@tinycloud/replica 0.4.4-beta.0 → 0.4.5-beta.0

package/dist/kv-storage.js

@@ -1,563 +1,4 @@
-// ../bootstrap/dist/index.js
-var CAPABILITIES = [
-  { urn: "tinycloud.kv/get", service: "tinycloud.kv", status: "active" },
-  { urn: "tinycloud.kv/list", service: "tinycloud.kv", status: "active" },
-  { urn: "tinycloud.kv/metadata", service: "tinycloud.kv", status: "active" },
-  { urn: "tinycloud.kv/put", service: "tinycloud.kv", status: "active" },
-  { urn: "tinycloud.kv/del", service: "tinycloud.kv", status: "active" },
-  { urn: "tinycloud.kv/delete", service: "tinycloud.kv", status: "deprecated-alias", aliasOf: "tinycloud.kv/del" },
-  { urn: "tinycloud.kv/sync", service: "tinycloud.kv", status: "active" },
-  { urn: "tinycloud.kv/retain", service: "tinycloud.kv", status: "active" },
-  { urn: "tinycloud.sql/read", service: "tinycloud.sql", status: "active" },
-  { urn: "tinycloud.sql/select", service: "tinycloud.sql", status: "deprecated-alias", aliasOf: "tinycloud.sql/read" },
-  { urn: "tinycloud.sql/write", service: "tinycloud.sql", status: "active" },
-  { urn: "tinycloud.sql/schema", service: "tinycloud.sql", status: "active" },
-  { urn: "tinycloud.sql/admin", service: "tinycloud.sql", status: "active", implies: ["tinycloud.sql/schema"] },
-  { urn: "tinycloud.sql/*", service: "tinycloud.sql", status: "active", implies: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema", "tinycloud.sql/admin"] },
-  { urn: "tinycloud.duckdb/read", service: "tinycloud.duckdb", status: "active" },
-  { urn: "tinycloud.duckdb/write", service: "tinycloud.duckdb", status: "active" },
-  { urn: "tinycloud.duckdb/admin", service: "tinycloud.duckdb", status: "active" },
-  { urn: "tinycloud.duckdb/import", service: "tinycloud.duckdb", status: "active" },
-  { urn: "tinycloud.duckdb/export", service: "tinycloud.duckdb", status: "active" },
-  { urn: "tinycloud.duckdb/select", service: "tinycloud.duckdb", status: "deprecated-alias", aliasOf: "tinycloud.duckdb/read" },
-  { urn: "tinycloud.duckdb/*", service: "tinycloud.duckdb", status: "active", implies: ["tinycloud.duckdb/read", "tinycloud.duckdb/write", "tinycloud.duckdb/admin", "tinycloud.duckdb/import", "tinycloud.duckdb/export"] },
-  { urn: "tinycloud.capabilities/read", service: "tinycloud.capabilities", status: "active" },
-  { urn: "tinycloud.delegation/status", service: "tinycloud.delegation", status: "active" },
-  { urn: "tinycloud.delegation/list", service: "tinycloud.delegation", status: "active" },
-  { urn: "tinycloud.hooks/subscribe", service: "tinycloud.hooks", status: "active" },
-  { urn: "tinycloud.hooks/register", service: "tinycloud.hooks", status: "active" },
-  { urn: "tinycloud.hooks/list", service: "tinycloud.hooks", status: "active" },
-  { urn: "tinycloud.hooks/unregister", service: "tinycloud.hooks", status: "active" },
-  { urn: "tinycloud.encryption/decrypt", service: "tinycloud.encryption", status: "active" },
-  { urn: "tinycloud.encryption/network.create", service: "tinycloud.encryption", status: "active" },
-  { urn: "tinycloud.encryption/network.revoke", service: "tinycloud.encryption", status: "active" },
-  { urn: "tinycloud.space/host", service: "tinycloud.space", status: "active" },
-  { urn: "tinycloud.space/create", service: "tinycloud.space", status: "active" },
-  { urn: "tinycloud.space/list", service: "tinycloud.space", status: "active" },
-  { urn: "tinycloud.space/info", service: "tinycloud.space", status: "active" },
-  { urn: "tinycloud.vfs/get", service: "tinycloud.vfs", status: "reserved" },
-  { urn: "tinycloud.vfs/list", service: "tinycloud.vfs", status: "reserved" },
