@tinycloud/sdk-core 2.11.0-beta.1 → 2.11.0-beta.10

package/dist/index.cjs

@@ -119,6 +119,7 @@ __export(index_exports, {
   MemoryShareCache: () => MemoryShareCache,
   NETWORK_NAME_PATTERN: () => import_sdk_services8.NETWORK_NAME_PATTERN,
   NetworkIdError: () => import_sdk_services8.NetworkIdError,
+  OPENKEY_ACTION_ID_SEPARATOR: () => OPENKEY_ACTION_ID_SEPARATOR,
   POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA: () => POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA,
   POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA: () => POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA,
   POLICY_ENGINE_DENIAL_SCHEMA: () => POLICY_ENGINE_DENIAL_SCHEMA,
@@ -245,6 +246,7 @@ __export(index_exports, {
   deriveSignedReceiverKey: () => import_sdk_services8.deriveSignedReceiverKey,
   didCacheKey: () => didCacheKey,
   didEquals: () => didEquals,
+  diffImmutableSiweFields: () => diffImmutableSiweFields,
   disableTinyCloudDebug: () => import_sdk_services8.disableTinyCloudDebug,
   discoverLocalTinyCloudNode: () => discoverLocalTinyCloudNode,
   discoverNetwork: () => import_sdk_services8.discoverNetwork,
@@ -265,6 +267,8 @@ __export(index_exports, {
   expandActionShortNames: () => expandActionShortNames,
   expandPermissionEntries: () => expandPermissionEntries,
   expandPermissionEntry: () => expandPermissionEntry,
+  extractImmutableSiweFields: () => extractImmutableSiweFields,
+  extractRecapAttenuations: () => extractRecapAttenuations,
   fetchLocationRecord: () => fetchLocationRecord,
   fetchPeerId: () => fetchPeerId,
   generateRandomReceiverKey: () => import_sdk_services8.generateRandomReceiverKey,
@@ -277,6 +281,7 @@ __export(index_exports, {
   isCapabilitySubset: () => isCapabilitySubset,
   isEvmAddress: () => isEvmAddress,
   isNetworkId: () => import_sdk_services8.isNetworkId,
+  isPlausibleOpenKeyActionId: () => isPlausibleOpenKeyActionId,
   isV2ShareLink: () => isV2ShareLink,
   jcsCanonicalize: () => jcsCanonicalize,
   loadManifest: () => loadManifest,
@@ -294,6 +299,7 @@ __export(index_exports, {
   ok: () => import_sdk_services8.ok,
   openWrappedKey: () => import_sdk_services8.openWrappedKey,
   parseCanonicalNetworkId: () => parseCanonicalNetworkId,
+  parseCanonicalRecapResource: () => parseCanonicalRecapResource,
   parseExpiry: () => parseExpiry,
   parseNetworkId: () => import_sdk_services8.parseNetworkId,
   parseNodeNativePortableDelegation: () => parseNodeNativePortableDelegation,
@@ -325,6 +331,8 @@ __export(index_exports, {
   submitHostDelegation: () => submitHostDelegation,
   tinyCloudDebugLogger: () => import_sdk_services8.tinyCloudDebugLogger,
   toSignedObjectError: () => toSignedObjectError,
+  unauthorizedRecapCapabilities: () => unauthorizedRecapCapabilities,
+  validateAuthorizationResultV1: () => validateAuthorizationResultV1,
   validateClientSession: () => validateClientSession,
   validateEnvelope: () => import_sdk_services8.validateEnvelope,
   validateLocationRecord: () => validateLocationRecord,
@@ -2200,13 +2208,12 @@ function digest(input, options2) {
 }
 var identity2 = { code: code2, name, encode: encode4, digest };
 
-// ../../node_modules/multiformats/dist/src/hashes/sha2.js
-var sha2_exports = {};
-__export(sha2_exports, {
+// ../../node_modules/multiformats/dist/src/hashes/sha2-browser.js
+var sha2_browser_exports = {};
+__export(sha2_browser_exports, {
   sha256: () => sha2562,
   sha512: () => sha512
 });
-var import_crypto = __toESM(require("crypto"), 1);
 
 // ../../node_modules/multiformats/dist/src/hashes/hasher.js
 var DEFAULT_MIN_DIGEST_LENGTH = 20;
@@ -2256,21 +2263,24 @@ function createDigest(digest4, code3, truncate) {
   return create(code3, digest4);
 }
 
-// ../../node_modules/multiformats/dist/src/hashes/sha2.js
+// ../../node_modules/multiformats/dist/src/hashes/sha2-browser.js
+function sha(name2) {
+  return async (data) => new Uint8Array(await crypto.subtle.digest(name2, data));
+}
 var sha2562 = from2({
   name: "sha2-256",
   code: 18,
-  encode: (input) => coerce(import_crypto.default.createHash("sha256").update(input).digest())
+  encode: sha("SHA-256")
 });
 var sha512 = from2({
   name: "sha2-512",
   code: 19,
-  encode: (input) => coerce(import_crypto.default.createHash("sha512").update(input).digest())
+  encode: sha("SHA-512")
 });
 
 // ../../node_modules/multiformats/dist/src/basics.js
 var bases = { ...identity_exports, ...base2_exports, ...base8_exports, ...base10_exports, ...base16_exports, ...base32_exports, ...base36_exports, ...base58_exports, ...base64_exports, ...base256emoji_exports };
-var hashes = { ...sha2_exports, ...identity_exports2 };
+var hashes = { ...sha2_browser_exports, ...identity_exports2 };
 
