           authority.missing,
-          runtimeContext.runtime.node,
+          runtimeContext2.runtime.node,
           outcome.requiresCallerInput ?? false
         );
       }
@@ -9407,12 +9781,12 @@ async function persistAuthorityRequest(context, missing, force = false) {
     };
   }
   try {
-    const resolveSpace = operationSpaceResolver(
+    const resolveSpace2 = operationSpaceResolver(
       context.runtime.node,
       context.summary.space
     );
-    const canonicalMissing = canonicalizeOperationCapabilities(missing, resolveSpace);
-    const canonicalGranted = canonicalizeOperationCapabilities(context.runtime.granted, resolveSpace);
+    const canonicalMissing = canonicalizeOperationCapabilities(missing, resolveSpace2);
+    const canonicalGranted = canonicalizeOperationCapabilities(context.runtime.granted, resolveSpace2);
     const resolution = await createOrReusePermissionRequest({
       profile: context.summary.profile,
       posture: context.summary.posture,
@@ -9423,7 +9797,7 @@ async function persistAuthorityRequest(context, missing, force = false) {
       ...context.summary.space === void 0 ? {} : { spaceId: context.summary.space },
       missing: canonicalMissing,
       granted: force ? [] : canonicalGranted,
-      resolveSpace
+      resolveSpace: resolveSpace2
     });
     if (resolution.status !== "created") {
       return {
@@ -9502,7 +9876,7 @@ function canonicalPkhOwner(space) {
 }
 function isExactLocalSecretsGetPlan(prepared, planned, context) {
   if (prepared.definition.id !== "tinycloud.secrets.get" || prepared.definition.version !== 1 || JSON.stringify(prepared.definition.effects) !== JSON.stringify(["read", "local_write"])) return "invalid";
-  const resolveSpace = operationSpaceResolver(context.runtime.node, context.summary.space);
+  const resolveSpace2 = operationSpaceResolver(context.runtime.node, context.summary.space);
   let reference;
   try {
     reference = resolveSecretReferenceForOperation(
@@ -9515,7 +9889,7 @@ function isExactLocalSecretsGetPlan(prepared, planned, context) {
   }
   const canonicalPlan = canonicalizeOperationCapabilities(
     planned,
-    resolveSpace
+    resolveSpace2
   );
   if (canonicalPlan.length !== 2) return "invalid";
   const kv = canonicalPlan.find((permission) => permission.service === "tinycloud.kv");
@@ -9528,7 +9902,7 @@ function isExactLocalSecretsGetPlan(prepared, planned, context) {
   }
   if (JSON.stringify(kv) !== JSON.stringify({
     service: "tinycloud.kv",
-    space: resolveSpace(reference.space),
+    space: resolveSpace2(reference.space),
     path: reference.permissionPath,
     actions: ["tinycloud.kv/get"]
   })) return "invalid";
@@ -9539,7 +9913,7 @@ function isExactLocalSecretsGetPlan(prepared, planned, context) {
   }) || typeof decrypt.path !== "string" || !decrypt.path.startsWith("urn:tinycloud:encryption:")) return "invalid";
   return "valid";
 }
-function refreshLiveRuntimeAuthority(node, requested, planned, resolveSpace) {
+function refreshLiveRuntimeAuthority(node, requested, planned, resolveSpace2) {
   const candidate = node;
   if (typeof candidate.hasRuntimePermissions !== "function") return void 0;
   if (candidate.hasRuntimePermissions([...requested]) !== true) return void 0;
@@ -9550,14 +9924,14 @@ function refreshLiveRuntimeAuthority(node, requested, planned, resolveSpace) {
   const exactActivated = validateExactCapabilities(activated);
   if (exactActivated === void 0) return void 0;
   const selectedActivated = exactActivated.filter(
-    (permission) => isExactCapabilityMemberSubset([permission], planned, resolveSpace)
+    (permission) => isExactCapabilityMemberSubset([permission], planned, resolveSpace2)
   );
-  if (!isExactCapabilityMemberSubset(requested, selectedActivated, resolveSpace)) return void 0;
+  if (!isExactCapabilityMemberSubset(requested, selectedActivated, resolveSpace2)) return void 0;
   const combined = canonicalizeOperationCapabilities(
     [...base, ...selectedActivated],
-    resolveSpace
+    resolveSpace2
   );
-  return evaluateOperationAuthority(combined, planned, resolveSpace).satisfied ? combined : void 0;
+  return evaluateOperationAuthority(combined, planned, resolveSpace2).satisfied ? combined : void 0;
 }
 function localAuthorityFailure(prepared) {
   return errorResult(