-  { urn: "tinycloud.vfs/metadata", service: "tinycloud.vfs", status: "reserved" },
-  { urn: "tinycloud.vfs/put", service: "tinycloud.vfs", status: "reserved" },
-  { urn: "tinycloud.vfs/delete", service: "tinycloud.vfs", status: "reserved" }
-];
-function actionKey(action) {
-  if (action === "*") return "ALL";
-  return action.toUpperCase().replace(/[^A-Z0-9]/g, "_");
-}
-function serviceOf(urn) {
-  return urn.slice("tinycloud.".length, urn.indexOf("/"));
-}
-function actionOf(urn) {
-  return urn.slice(urn.indexOf("/") + 1);
-}
-function deriveServiceConstants(service) {
-  const out = {};
-  for (const entry of CAPABILITIES) {
-    if (serviceOf(entry.urn) !== service) continue;
-    out[actionKey(actionOf(entry.urn))] = entry.urn;
-  }
-  return out;
-}
-var KV = deriveServiceConstants("kv");
-var SQL = {
-  ...deriveServiceConstants("sql"),
-  EXECUTE: "tinycloud.sql/execute",
-  EXPORT: "tinycloud.sql/export"
-};
-var DUCKDB = {
-  ...deriveServiceConstants("duckdb"),
-  DESCRIBE: "tinycloud.duckdb/describe",
-  EXECUTE: "tinycloud.duckdb/execute"
-};
-var CAPABILITIES2 = deriveServiceConstants("capabilities");
-var HOOKS = deriveServiceConstants("hooks");
-var ENCRYPTION = deriveServiceConstants("encryption");
-var SPACE = deriveServiceConstants("space");
-var CAPABILITY_REGISTRY = CAPABILITIES;
-var DEFAULT_MANIFEST_SPACE = "applications";
-var ACCOUNT_REGISTRY_SPACE = "account";
-var ACCOUNT_REGISTRY_PATH = "applications/";
-var SECRETS_SPACE = "secrets";
-var BOOTSTRAP_DEFAULT_SPACE = "default";
-var BOOTSTRAP_PUBLIC_SPACE = "public";
-var AGENTS_SPACE = "agents";
-var BOOTSTRAP_ENCRYPTION_NETWORK_NAME = "default";
-var BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE = `urn:tinycloud:encryption:{ownerDid}:${BOOTSTRAP_ENCRYPTION_NETWORK_NAME}`;
-var DEFAULT_EXPIRY_MS = 30 * 24 * 60 * 60 * 1e3;
-var VAULT_PERMISSION_SERVICE = "tinycloud.vault";
-var ENCRYPTION_PERMISSION_SERVICE = "tinycloud.encryption";
-var ENCRYPTION_MANIFEST_SPACE = "encryption";
-var NETWORK_CREATE_ACTION = ENCRYPTION.NETWORK_CREATE;
-var BOOTSTRAP_SPACE_NAMES = [
-  BOOTSTRAP_DEFAULT_SPACE,
-  DEFAULT_MANIFEST_SPACE,
-  ACCOUNT_REGISTRY_SPACE,
-  SECRETS_SPACE,
-  BOOTSTRAP_PUBLIC_SPACE,
-  AGENTS_SPACE
-];
-var TINYCLOUD_DEFAULT_SPACE_MANIFEST = {
-  app_id: "xyz.tinycloud.default",
-  name: "TinyCloud Default Space",
-  space: BOOTSTRAP_DEFAULT_SPACE,
-  prefix: "",
-  defaults: false,
-  includePublicSpace: false,
-  permissions: [
-    {
-      service: "tinycloud.kv",
-      space: BOOTSTRAP_DEFAULT_SPACE,
-      // Empty path = whole service on this space. Do NOT use "/": the recap
-      // encoder joins it as `<space>/<service>//`, which the node's byte-prefix
-      // resource matching can never extend (real paths start `<service>/x…`).
-      path: "",
-      actions: ["get", "put", "del", "list", "metadata"]
-    },
-    {
-      service: "tinycloud.sql",
-      space: BOOTSTRAP_DEFAULT_SPACE,
-      path: "",
-      actions: ["read", "write"]
-    }
-  ]
-};
-var TINYCLOUD_APPLICATIONS_SPACE_MANIFEST = {
-  app_id: "xyz.tinycloud.applications",
-  name: "TinyCloud Applications Space",
-  space: DEFAULT_MANIFEST_SPACE,
-  prefix: "",
-  defaults: false,
-  includePublicSpace: false,
-  permissions: [
-    {
-      service: "tinycloud.kv",
-      space: DEFAULT_MANIFEST_SPACE,
-      // Empty path = whole service on this space. Do NOT use "/": the recap
-      // encoder joins it as `<space>/<service>//`, which the node's byte-prefix
-      // resource matching can never extend (real paths start `<service>/x…`).