 // src/policy/signed-object.ts
 var import_viem3 = require("viem");
@@ -6702,15 +6712,28 @@ function normalizeSpace(space) {
 function isCapabilitySubset(requested, granted) {
   const missing = [];
   for (const req of requested) {
-    const match = granted.find((g) => canonicalizeEntryMatches(req, g));
-    if (match === void 0) {
+    const matchingScope = granted.filter(
+      (entry) => canonicalizeEntryScopeMatches(req, entry)
+    );
+    const requestedActions = expandActionShortNames(
+      req.service,
+      req.actions
+    );
+    const grantedActions = matchingScope.flatMap(
+      (entry) => expandActionShortNames(entry.service, entry.actions)
+    );
+    const covered = requestedActions.every(
+      (requestedAction) => grantedActions.some(
+        (grantedAction) => actionContains(grantedAction, requestedAction)
+      )
+    );
+    if (!covered) {
       missing.push(cloneEntry(req));
-      continue;
     }
   }
   return { subset: missing.length === 0, missing };
 }
-function canonicalizeEntryMatches(requested, granted) {
+function canonicalizeEntryScopeMatches(requested, granted) {
   if (requested.service !== granted.service) {
     return false;
   }
@@ -6720,15 +6743,6 @@ function canonicalizeEntryMatches(requested, granted) {
   if (!pathContains2(granted.path, requested.path)) {
     return false;
   }
-  const reqActions = new Set(
-    expandActionShortNames(requested.service, requested.actions)
-  );
-  const grantedActions = expandActionShortNames(granted.service, granted.actions);
-  for (const a of reqActions) {
-    if (!grantedActions.some((grantedAction) => actionContains(grantedAction, a))) {
-      return false;
-    }
-  }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
     return false;
   }
@@ -6992,6 +7006,10 @@ function normalizeRecipient(recipient) {
     }
     return { kind: recipient.kind, value: domain };
   }
+  if (recipient.kind === "recipientDid") {
+    if (!isCanonicalRecipientDid(recipient.value)) throw new ShareEnvelopeError("invalid-envelope", "recipient DID is invalid");
+    return { kind: recipient.kind, value: recipient.value };
+  }
   const exact = recipient.value.trim();
   const at = exact.lastIndexOf("@");
   const normalizedExact = at > 0 ? `${exact.slice(0, at)}@${exact.slice(at + 1).toLowerCase()}` : exact;
@@ -7000,6 +7018,28 @@ function normalizeRecipient(recipient) {
   }
   return { kind: recipient.kind, value: normalizedExact };
 }
+function isCanonicalRecipientDid(value) {
+  if (value.length === 0 || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value)) return false;
+  const parts = value.split(":");
+  if (parts.length < 3 || parts[0] !== "did" || !/^[a-z0-9]+$/.test(parts[1] ?? "")) return false;
+  const identifier = parts.slice(2);
+  if (identifier.some((part) => part.length === 0)) return false;
+  if (parts[1] === "web") {
+    const host = identifier[0] ?? "";
+    if (host.length > 253 || host.split(".").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-"))) return false;
+    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  }
+  if (parts[1] === "pkh") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  if (parts[1] === "key") {
+    try {
+      const bytes2 = base58btc.decode(identifier.join(":"));
+      return bytes2.length === 34 && bytes2[0] === 237 && bytes2[1] === 1;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
 function normalizeShareRecipientTarget(recipient) {
   const normalized = normalizeRecipient(recipient);
   if (normalized === void 0) throw new ShareEnvelopeError("invalid-envelope", "recipient matcher is required");
@@ -7086,9 +7126,9 @@ function verifyShareEnvelope(envelope, options2 = {}) {
     const recipient = normalizeRecipient(envelope.recipient);
     if (recipient !== void 0 && JSON.stringify(recipient) !== JSON.stringify(envelope.recipient)) throw new ShareEnvelopeError("invalid-envelope", "recipient is not canonical");
     if (recipient?.kind === "exactEmail" || recipient?.kind === "emailDomain") throw new ShareEnvelopeError("unsafe-plaintext", "recipient matchers are not public envelope fields");
-    if (envelope.recipientKind !== void 0 && !["exactEmail", "emailDomain", "bearer"].includes(envelope.recipientKind)) throw new ShareEnvelopeError("invalid-envelope", "recipient mode is invalid");
+    if (envelope.recipientKind !== void 0 && !["exactEmail", "emailDomain", "recipientDid", "bearer"].includes(envelope.recipientKind)) throw new ShareEnvelopeError("invalid-envelope", "recipient mode is invalid");
     if (envelope.recipientKind === "bearer" && recipient?.kind !== void 0 && recipient.kind !== "bearer") throw new ShareEnvelopeError("invalid-envelope", "recipient mode does not match recipient");
-    if ((envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain") && !envelope.encrypted) throw new ShareEnvelopeError("unsafe-plaintext", "policy shares require encryption");
+    if ((envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain" || envelope.recipientKind === "recipientDid") && !envelope.encrypted) throw new ShareEnvelopeError("unsafe-plaintext", "addressed shares require encryption");
     if (typeof envelope.spaceId !== "string" || envelope.spaceId.length === 0 || typeof envelope.content.mimeType !== "string" || envelope.content.mimeType.length === 0 || typeof envelope.content.digest !== "string" || !/^[A-Za-z0-9_-]+$/.test(envelope.content.digest)) throw new ShareEnvelopeError("invalid-envelope", "content metadata is invalid");
     const maxContentBytes = envelope.encrypted ? options2.maxSealedContentBytes ?? MAX_SEALED_SHARE_CONTENT_BYTES : options2.maxContentBytes ?? MAX_SHARE_CONTENT_BYTES;
     if (!Number.isInteger(envelope.content.size) || envelope.content.size < 0 || envelope.content.size > maxContentBytes) throw new ShareEnvelopeError("content-too-large", "share content exceeds the configured limit");
@@ -7227,7 +7267,7 @@ function parsePolicyMetadata(policyBytes, target, expectedExpiry) {
     assertKeys(policy, ["type", "version", "issuerDid", "recipientMatcher", "target", "delegation", "authority", "actions", "resource", "content-source", "expiresAt"], "published canonical policy material");
     if (typeof policy.issuerDid !== "string" || typeof policy.expiresAt !== "string" || policy.expiresAt !== expectedExpiry) throw new ShareEnvelopeError("invalid-envelope", "policy expiry is not bound to the envelope");
     const matcherValue = policy.recipientMatcher;
-    if (!isPlainObject(matcherValue) || matcherValue.kind !== "exactEmail" && matcherValue.kind !== "emailDomain" || typeof matcherValue.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
+    if (!isPlainObject(matcherValue) || matcherValue.kind !== "exactEmail" && matcherValue.kind !== "emailDomain" && matcherValue.kind !== "recipientDid" || typeof matcherValue.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
     const matcher2 = normalizeRecipient(matcherValue);
     if (matcher2 === void 0 || matcher2.kind === "bearer") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
     if (!isPlainObject(policy.target)) throw new ShareEnvelopeError("invalid-envelope", "policy target is invalid");
@@ -7314,7 +7354,7 @@ function parseCanonicalPublishedV2(value, options2) {
   if (!Number.isFinite(expiry) || expiry <= (options2.now ?? /* @__PURE__ */ new Date()).getTime() || new Date(expiry).toISOString() !== value.expiry) throw new ShareEnvelopeError("expired", "published share envelope has expired");
   if (typeof delegation.cid !== "string" || typeof delegation.issuerDid !== "string" || typeof delegation.audience !== "string" || typeof delegation.expiresAt !== "string" || Date.parse(delegation.expiresAt) > expiry) throw new ShareEnvelopeError("invalid-envelope", "published v2 delegation is invalid");
   const matcher = value.recipientMatcher;
-  if (!isPlainObject(matcher) || matcher.kind !== "exactEmail" && matcher.kind !== "emailDomain" || typeof matcher.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
+  if (!isPlainObject(matcher) || matcher.kind !== "exactEmail" && matcher.kind !== "emailDomain" && matcher.kind !== "recipientDid" || typeof matcher.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
   const normalizedMatcher = normalizeRecipient(matcher);
   if (normalizedMatcher === void 0 || normalizedMatcher.kind === "bearer") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
   if (!Array.isArray(value.actions)) throw new ShareEnvelopeError("invalid-envelope", "published v2 actions are invalid");
@@ -7755,10 +7795,11 @@ var ShareConflict = class extends Error {
   }
 };
 var ShareAccessError = class extends Error {
-  constructor(code3, message) {
+  constructor(code3, message, details) {
     super(message ?? "shared access could not be completed");
     this.name = "ShareAccessError";
     this.code = code3;
+    this.details = details;
   }
 };
 