-      path: "",
-      actions: ["get", "put", "del", "list", "metadata"]
-    },
-    {
-      service: "tinycloud.sql",
-      space: DEFAULT_MANIFEST_SPACE,
-      path: "",
-      actions: ["read", "write"]
-    }
-  ]
-};
-var TINYCLOUD_ACCOUNT_SPACE_MANIFEST = {
-  app_id: "xyz.tinycloud.account",
-  name: "TinyCloud Account Registry",
-  space: ACCOUNT_REGISTRY_SPACE,
-  prefix: "",
-  defaults: false,
-  includePublicSpace: false,
-  permissions: [
-    {
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "applications/",
-      actions: ["get", "put", "list"]
-    },
-    {
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "spaces/",
-      actions: ["get", "put", "list"]
-    },
-    {
-      service: "tinycloud.sql",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "account",
-      actions: ["read", "write", "schema"]
-    }
-  ]
-};
-var TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST = {
-  app_id: "xyz.tinycloud.secrets",
-  name: "TinyCloud Secrets",
-  space: SECRETS_SPACE,
-  prefix: "",
-  defaults: false,
-  includePublicSpace: false,
-  permissions: [
-    {
-      service: "tinycloud.vault",
-      space: SECRETS_SPACE,
-      path: "secrets/",
-      actions: ["read"],
-      skipPrefix: true
-    },
-    {
-      service: "tinycloud.kv",
-      space: SECRETS_SPACE,
-      path: "variables",
-      actions: ["list", "metadata"],
-      skipPrefix: true
-    },
-    {
-      service: "tinycloud.kv",
-      space: SECRETS_SPACE,
-      path: "variables/",
-      actions: ["get", "put", "del", "list", "metadata"],
-      skipPrefix: true
-    },
-    {
-      service: "tinycloud.sql",
-      space: SECRETS_SPACE,
-      path: "default",
-      actions: ["read", "write", "schema"],
-      skipPrefix: true
-    },
-    {
-      service: "tinycloud.capabilities",
-      space: SECRETS_SPACE,
-      path: "",
-      actions: ["read"],
-      skipPrefix: true
-    }
-  ]
-};
-var TINYCLOUD_PUBLIC_SPACE_MANIFEST = {
-  app_id: "xyz.tinycloud.public",
-  name: "TinyCloud Public Space",
-  space: BOOTSTRAP_PUBLIC_SPACE,
-  prefix: "",
-  defaults: false,
-  includePublicSpace: false,
-  permissions: [
-    {
-      service: "tinycloud.kv",
-      space: BOOTSTRAP_PUBLIC_SPACE,
-      path: "",
-      actions: ["get", "list", "metadata"]
-    }
-  ]
-};
-var TINYCLOUD_AGENTS_SPACE_MANIFEST = {
-  app_id: "xyz.tinycloud.agents",
-  name: "TinyCloud Agents Space",
-  space: AGENTS_SPACE,
-  prefix: "",
-  defaults: false,
-  includePublicSpace: false,
-  permissions: [
-    {
-      service: "tinycloud.kv",
-      space: AGENTS_SPACE,
-      path: "",
-      actions: ["get", "put", "del", "list", "metadata"]
-    }
-  ]
-};
-var BOOTSTRAP_SPACE_MANIFESTS = {
-  [BOOTSTRAP_DEFAULT_SPACE]: TINYCLOUD_DEFAULT_SPACE_MANIFEST,
-  [DEFAULT_MANIFEST_SPACE]: TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
-  [ACCOUNT_REGISTRY_SPACE]: TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
-  [SECRETS_SPACE]: TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
-  [BOOTSTRAP_PUBLIC_SPACE]: TINYCLOUD_PUBLIC_SPACE_MANIFEST,
-  [AGENTS_SPACE]: TINYCLOUD_AGENTS_SPACE_MANIFEST
-};
-var BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS = [
-  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST
-];
-var ACCOUNT_INDEX_SCHEMA = [
-  `CREATE TABLE IF NOT EXISTS applications (
-    app_id TEXT PRIMARY KEY,
-    name TEXT,
-    description TEXT,
-    updated_at TEXT,
-    manifest_json TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS application_state (
-    app_id TEXT PRIMARY KEY,
-    manifest_hash TEXT NOT NULL,
-    indexed_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS spaces (
-    space_id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    owner_did TEXT NOT NULL,
-    type TEXT NOT NULL,
-    permissions_json TEXT NOT NULL,
-    status TEXT NOT NULL,
-    registered_at TEXT,
-    updated_at TEXT NOT NULL,
-    expires_at TEXT
-  )`,
-  `CREATE TABLE IF NOT EXISTS delegations (
-    cid TEXT PRIMARY KEY,
-    direction TEXT NOT NULL,
-    space_id TEXT NOT NULL,
-    space_name TEXT,
-    counterparty_did TEXT NOT NULL,
-    delegate_did TEXT NOT NULL,
-    delegator_did TEXT,
-    path TEXT NOT NULL,
-    actions_json TEXT NOT NULL,
-    expiry TEXT NOT NULL,
-    status TEXT NOT NULL,
-    created_at TEXT,
-    updated_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS sync_state (
-    source TEXT PRIMARY KEY,
-    synced_at TEXT NOT NULL,
-    count INTEGER NOT NULL
-  )`,
-  "CREATE INDEX IF NOT EXISTS idx_delegations_direction ON delegations(direction)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_space ON delegations(space_id)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_counterparty ON delegations(counterparty_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_type ON spaces(type)"
-];
-var SECRET_RECORDS_SCHEMA = [
-  `CREATE TABLE IF NOT EXISTS secret_records (
-    scope TEXT NOT NULL,
-    name TEXT NOT NULL,
-    provider_id TEXT,
-    custom_note TEXT,
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL,
-    last_tested TEXT,
-    test_status TEXT,
-    test_message TEXT,
-    PRIMARY KEY(scope, name)
-  )`
-];
-var BOOTSTRAP_MANIFEST = {
-  spaces: BOOTSTRAP_SPACE_NAMES.map((name) => ({
-    name,
-    manifest: BOOTSTRAP_SPACE_MANIFESTS[name],
-    persistedAsApplication: name === SECRETS_SPACE
-  })),
-  applications: BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
-  accountIndexSchema: ACCOUNT_INDEX_SCHEMA,
-  secretRecordsSchema: SECRET_RECORDS_SCHEMA,
-  encryptionNetwork: {
-    name: BOOTSTRAP_ENCRYPTION_NETWORK_NAME
-  }
-};
-function cloneManifest(manifest) {
-  return {
-    ...manifest,
-    permissions: manifest.permissions?.map((permission) => ({
-      ...permission,
-      actions: [...permission.actions]
-    }))
-  };
-}
-function actionUrn(service, action) {
-  return action.includes("/") ? action : `${service}/${action}`;
-}
-function applyPrefix(prefix, path, skipPrefix) {
-  if (skipPrefix === true || prefix === "" || path === "") {
-    return path;
-  }
-  if (path === "/") {
-    return `${prefix}/`;
-  }
-  const trimmedPrefix = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
-  const trimmedPath = path.startsWith("/") ? path.slice(1) : path;
-  return `${trimmedPrefix}/${trimmedPath}`;
-}
-function expandVaultPermission(entry) {
-  return entry.actions.map((action) => {
-    const normalized = action.startsWith("tinycloud.vault/") ? action.slice("tinycloud.vault/".length) : action.startsWith("tinycloud.kv/") ? action.slice("tinycloud.kv/".length) : action;
-    const mapped = normalized === "read" || normalized === "get" ? KV.GET : normalized === "write" || normalized === "put" ? KV.PUT : normalized === "delete" || normalized === "del" ? KV.DEL : normalized === "list" ? KV.LIST : normalized === "metadata" ? KV.METADATA : void 0;
-    if (mapped === void 0) {
-      throw new Error(`unknown vault action ${JSON.stringify(action)}`);
-    }
-    const normalizedPath = entry.path.startsWith("/") ? entry.path.slice(1) : entry.path;
-    return {
-      ...entry,
-      service: "tinycloud.kv",