@@ -7767,6 +7808,7 @@ var import_zod5 = require("zod");
 var ShareRecipientTargetSchema = import_zod5.z.discriminatedUnion("kind", [
   import_zod5.z.object({ kind: import_zod5.z.literal("exactEmail"), value: import_zod5.z.string().min(1) }).strict(),
   import_zod5.z.object({ kind: import_zod5.z.literal("emailDomain"), value: import_zod5.z.string().min(1) }).strict(),
+  import_zod5.z.object({ kind: import_zod5.z.literal("recipientDid"), value: import_zod5.z.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),
   import_zod5.z.object({ kind: import_zod5.z.literal("bearer") }).strict()
 ]);
 var ShareResourceSchema = import_zod5.z.discriminatedUnion("kind", [
@@ -7810,7 +7852,8 @@ var ShareContentSourceSchema = import_zod5.z.discriminatedUnion("kind", [
 ]);
 var ShareAddressedRecipientSchema = import_zod5.z.discriminatedUnion("kind", [
   import_zod5.z.object({ kind: import_zod5.z.literal("exactEmail"), value: import_zod5.z.string().min(1) }).strict(),
-  import_zod5.z.object({ kind: import_zod5.z.literal("emailDomain"), value: import_zod5.z.string().min(1) }).strict()
+  import_zod5.z.object({ kind: import_zod5.z.literal("emailDomain"), value: import_zod5.z.string().min(1) }).strict(),
+  import_zod5.z.object({ kind: import_zod5.z.literal("recipientDid"), value: import_zod5.z.string().regex(/^did:[a-z0-9]+:.+$/) }).strict()
 ]);
 var ShareAddressedDelegationRequestV2Schema = import_zod5.z.object({
   version: import_zod5.z.literal(2),
@@ -8065,12 +8108,21 @@ var ShareRecipientClient = class {
       const { envelope } = resolved.artifact;
       const { location } = resolved;
       const bearer = isBearerEnvelope(envelope);
-      const policy = envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain";
+      const policy = envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain" || envelope.authorizationTargetKind === "recipientDid";
       const legacyBearer = !policy && envelope.recipientKind === void 0;
-      if (envelope.authorizationTargetKind === "recipientDid") throw new ShareAccessError("SHARE_RECIPIENT_DID_UNSUPPORTED");
+      let recipientDidSession;
+      if (envelope.authorizationTargetKind === "recipientDid") {
+        if (this.options.establishRecipientDidSession === void 0) throw new ShareAccessError("SHARE_DEVICE_AUTH_REQUIRED", "an OpenKey device authorization is required");
+        const authorization = await this.options.establishRecipientDidSession({ envelope, recipientDid: envelope.recipient?.kind === "recipientDid" ? envelope.recipient.value : "" });
+        if ("state" in authorization) {
+          if (authorization.state === "authorization-required") throw new ShareAccessError("SHARE_DEVICE_AUTH_REQUIRED", "an OpenKey device authorization is required", authorization);
+          throw new ShareAccessError("SHARE_DENIED", "recipient DID authorization was denied", authorization);
+        }
+        recipientDidSession = authorization;
+      }
       if (policy && this.options.bearerSession !== void 0) throw new ShareAccessError("SHARE_POLICY_BEARER_MISMATCH");
       if (bearer && this.options.presentation !== void 0) throw new ShareAccessError("SHARE_BEARER_PRESENTATION_MISMATCH");
-      const session = bearer || legacyBearer ? this.options.bearerSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
+      const session = bearer || legacyBearer ? this.options.bearerSession : recipientDidSession ? recipientDidSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
       const kv = bearer || legacyBearer ? session === void 0 ? void 0 : this.createKV(envelope.origin, session) : void 0;
       const policySession = policy ? session : void 0;
       if (policySession !== void 0) this.assertProvidedPolicySession(policySession, envelope);
@@ -10271,7 +10323,7 @@ function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
   const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
   const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
   const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.jti || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
+  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
     throw new Error("share delivery authorization is not bound to the submitted request");
   }
   if (typeof authorization.issuedAt !== "string" || Date.parse(authorization.issuedAt) > Date.now() + 6e4) throw new Error("share delivery authorization issuedAt is invalid");
@@ -10406,6 +10458,10 @@ var SenderShareStore = class {
   }
 };
 