-      path: `vault/${normalizedPath}`,
-      actions: [mapped],
-      skipPrefix: true
-    };
-  });
-}
-function expandPermissionEntry(entry, prefix, inheritedSpace) {
-  if (entry.service === VAULT_PERMISSION_SERVICE) {
-    return expandVaultPermission(entry).flatMap(
-      (expanded) => expandPermissionEntry(expanded, prefix, inheritedSpace)
-    );
-  }
-  const skipPrefix = entry.skipPrefix === true || entry.service === ENCRYPTION_PERMISSION_SERVICE;
-  return [
-    {
-      service: entry.service,
-      space: entry.service === ENCRYPTION_PERMISSION_SERVICE ? ENCRYPTION_MANIFEST_SPACE : entry.space ?? inheritedSpace,
-      path: applyPrefix(prefix, entry.path, skipPrefix),
-      actions: entry.actions.map((action) => actionUrn(entry.service, action)),
-      ...entry.description !== void 0 ? { description: entry.description } : {}
-    }
-  ];
-}
-function dedupeResources(resources) {
-  const byKey = /* @__PURE__ */ new Map();
-  for (const resource of resources) {
-    const key = `${resource.service}\0${resource.space}\0${resource.path}`;
-    const existing = byKey.get(key);
-    if (!existing) {
-      byKey.set(key, { ...resource, actions: [...resource.actions] });
-      continue;
-    }
-    for (const action of resource.actions) {
-      if (!existing.actions.includes(action)) {
-        existing.actions.push(action);
-      }
-    }
-  }
-  return [...byKey.values()];
-}
-function withCapabilitiesReadForSpaces(resources) {
-  const spaces = new Set(
-    resources.filter((resource) => resource.service !== ENCRYPTION_PERMISSION_SERVICE).map((resource) => resource.space)
-  );
-  return dedupeResources([
-    ...resources,
-    ...[...spaces].map((space) => ({
-      service: "tinycloud.capabilities",
-      space,
-      path: "",
-      actions: [CAPABILITIES2.READ]
-    }))
-  ]);
-}
-function composeManifestRequest(inputs, options = {}) {
-  if (!Array.isArray(inputs) || inputs.length === 0) {
-    throw new Error("composeManifestRequest requires at least one manifest");
-  }
-  const includeAccountRegistryPermissions = options.includeAccountRegistryPermissions ?? true;
-  const manifests = inputs.map(cloneManifest);
-  const resources = manifests.flatMap((manifest) => {
-    const prefix = manifest.prefix ?? manifest.app_id;
-    const space = manifest.space ?? DEFAULT_MANIFEST_SPACE;
-    const explicit = manifest.permissions ?? [];
-    return explicit.flatMap((entry) => expandPermissionEntry(entry, prefix, space));
-  });
-  if (includeAccountRegistryPermissions) {
-    resources.push(
-      ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
-        ...resource,
-        actions: [...resource.actions]
-      }))
-    );
-  }
-  const manifestsByAppId = /* @__PURE__ */ new Map();
-  for (const manifest of manifests) {
-    const current = manifestsByAppId.get(manifest.app_id) ?? [];
-    current.push(cloneManifest(manifest));
-    manifestsByAppId.set(manifest.app_id, current);
-  }
-  return {
-    manifests,
-    resources: withCapabilitiesReadForSpaces(resources),
-    delegationTargets: [],
-    registryRecords: includeAccountRegistryPermissions ? [...manifestsByAppId.entries()].map(([app_id, appManifests]) => ({
-      key: `${ACCOUNT_REGISTRY_PATH}${app_id}`,
-      app_id,
-      manifests: appManifests
-    })) : [],
-    expiryMs: DEFAULT_EXPIRY_MS,
-    includePublicSpace: manifests.some(
-      (manifest) => manifest.includePublicSpace ?? true
-    )
-  };
-}
-function composeBootstrapSpaceManifest(space) {
-  return composeManifestRequest([BOOTSTRAP_SPACE_MANIFESTS[space]], {