+// src/delegations/index.ts
+var import_share_sdk = require("@tinycloud/share-sdk");
+var import_share_sdk2 = require("@tinycloud/share-sdk");
+
 // src/networkId.ts
 var import_sdk_services3 = require("@tinycloud/sdk-services");
 function canonicalizeNetworkId(networkId) {
@@ -12120,6 +12176,22 @@ var ACCOUNT_SPACES_PATH = "spaces/";
 var AccountService = class {
   constructor(config) {
     this.config = config;
+    /**
+     * Per-account-space memo for {@link ensureAccountIndex}.
+     *
+     * Applying the index migration is a no-op once the schema exists, but the
+     * SQL service still spends two round trips discovering that (create the
+     * migrations table, then read the applied-migration rows). Account bootstrap
+     * touches the index eight times, so without a memo that is ~14 wasted
+     * requests on the cold sign-in path. The in-flight dedupe inside SQLService
+     * never helps here: the node SDK builds a fresh SQLService per
+     * `getAccountDb()` call, so its lock map is always empty.
+     *
+     * Keyed by account space id, so a different account never reuses this entry.
+     * Failures are evicted so a later call retries instead of inheriting a
+     * permanently poisoned result.
+     */
+    this.accountIndexReady = /* @__PURE__ */ new Map();
     this.applications = {
       list: async (options2 = {}) => {
         if (options2.preferIndex) {
@@ -12153,7 +12225,7 @@ var AccountService = class {
         if (!loaded.ok) return accountErr(loaded.error);
         return (0, import_sdk_services6.ok)(applicationFromRecord(key, loaded.data.data));
       },
-      register: async (manifest) => {
+      register: async (manifest, options2 = {}) => {
         const manifests = Array.isArray(manifest) ? manifest : [manifest];
         const request = composeManifestRequest(manifests);
         if (request.registryRecords.length === 0) {
@@ -12171,7 +12243,7 @@ var AccountService = class {
         let registered;
         for (const record of request.registryRecords) {
           const manifestHash = hashJson(record.manifests);
-          if (await this.indexHasApplicationHash(record.app_id, manifestHash)) {
+          if (!options2.assumeUnregistered && await this.indexHasApplicationHash(record.app_id, manifestHash)) {
             registered = {
               appId: record.app_id,
               manifests: record.manifests,
@@ -12246,6 +12318,60 @@ var AccountService = class {
         await this.upsertSpaceIndexQuietly(registered);
         return (0, import_sdk_services6.ok)(registered);
       },
+      /**
+       * Register multiple spaces in one KV batch write + one multi-row index
+       * write, instead of one `register()` round trip per space (TC-373).
+       *
+       * The stored records are computed exactly once and reused for both the
+       * batch attempt and any reconciliation below, so a fallback never mints a
+       * fresh timestamp for a space that already has a written record — a
+       * second `spaceRecordFromInput` call would produce a new content hash and
+       * leave the first attempt's blocks orphaned.
+       */
+      registerBatch: async (spaces) => {
+        if (spaces.length === 0) return (0, import_sdk_services6.ok)({ spaces: [] });
+        await this.config.ensureAccountSpaceHosted?.();
+        const kvResult = this.accountKV();
+        if (!kvResult.ok) return kvResult;
+        const stored = spaces.map((space) => spaceRecordFromInput(space));
+        const registered = stored.map(
+          (record) => spaceFromRecord(spaceKey(record.space_id), record)
+        );
+        const items = stored.map((record) => ({
+          key: spaceKey(record.space_id),
+          value: record
+        }));
+        const batchResult = await kvResult.data.batchPut(items);
+        if (batchResult.ok) {
+          await this.upsertSpacesIndexQuietly(registered);
+          return (0, import_sdk_services6.ok)({ spaces: registered });
+        }
+        if (!isAmbiguousBatchFailure(batchResult.error)) {
+          return accountErr(batchResult.error);
+        }
+        const reconcileFailures = [];
+        for (const record of stored) {
+          const written = await kvResult.data.put(spaceKey(record.space_id), record);
+          if (!written.ok) {
+            reconcileFailures.push(`${record.space_id}: ${written.error.message}`);
+          }
+        }
+        if (reconcileFailures.length > 0) {
+          return (0, import_sdk_services6.err)(
+            (0, import_sdk_services6.serviceError)(
+              "KV_BATCH_RECONCILE_FAILED",
+              `KV batch write for ${items.length} space(s) failed ambiguously (${batchResult.error.message}) and per-space reconciliation also failed for: ${reconcileFailures.join("; ")}`,
+              SERVICE_NAME2,
+              { cause: batchResult.error.cause, meta: { originalError: batchResult.error } }
+            )
+          );
+        }
+        console.warn(
+          `[AccountService] KV batch write for ${items.length} space(s) returned an ambiguous error and was reconciled via per-space fallback. Original error: ${batchResult.error.message}`
+        );
+        await this.upsertSpacesIndexQuietly(registered);
+        return (0, import_sdk_services6.ok)({ spaces: registered, recoveredFromBatchError: batchResult.error });
+      },
       syncAccessible: async () => {
         const listed = await this.config.getSpaces().list();
         if (!listed.ok) return accountErr(listed.error);
@@ -12352,6 +12478,7 @@ var AccountService = class {
         const delegations = await this.delegations.list();
         if (!delegations.ok) return delegations;
         const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+        this.invalidateAccountIndexMemo();
         const schema = await this.ensureAccountIndex(dbResult.data);
         if (!schema.ok) return schema;
         const statements = [
@@ -12631,6 +12758,47 @@ var AccountService = class {
     if (!written.ok) return accountErr(written.error);
     return (0, import_sdk_services6.ok)(void 0);
   }
+  async upsertSpacesIndexQuietly(spaces) {
+    await ignoreIndexFailure(() => this.upsertSpacesIndex(spaces));
+  }
+  /**
+   * Upsert multiple space index rows in ONE multi-row `INSERT OR REPLACE`
+   * statement (TC-373), rather than one statement per space. This matters
+   * because `IDatabaseHandle.batch()` executes its statement list as a plain
+   * loop, not a single database transaction — an N-statement batch is not
+   * atomic. A single multi-row INSERT is one SQLite statement, so it applies
+   * atomically: all rows or none.
+   */
+  async upsertSpacesIndex(spaces) {
+    if (spaces.length === 0) return (0, import_sdk_services6.ok)(void 0);
+    const dbResult = this.accountDb();
+    if (!dbResult.ok) return (0, import_sdk_services6.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
+    const placeholders = spaces.map(() => "(?, ?, ?, ?, ?, ?, ?, ?, ?)").join(", ");
+    const params = spaces.flatMap((space) => {
+      const updatedAt = space.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+      return [
+        space.spaceId,
+        space.name,
+        space.ownerDid,
+        space.type,
+        JSON.stringify(space.permissions),
+        space.status,
+        space.registeredAt ?? updatedAt,
+        updatedAt,
+        space.expiresAt?.toISOString() ?? null
+      ];
+    });
+    const written = await dbResult.data.batch([
+      {
+        sql: `INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES ${placeholders}`,
+        params
+      }
+    ]);
+    if (!written.ok) return accountErr(written.error);
+    return (0, import_sdk_services6.ok)(void 0);
+  }
   async deleteSpaceIndexQuietly(spaceId) {
     await ignoreIndexFailure(() => this.deleteSpaceIndex(spaceId));
   }
@@ -12751,7 +12919,41 @@ var AccountService = class {
       ]);
     });
   }
+  /**
+   * Apply the account index schema at most once per account space.
+   *
+   * The index is a cache over canonical KV state, and every caller already
+   * tolerates it being absent (`ignoreIndexFailure` / `isMissingIndexError`),
+   * so a memo that is wrong in the "already applied" direction degrades to a
+   * `no such table` read that the caller handles. A memo that is wrong in the
+   * other direction would be a real bug, so failures are never cached.
+   */
   async ensureAccountIndex(db) {
+    const key = this.config.getAccountSpaceId() ?? "";
+    const cached = this.accountIndexReady.get(key);
+    if (cached) return cached;
+    const pending = this.applyAccountIndex(db);
+    this.accountIndexReady.set(key, pending);
+    const evict = () => {
+      if (this.accountIndexReady.get(key) === pending) {
+        this.accountIndexReady.delete(key);
+      }
+    };
+    let settled;
+    try {
+      settled = await pending;
+    } catch (error) {
+      evict();
+      throw error;
+    }
+    if (!settled.ok) evict();
+    return settled;
+  }
+  /** Drop the memo so the next {@link ensureAccountIndex} re-applies the schema. */
+  invalidateAccountIndexMemo() {
+    this.accountIndexReady.delete(this.config.getAccountSpaceId() ?? "");
+  }
+  async applyAccountIndex(db) {
     const migrated = await db.migrations.apply({
       namespace: ACCOUNT_INDEX_NAMESPACE,
       migrations: [
@@ -12923,6 +13125,17 @@ function accountErr(error) {
 function isMissingIndexError(error) {
   return /no such table:/i.test(error.message);
 }
+var AMBIGUOUS_WRITE_STATUSES = /* @__PURE__ */ new Set([500, 502, 503, 504, 520, 522, 524]);
+function isAmbiguousBatchFailure(error) {
+  if (error.code === import_sdk_services6.ErrorCodes.NETWORK_ERROR || error.code === import_sdk_services6.ErrorCodes.TIMEOUT) {
+    return error.meta?.requestMayHaveDispatched === true;
+  }
+  if (error.code === import_sdk_services6.ErrorCodes.KV_WRITE_FAILED) {
+    const status = error.meta?.status;
+    return typeof status === "number" && AMBIGUOUS_WRITE_STATUSES.has(status);
+  }
+  return false;
+}
 async function ignoreIndexFailure(task) {
   try {
     await task();
@@ -13539,6 +13752,279 @@ var AutoApproveSpaceCreationHandler = class {
 };
 var defaultSpaceCreationHandler = new AutoApproveSpaceCreationHandler();
 
+// src/authorization/openkey-protocol.ts
+function validateAuthorizationResultV1(value) {
+  if (!value || typeof value !== "object") {
+    return { ok: false, error: "authorization result must be an object" };
+  }
+  const v = value;
+  if (v.protocolVersion !== 1) {
+    return { ok: false, error: `unsupported protocolVersion ${String(v.protocolVersion)}` };
+  }
+  if (typeof v.address !== "string" || !v.address) {
+    return { ok: false, error: "address must be a non-empty string" };
+  }
+  if (typeof v.signature !== "string" || !v.signature) {
+    return { ok: false, error: "signature must be a non-empty string" };
+  }
+  if (typeof v.signedMessage !== "string" || !v.signedMessage) {
+    return { ok: false, error: "signedMessage must be a non-empty string" };
+  }
+  if (!Array.isArray(v.selectedActionKeys) || v.selectedActionKeys.some((k) => typeof k !== "string")) {
+    return { ok: false, error: "selectedActionKeys must be a string[]" };
+  }
+  if (!Array.isArray(v.permissions)) {
+    return { ok: false, error: "permissions must be an array" };
+  }
+  const permissions = [];
+  for (const [index, entry] of v.permissions.entries()) {
+    if (!entry || typeof entry !== "object") {
+      return { ok: false, error: `permissions[${index}] must be an object` };
+    }
+    const e = entry;
+    if (typeof e.service !== "string" || typeof e.space !== "string" || typeof e.path !== "string") {
+      return { ok: false, error: `permissions[${index}] must have string service/space/path` };
+    }
+    if (!Array.isArray(e.actions) || e.actions.some((a) => typeof a !== "string")) {
+      return { ok: false, error: `permissions[${index}].actions must be a string[]` };
+    }
+    permissions.push({
+      service: e.service,
+      space: e.space,
+      path: e.path,
+      actions: e.actions
+    });
+  }
+  return {
+    ok: true,
+    value: {
+      protocolVersion: 1,
+      address: v.address,
+      signature: v.signature,
+      signedMessage: v.signedMessage,
+      selectedActionKeys: v.selectedActionKeys,
+      permissions
+    }
+  };
+}
+var OPENKEY_ACTION_ID_SEPARATOR = "\0";
+function isPlausibleOpenKeyActionId(id) {
+  return typeof id === "string" && id.split(OPENKEY_ACTION_ID_SEPARATOR).length === 4 && id.length > 0;
+}
+function parseCanonicalRecapResource(resource) {
+  if (!resource.startsWith("tinycloud:")) {
+    return { space: resource, path: "" };
+  }
+  const firstSlash = resource.indexOf("/");
+  if (firstSlash < 0) {
+    return { space: resource, path: "" };
+  }
+  const space = resource.slice(0, firstSlash);
+  const rest = resource.slice(firstSlash + 1);
+  const secondSlash = rest.indexOf("/");
+  if (secondSlash < 0) {
+    return { space, path: "" };
+  }
+  return { space, path: rest.slice(secondSlash + 1) };
+}
+function extractImmutableSiweFields(siwe) {
+  const lines = siwe.split(/\r?\n/);
+  const result = {};
+  const headerLine = lines[0];
+  if (headerLine) {
+    const domainMatch = headerLine.match(/^(.+?)\s+wants you to sign in/);
+    if (domainMatch) {
+      result.domain = domainMatch[1];
+    }
+  }
+  for (let i = 1; i < lines.length && i < 5; i++) {
+    const line = lines[i]?.trim() ?? "";
+    if (/^0x[0-9a-fA-F]{40}$/.test(line)) {
+      result.address = line;
+      break;
+    }
+  }
+  for (const line of lines) {
+    const match = line.match(/^([A-Z][A-Za-z ]*):\s*(.*)$/);
+    if (!match) continue;
+    const [, key, value] = match;
+    switch (key) {
+      case "URI":
+        result.uri = value;
+        break;
+      case "Version":
+        result.version = value;
+        break;
+      case "Chain ID":
+        result.chainId = value;
+        break;
+      case "Nonce":
+        result.nonce = value;
+        break;
+      case "Issued At":
+        result.issuedAt = value;
+        break;
+      // Sol MAJOR-4: complete immutable-field coverage.
+      case "Expiration Time":
+        result.expirationTime = value;
+        break;
+      case "Not Before":
+        result.notBefore = value;
+        break;
+      case "Request ID":
+        result.requestId = value;
+        break;
+      default:
+        break;
+    }
+  }
+  const uriLineIdx = lines.findIndex((l) => /^URI:/.test(l));
+  if (uriLineIdx > 3) {
+    let end = uriLineIdx - 1;
+    while (end > 3 && lines[end] === "") end -= 1;
+    if (end >= 3) {
+      result.statement = lines.slice(3, end + 1).join("\n");
+    } else {
+      result.statement = "";
+    }
+  } else {
+    result.statement = "";
+  }
+  result.nonRecapResources = lines.filter((l) => /^- /.test(l) && !/^- urn:recap:/.test(l)).join("\n");
+  return result;
+}
+function diffImmutableSiweFields(original, signed, options2) {
+  const baseKeys = [
+    "domain",
+    "address",
+    "uri",
+    "version",
+    "chainId",
+    "nonce",
+    "issuedAt",
+    "expirationTime",
+    "notBefore",
+    "requestId",
+    "nonRecapResources"
+  ];
+  const keys = options2?.originalHasRecap ? baseKeys : [...baseKeys, "statement"];
+  const diffs = [];
+  for (const key of keys) {
+    const a = original[key] ?? "";
+    const b = signed[key] ?? "";
+    if (a !== b) {
+      diffs.push(key);
+    }
+  }
+  return diffs;
+}
+function extractRecapAttenuations(siwe) {
+  const merged = {};
+  const lines = siwe.split(/\r?\n/);
+  for (const line of lines) {
+    const match = line.match(/urn:recap:([A-Za-z0-9_-]+=*)/);
+    if (!match) continue;
+    const encoded = match[1];
+    let decodedJson;
+    try {
+      const normalized = encoded.replace(/-/g, "+").replace(/_/g, "/");
+      const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+      decodedJson = Buffer.from(padded, "base64").toString("utf8");
+    } catch (err6) {
+      throw new Error(
+        `Failed to decode urn:recap: payload: ${err6.message}`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(decodedJson);
+    } catch (err6) {
+      throw new Error(
+        `urn:recap: payload is not valid JSON: ${err6.message}`
+      );
+    }
+    if (!parsed || typeof parsed !== "object") {
+      throw new Error("urn:recap: payload must be an object");
+    }
+    const att = parsed.att;
+    if (att === void 0) {
+      continue;
+    }
+    if (typeof att !== "object" || att === null || Array.isArray(att)) {
+      throw new Error("urn:recap: att must be an object");
+    }
+    for (const [resource, actionMap] of Object.entries(att)) {
+      if (!actionMap || typeof actionMap !== "object" || Array.isArray(actionMap)) {
+        throw new Error(`urn:recap: att[${resource}] must be an object`);
+      }
+      const existing = merged[resource] ?? {};
+      for (const [action, caveats] of Object.entries(actionMap)) {
+        if (!Array.isArray(caveats)) {
+          throw new Error(
+            `urn:recap: att[${resource}][${action}] must be an array`
+          );
+        }
+        const previous = existing[action] ?? [];
+        existing[action] = previous.concat(caveats);
+      }
+      merged[resource] = existing;
+    }
+  }
+  return merged;
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(",")}]`;
+  }
+  const entries = Object.entries(value).sort(
+    ([a], [b]) => a.localeCompare(b)
+  );
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+}
+function caveatsDeepEqual(a, b) {
+  return stableStringify(a) === stableStringify(b);
+}
+function unauthorizedRecapCapabilities(child, parent) {
+  const unauthorized = [];
+  for (const [resource, actions] of Object.entries(child)) {
+    const parentActions = parent[resource];
+    for (const [action, childCaveatsRaw] of Object.entries(actions)) {
+      if (!parentActions || parentActions[action] === void 0) {
+        unauthorized.push({ resource, action });
+        continue;
+      }
+      const parentCaveatsRaw = parentActions[action];
+      const parentCaveats = Array.isArray(parentCaveatsRaw) ? parentCaveatsRaw : [];
+      const childCaveats = Array.isArray(childCaveatsRaw) ? childCaveatsRaw : [];
+      const parentCanonCounts = /* @__PURE__ */ new Map();
+      for (const c of parentCaveats) {
+        const k = stableStringify(c);
+        parentCanonCounts.set(k, (parentCanonCounts.get(k) ?? 0) + 1);
+      }
+      const childCanonCounts = /* @__PURE__ */ new Map();
+      for (const c of childCaveats) {
+        const k = stableStringify(c);
+        childCanonCounts.set(k, (childCanonCounts.get(k) ?? 0) + 1);
+      }
+      let equal = parentCanonCounts.size === childCanonCounts.size;
+      if (equal) {
+        for (const [k, n] of parentCanonCounts) {
+          if (childCanonCounts.get(k) !== n) {
+            equal = false;
+            break;
+          }
+        }
+      }
+      if (!equal) {
+        unauthorized.push({ resource, action });
+      }
+      void caveatsDeepEqual;
+    }
+  }
+  return unauthorized;
+}
+
 // src/version.ts
 var ProtocolMismatchError = class extends Error {
   constructor(sdkProtocol, nodeProtocol, nodeVersion, host) {
@@ -13620,17 +14106,9 @@ function equals3(a, b) {
   return true;
 }
 