-    includeAccountRegistryPermissions: false
-  });
-}
-var ACCOUNT_MANIFEST_PERMISSIONS = Object.freeze([
-  {
-    service: "tinycloud.kv",
-    space: ACCOUNT_REGISTRY_SPACE,
-    path: ACCOUNT_REGISTRY_PATH,
-    actions: [KV.GET, KV.PUT, KV.LIST]
-  },
-  {
-    service: "tinycloud.kv",
-    space: ACCOUNT_REGISTRY_SPACE,
-    path: "spaces/",
-    actions: [KV.GET, KV.PUT, KV.LIST]
-  },
-  {
-    service: "tinycloud.kv",
-    space: ACCOUNT_REGISTRY_SPACE,
-    path: "system/bootstrap/complete",
-    actions: [KV.GET, KV.PUT]
-  },
-  {
-    service: "tinycloud.delegation",
-    space: ACCOUNT_REGISTRY_SPACE,
-    path: "",
-    actions: ["tinycloud.delegation/list"]
-  },
-  {
-    service: "tinycloud.sql",
-    space: ACCOUNT_REGISTRY_SPACE,
-    path: "account",
-    actions: [SQL.READ, SQL.WRITE, SQL.SCHEMA]
-  },
-  {
-    service: "tinycloud.capabilities",
-    space: ACCOUNT_REGISTRY_SPACE,
-    path: "",
-    actions: [CAPABILITIES2.READ]
-  }
-]);
-var BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST = composeBootstrapSpaceManifest(BOOTSTRAP_DEFAULT_SPACE);
-var BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST = {
-  ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST,
-  resources: [
-    ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST.resources,
-    ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
-      ...resource,
-      actions: [...resource.actions]
-    }))
-  ]
-};
-var BOOTSTRAP_SESSION_REQUESTS = Object.freeze(
-  Object.fromEntries(
-    BOOTSTRAP_SPACE_NAMES.map((space) => [
-      space,
-      space === BOOTSTRAP_DEFAULT_SPACE ? BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST : composeBootstrapSpaceManifest(space)
-    ])
-  )
-);
-var ACCOUNT_SESSION_RAW_ALLOWLIST = Object.freeze([
-  {
-    service: "tinycloud.encryption",
-    resource: BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
-    actions: [NETWORK_CREATE_ACTION]
-  }
-]);
-var BOOTSTRAP_ALLOWLIST = Object.freeze(
-  BOOTSTRAP_SPACE_NAMES.flatMap((space) => [
-    {
-      kind: "session",
-      service: "tinycloud.session",
-      space,
-      actions: ["siwe"],
-      resources: BOOTSTRAP_SESSION_REQUESTS[space].resources,
-      ...space === ACCOUNT_REGISTRY_SPACE ? { rawAbilities: ACCOUNT_SESSION_RAW_ALLOWLIST } : {}
-    },
-    {
-      kind: "space/host",
-      service: "tinycloud.space",
-      space,
-      actions: [SPACE.HOST]
-    }
-  ])
-);
-
-// ../sdk-services/dist/kv/replication/index.js
+// ../sdk-services/src/kv/replication/identity.ts
 var SPACE_ID = /^(tinycloud:pkh:eip155:\d+:)([^:]+)(:.+)$/;
 var PRINCIPAL_DID = /^(did:pkh:eip155:\d+:)([^:]+)$/;
 function canonicalReplicationIdentity(raw) {
@@ -600,92 +41,6 @@ ${canonical.host}
 ${canonical.space}
 ${canonical.principal}`;
 }
-var ErrorCodes = {
-  // Common errors
-  NOT_FOUND: "NOT_FOUND",
-  AUTH_EXPIRED: "AUTH_EXPIRED",
-  AUTH_REQUIRED: "AUTH_REQUIRED",
-  AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
-  /** HTTP 401: the delegation the invocation cites was revoked. */
-  AUTH_DELEGATION_REVOKED: "AUTH_DELEGATION_REVOKED",
-  /** HTTP 401: a delegation the cited one rests on was revoked. */
-  AUTH_DELEGATION_ANCESTOR_REVOKED: "AUTH_DELEGATION_ANCESTOR_REVOKED",
-  NETWORK_ERROR: "NETWORK_ERROR",
-  TIMEOUT: "TIMEOUT",
-  ABORTED: "ABORTED",
-  INVALID_INPUT: "INVALID_INPUT",
-  PERMISSION_DENIED: "PERMISSION_DENIED",
-  // Node retry signals (tinycloud-node #347). `meta.retryable` says whether a
-  // retry is safe; `meta.retryAfterMs` carries the node's Retry-After.