-// ../../node_modules/uint8arrays/dist/src/alloc.node.js
-var import_node_buffer = require("buffer");
-
-// ../../node_modules/uint8arrays/dist/src/util/as-uint8array.node.js
-function asUint8Array(buf) {
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-
-// ../../node_modules/uint8arrays/dist/src/alloc.node.js
+// ../../node_modules/uint8arrays/dist/src/alloc.js
 function allocUnsafe(size = 0) {
-  return asUint8Array(import_node_buffer.Buffer.allocUnsafe(size));
+  return new Uint8Array(size);
 }
 
 // ../../node_modules/uint8-varint/dist/src/index.js
@@ -13806,14 +14284,24 @@ function decode6(buf, offset = 0) {
   }
 }
 
-// ../../node_modules/uint8arrays/dist/src/concat.node.js
-var import_node_buffer2 = require("buffer");
-function concat(arrays, length2) {
-  return asUint8Array(import_node_buffer2.Buffer.concat(arrays, length2));
+// ../../node_modules/uint8arrays/dist/src/util/as-uint8array.js
+function asUint8Array(buf) {
+  return buf;
 }
 
-// ../../node_modules/uint8arrays/dist/src/from-string.node.js
-var import_node_buffer3 = require("buffer");
+// ../../node_modules/uint8arrays/dist/src/concat.js
+function concat(arrays, length2) {
+  if (length2 == null) {
+    length2 = arrays.reduce((acc, curr) => acc + curr.length, 0);
+  }
+  const output = allocUnsafe(length2);
+  let offset = 0;
+  for (const arr of arrays) {
+    output.set(arr, offset);
+    offset += arr.length;
+  }
+  return asUint8Array(output);
+}
 
 // ../../node_modules/uint8arrays/dist/src/util/bases.js
 function createCodec(name2, prefix, encode5, decode7) {
@@ -13862,28 +14350,21 @@ var BASES = {
 };
 var bases_default = BASES;
 
-// ../../node_modules/uint8arrays/dist/src/from-string.node.js
+// ../../node_modules/uint8arrays/dist/src/from-string.js
 function fromString2(string2, encoding = "utf8") {
   const base3 = bases_default[encoding];
   if (base3 == null) {
     throw new Error(`Unsupported encoding "${encoding}"`);
   }
-  if (encoding === "utf8" || encoding === "utf-8") {
-    return asUint8Array(import_node_buffer3.Buffer.from(string2, "utf-8"));
-  }
   return base3.decoder.decode(`${base3.prefix}${string2}`);
 }
 
-// ../../node_modules/uint8arrays/dist/src/to-string.node.js
-var import_node_buffer4 = require("buffer");
+// ../../node_modules/uint8arrays/dist/src/to-string.js
 function toString2(array, encoding = "utf8") {
   const base3 = bases_default[encoding];
   if (base3 == null) {
     throw new Error(`Unsupported encoding "${encoding}"`);
   }
-  if (encoding === "utf8" || encoding === "utf-8") {
-    return import_node_buffer4.Buffer.from(array.buffer, array.byteOffset, array.byteLength).toString("utf8");
-  }
   return base3.encoder.encode(array).substring(1);
 }
 
@@ -13917,8 +14398,218 @@ var UnknownProtocolError = class extends Error {
 };
 __publicField(UnknownProtocolError, "name", "UnknownProtocolError");
 
-// ../../node_modules/@chainsafe/is-ip/lib/is-ip.node.js
-var import_node_net = require("net");
+// ../../node_modules/@chainsafe/is-ip/lib/parser.js
+var Parser = class {
+  constructor() {
+    __publicField(this, "index", 0);
+    __publicField(this, "input", "");
+  }
+  new(input) {
+    this.index = 0;
+    this.input = input;
+    return this;
+  }
+  /** Run a parser, and restore the pre-parse state if it fails. */
+  readAtomically(fn) {
+    const index = this.index;
+    const result = fn();
+    if (result === void 0) {
+      this.index = index;
+    }
+    return result;
+  }
+  /** Run a parser, but fail if the entire input wasn't consumed. Doesn't run atomically. */
+  parseWith(fn) {
+    const result = fn();
+    if (this.index !== this.input.length) {
+      return void 0;
+    }
+    return result;
+  }
+  /** Peek the next character from the input */
+  peekChar() {
+    if (this.index >= this.input.length) {
+      return void 0;
+    }
+    return this.input[this.index];
+  }
+  /** Read the next character from the input */
+  readChar() {
+    if (this.index >= this.input.length) {
+      return void 0;
+    }
+    return this.input[this.index++];
+  }
+  /** Read the next character from the input if it matches the target. */
+  readGivenChar(target) {
+    return this.readAtomically(() => {
+      const char = this.readChar();
+      if (char !== target) {
+        return void 0;
+      }
+      return char;
+    });
+  }
+  /**
+   * Helper for reading separators in an indexed loop. Reads the separator
+   * character iff index > 0, then runs the parser. When used in a loop,
+   * the separator character will only be read on index > 0 (see
+   * readIPv4Addr for an example)
+   */
+  readSeparator(sep, index, inner) {
+    return this.readAtomically(() => {
+      if (index > 0) {
+        if (this.readGivenChar(sep) === void 0) {
+          return void 0;
+        }
+      }
+      return inner();
+    });
+  }
+  /**
+   * Read a number off the front of the input in the given radix, stopping
+   * at the first non-digit character or eof. Fails if the number has more
+   * digits than max_digits or if there is no number.
+   */
+  readNumber(radix, maxDigits, allowZeroPrefix, maxBytes) {
+    return this.readAtomically(() => {
+      let result = 0;
+      let digitCount = 0;
+      const leadingChar = this.peekChar();
+      if (leadingChar === void 0) {
+        return void 0;
+      }
+      const hasLeadingZero = leadingChar === "0";
+      const maxValue2 = 2 ** (8 * maxBytes) - 1;
+      while (true) {
+        const digit = this.readAtomically(() => {
+          const char = this.readChar();
+          if (char === void 0) {
+            return void 0;
+          }
+          const num = Number.parseInt(char, radix);
+          if (Number.isNaN(num)) {
+            return void 0;
+          }
+          return num;
+        });
+        if (digit === void 0) {
+          break;
+        }
+        result *= radix;
+        result += digit;
+        if (result > maxValue2) {
+          return void 0;
+        }
+        digitCount += 1;
+        if (maxDigits !== void 0) {
+          if (digitCount > maxDigits) {
+            return void 0;
+          }
+        }
+      }
+      if (digitCount === 0) {
+        return void 0;
+      } else if (!allowZeroPrefix && hasLeadingZero && digitCount > 1) {
+        return void 0;
+      } else {
+        return result;
+      }
+    });
+  }
+  /** Read an IPv4 address. */
+  readIPv4Addr() {
+    return this.readAtomically(() => {
+      const out = new Uint8Array(4);
+      for (let i = 0; i < out.length; i++) {
+        const ix = this.readSeparator(".", i, () => this.readNumber(10, 3, false, 1));
+        if (ix === void 0) {
+          return void 0;
+        }
+        out[i] = ix;
+      }
+      return out;
+    });
+  }
+  /** Read an IPv6 Address. */
+  readIPv6Addr() {
+    const readGroups = (groups) => {
+      for (let i = 0; i < groups.length / 2; i++) {
+        const ix = i * 2;
+        if (i < groups.length - 3) {
+          const ipv4 = this.readSeparator(":", i, () => this.readIPv4Addr());
+          if (ipv4 !== void 0) {
+            groups[ix] = ipv4[0];
+            groups[ix + 1] = ipv4[1];
+            groups[ix + 2] = ipv4[2];
+            groups[ix + 3] = ipv4[3];
+            return [ix + 4, true];
+          }
+        }
+        const group = this.readSeparator(":", i, () => this.readNumber(16, 4, true, 2));
+        if (group === void 0) {
+          return [ix, false];
+        }
+        groups[ix] = group >> 8;
+        groups[ix + 1] = group & 255;
+      }
+      return [groups.length, false];
+    };
+    return this.readAtomically(() => {
+      const head = new Uint8Array(16);
+      const [headSize, headIp4] = readGroups(head);
+      if (headSize === 16) {
+        return head;
+      }
+      if (headIp4) {
+        return void 0;
+      }
+      if (this.readGivenChar(":") === void 0) {
+        return void 0;
+      }
+      if (this.readGivenChar(":") === void 0) {
+        return void 0;
+      }
+      const tail = new Uint8Array(14);
+      const limit = 16 - (headSize + 2);
+      const [tailSize] = readGroups(tail.subarray(0, limit));
+      head.set(tail.subarray(0, tailSize), 16 - tailSize);
+      return head;
+    });
+  }
+  /** Read an IP Address, either IPv4 or IPv6. */
+  readIPAddr() {
+    return this.readIPv4Addr() ?? this.readIPv6Addr();
+  }
+};
+
+// ../../node_modules/@chainsafe/is-ip/lib/parse.js
+var MAX_IPV6_LENGTH = 45;
+var MAX_IPV4_LENGTH = 15;
+var parser = new Parser();
+function parseIPv4(input) {
+  if (input.length > MAX_IPV4_LENGTH) {
+    return void 0;
+  }
+  return parser.new(input).parseWith(() => parser.readIPv4Addr());
+}
+function parseIPv6(input) {
+  if (input.includes("%")) {
+    input = input.split("%")[0];
+  }
+  if (input.length > MAX_IPV6_LENGTH) {
+    return void 0;
+  }
+  return parser.new(input).parseWith(() => parser.readIPv6Addr());
+}
+
+// ../../node_modules/@chainsafe/is-ip/lib/is-ip.js
+function isIPv4(input) {
+  return Boolean(parseIPv4(input));
+}
+function isIPv6(input) {
+  return Boolean(parseIPv6(input));
+}
 