-  /** HTTP 503 `sql_busy:<stage>` / `unavailable_retryable`/`read_audit_busy`: nothing was applied; retry after `meta.retryAfterMs`. */
-  NODE_BUSY: "NODE_BUSY",
-  /** HTTP 503 `request_timeout`: the node's deadline passed before any write began; nothing was applied. */
-  REQUEST_TIMEOUT: "REQUEST_TIMEOUT",
-  /** HTTP 500 `outcome_unknown`: a write may have been applied; read back before retrying a non-idempotent operation. */
-  OUTCOME_UNKNOWN: "OUTCOME_UNKNOWN",
-  // KV-specific errors
-  KV_NOT_FOUND: "KV_NOT_FOUND",
-  KV_WRITE_FAILED: "KV_WRITE_FAILED",
-  KV_PRECONDITION_FAILED: "KV_PRECONDITION_FAILED",
-  KV_CONFLICT: "KV_CONFLICT",
-  KV_RESPONSE_TOO_LARGE: "KV_RESPONSE_TOO_LARGE",
-  /** HTTP 410 from the change feed: discard sync state and restart without a cursor; `meta.reason` says why. */
-  KV_SYNC_RESET_REQUIRED: "KV_SYNC_RESET_REQUIRED",
-  /** HTTP 403 from the change feed: the retention grant was refused; `meta.reason` says why. */
-  KV_RETENTION_GRANT_REFUSED: "KV_RETENTION_GRANT_REFUSED",
-  // SQL-specific errors
-  SQL_ERROR: "SQL_ERROR",
-  SQL_PERMISSION_DENIED: "SQL_PERMISSION_DENIED",
-  SQL_DATABASE_NOT_FOUND: "SQL_DATABASE_NOT_FOUND",
-  SQL_RESPONSE_TOO_LARGE: "SQL_RESPONSE_TOO_LARGE",
-  SQL_QUOTA_EXCEEDED: "SQL_QUOTA_EXCEEDED",
-  SQL_INVALID_STATEMENT: "SQL_INVALID_STATEMENT",
-  SQL_SCHEMA_ERROR: "SQL_SCHEMA_ERROR",
-  SQL_READONLY_VIOLATION: "SQL_READONLY_VIOLATION",
-  // Storage quota errors
-  STORAGE_QUOTA_EXCEEDED: "STORAGE_QUOTA_EXCEEDED",
-  STORAGE_LIMIT_REACHED: "STORAGE_LIMIT_REACHED",
-  /** The node answered the usage read without usage numbers (it predates the read). */
-  STORAGE_STATUS_UNAVAILABLE: "STORAGE_STATUS_UNAVAILABLE",
-  // DuckDB-specific errors
-  DUCKDB_ERROR: "DUCKDB_ERROR",
-  DUCKDB_PERMISSION_DENIED: "DUCKDB_PERMISSION_DENIED",
-  DUCKDB_DATABASE_NOT_FOUND: "DUCKDB_DATABASE_NOT_FOUND",
-  DUCKDB_RESPONSE_TOO_LARGE: "DUCKDB_RESPONSE_TOO_LARGE",
-  DUCKDB_QUOTA_EXCEEDED: "DUCKDB_QUOTA_EXCEEDED",
-  DUCKDB_INVALID_STATEMENT: "DUCKDB_INVALID_STATEMENT",
-  DUCKDB_SCHEMA_ERROR: "DUCKDB_SCHEMA_ERROR",
-  DUCKDB_READONLY_VIOLATION: "DUCKDB_READONLY_VIOLATION"
-};
-var defaultRetryPolicy = {
-  maxAttempts: 4,
-  backoff: "exponential",
-  baseDelayMs: 250,
-  maxDelayMs: 4e3,
-  retryableErrors: [ErrorCodes.NODE_BUSY, ErrorCodes.REQUEST_TIMEOUT],
-  maxTotalMs: 12e3
-};
-var grantableActions = new Set(
-  CAPABILITY_REGISTRY.map(({ urn }) => urn).filter((urn) => !urn.endsWith("/*"))
-);
-var capabilityServices = new Set(
-  CAPABILITY_REGISTRY.map(({ service }) => service.slice("tinycloud.".length))
-);
-var DEFINITIVE_FAILURES = /* @__PURE__ */ new Set([
-  ErrorCodes.AUTH_REQUIRED,
-  ErrorCodes.INVALID_INPUT,
-  ErrorCodes.AUTH_UNAUTHORIZED,
-  ErrorCodes.KV_PRECONDITION_FAILED,
-  ErrorCodes.STORAGE_QUOTA_EXCEEDED,
-  ErrorCodes.STORAGE_LIMIT_REACHED
-]);
-var encoder = new TextEncoder();
-var decoder = new TextDecoder("utf-8", { fatal: true });
-var HOUR_MS = 60 * 60 * 1e3;
-var DAY_MS = 24 * HOUR_MS;
-var MAX_GRANT_TTL_MS = 7 * DAY_MS;
-var CONSENT_WINDOW_MS = 7 * DAY_MS;
-var EXPIRED = Number.NEGATIVE_INFINITY;
 
 // src/errors.ts
 var ReplicaErrorCode = {
@@ -868,10 +223,10 @@ function validAccountKey(record, gate) {
 }
 
 // ../sdk-services/dist/kv/replication/contractConstants.js
-var HOUR_MS2 = 60 * 60 * 1e3;
-var DAY_MS2 = 24 * HOUR_MS2;
-var MAX_GRANT_TTL_MS2 = 7 * DAY_MS2;
-var CONSENT_WINDOW_MS2 = 7 * DAY_MS2;
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
 var DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;
 var REPLICA_KV_DATABASE = "tinycloud-replica-kv";
 var REPLICA_KV_STORES = {
@@ -905,11 +260,11 @@ function principalOf(did) {
 
 // src/kv-storage/sealed.ts
 import { bytesToHex } from "@noble/hashes/utils";
-var encoder2 = new TextEncoder();
+var encoder = new TextEncoder();
 var NONCE_LENGTH = 12;
 var TAG_LENGTH = 16;
 function aad(context) {
-  return encoder2.encode(`tinycloud-replica-kv:v1\0${context}`);
+  return encoder.encode(`tinycloud-replica-kv:v1\0${context}`);
 }
 async function seal(key, plaintext, context) {
   const iv = crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
@@ -1647,7 +1002,7 @@ function createIndexedDbLifecycle(options = {}) {
           deniedAt: floor.deniedAt,
           keyId: hash.keyId,
           accountKeyId: account.keyId,
-          consentDeadline: issuedAt + CONSENT_WINDOW_MS2
+          consentDeadline: issuedAt + CONSENT_WINDOW_MS
         };
         if (!Number.isSafeInteger(created.consentDeadline)) throw gatedError("not_established", "The consent deadline is invalid.");
         await writeGate(created, current, { hash, account });
@@ -2008,8 +1363,8 @@ function createIndexedDbLifecycle(options = {}) {
 
 // src/kv-storage/codec.ts
 import { bytesToHex as bytesToHex2, hexToBytes } from "@noble/hashes/utils";
-var encoder3 = new TextEncoder();
-var decoder2 = new TextDecoder("utf-8", { fatal: true });
+var encoder2 = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
 function encodeValue(value) {
   if (value === void 0) return ["undefined"];
   if (value instanceof Uint8Array) return ["bytes", bytesToHex2(value)];
@@ -2044,11 +1399,11 @@ function decodeValue(value) {
   throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica record has an invalid payload variant.");
 }
 function encodeJson(value) {
-  return encoder3.encode(JSON.stringify(["tinycloud-replica-kv", 1, encodeValue(value)]));
+  return encoder2.encode(JSON.stringify(["tinycloud-replica-kv", 1, encodeValue(value)]));
 }
 function decodeJson(bytes) {
   try {
-    const value = JSON.parse(decoder2.decode(bytes));
+    const value = JSON.parse(decoder.decode(bytes));
     if (!Array.isArray(value) || value.length !== 3 || value[0] !== "tinycloud-replica-kv" || value[1] !== 1) {
       throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica record has an unknown payload version.");
     }
@@ -2172,7 +1527,7 @@ function spawn(source) {
     if (source instanceof URL || typeof source === "string") return new Worker(source, { type: "module" });
     if (typeof source === "function") return source();
   }
-  return new Worker(new URL("./kv-storage.worker.f36b4011295de4d2bd57791c065186645b328f57ad08f1b6fc5843ad6e34c315.js", import.meta.url), { type: "module" });
+  return new Worker(new URL("./kv-storage.worker.bb0d0e128851db2916b3233f31e5c31ca360a97a536bbe1fe81a0fa6886ea307.js", import.meta.url), { type: "module" });
 }
 var WorkerConnection = class {
   ready;