 // ../../node_modules/@multiformats/multiaddr/dist/src/constants.js
 var CODE_IP4 = 4;
@@ -14040,7 +14731,7 @@ var ip6ToBytes = function(ip) {
   const sections = ip.split(":", 8);
   let i;
   for (i = 0; i < sections.length; i++) {
-    const isv4 = (0, import_node_net.isIPv4)(sections[i]);
+    const isv4 = isIPv4(sections[i]);
     let v4Buffer;
     if (isv4) {
       v4Buffer = ip4ToBytes(sections[i]);
@@ -14207,7 +14898,7 @@ var codecs = [{
   valueToBytes: ip4ToBytes,
   bytesToValue: ip4ToString,
   validate: (value) => {
-    if (!(0, import_node_net.isIPv4)(value)) {
+    if (!isIPv4(value)) {
       throw new ValidationError(`Invalid IPv4 address "${value}"`);
     }
   }
@@ -14240,7 +14931,7 @@ var codecs = [{
   bytesToValue: ip6ToString,
   stringToValue: ip6StringToValue,
   validate: (value) => {
-    if (!(0, import_node_net.isIPv6)(value)) {
+    if (!isIPv6(value)) {
       throw new ValidationError(`Invalid IPv6 address "${value}"`);
     }
   }
@@ -14875,25 +15566,17 @@ ipRegex.v4 = (options2) => options2 && options2.exact ? v4exact : new RegExp(`${
 ipRegex.v6 = (options2) => options2 && options2.exact ? v6exact : new RegExp(`${boundry(options2)}${v6}${boundry(options2)}`, "g");
 var ip_regex_default = ipRegex;
 
-// ../../node_modules/function-timeout/index.js
-var import_node_vm = __toESM(require("vm"), 1);
-function functionTimeout(function_, { timeout } = {}) {
-  const script = new import_node_vm.default.Script("returnValue = function_()");
-  const wrappedFunction = (...arguments_) => {
-    const context = {
-      function_: () => function_(...arguments_)
-    };
-    script.runInNewContext(context, { timeout });
-    return context.returnValue;
-  };
+// ../../node_modules/function-timeout/browser.js
+function functionTimeout(function_) {
+  const wrappedFunction = (...arguments_) => function_(...arguments_);
   Object.defineProperty(wrappedFunction, "name", {
     value: `functionTimeout(${function_.name || "<anonymous>"})`,
     configurable: true
   });
   return wrappedFunction;
 }
-function isTimeoutError(error) {
-  return error?.code === "ERR_SCRIPT_EXECUTION_TIMEOUT";
+function isTimeoutError() {
+  return false;
 }
 
 // ../../node_modules/clone-regexp/node_modules/is-regexp/index.js
@@ -15295,13 +15978,14 @@ async function discoverLocalTinyCloudNode(options2 = {}) {
   }
   const fetchFn = options2.fetch ?? globalThis.fetch;
   const identityStore = options2.identityStore ?? defaultLocalNodeIdentityStore;
-  const staticCandidates = [
-    {
+  const staticCandidates = [];
+  if (options2.localNodeUrl) {
+    staticCandidates.push({
       source: "local-loopback",
-      url: options2.localNodeUrl ?? DEFAULT_LOCAL_NODE_URL,
+      url: options2.localNodeUrl,
       timeoutMs: LOCAL_LOOPBACK_PROBE_TIMEOUT_MS
-    }
-  ];
+    });
+  }
   if (options2.localLinkName) {
     if (isValidDnsLabel(options2.localLinkName)) {
       staticCandidates.push({
@@ -15695,320 +16379,4 @@ function decodeBase64Url(value) {
   }
   return Uint8Array.from(bytes2);
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  ACCOUNT_INDEX_SCHEMA,
-  ACCOUNT_REGISTRY_PATH,
-  ACCOUNT_REGISTRY_SPACE,
-  AccountService,
-  AutoApproveSpaceCreationHandler,
-  BOOTSTRAP_ALLOWLIST,
-  BOOTSTRAP_DEFAULT_SPACE,
-  BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
-  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
-  BOOTSTRAP_MANIFEST,
-  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
-  BOOTSTRAP_PUBLIC_SPACE,
-  BOOTSTRAP_SESSION_REQUESTS,
-  BOOTSTRAP_SPACE_MANIFESTS,
-  BOOTSTRAP_SPACE_NAMES,
-  CAPABILITIES,
-  CAPABILITY_REGISTRY,
-  CapabilityKeyRegistry,
-  CapabilityKeyRegistryErrorCodes,
-  CaveatedDelegationUnsupportedError,
-  ClientSessionSchema,
-  CloudLocationResolutionError,
-  DECRYPT_ACTION,
-  DECRYPT_FACT_TYPE,
-  DECRYPT_RESULT_TYPE,
-  DEFAULT_DEFAULTS,
-  DEFAULT_ENCRYPTION_ALG,
-  DEFAULT_EXPIRY,
-  DEFAULT_KEY_VERSION,
-  DEFAULT_KNOWLEDGE_ROOT,
-  DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY,
-  DEFAULT_LOCAL_NODE_URL,
-  DEFAULT_MANIFEST_SPACE,
-  DEFAULT_MANIFEST_VERSION,
-  DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
-  DEFAULT_TINYCLOUD_FALLBACK_HOST,
-  DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
-  DUCKDB,
-  DataVaultService,
-  DatabaseHandle,
-  DecryptTransportResponseError,
-  DelegationErrorCodes,
-  DelegationManager,
-  DuckDbAction,
-  DuckDbDatabaseHandle,
-  DuckDbService,
-  ED25519_JCS_SIGNATURE_SUITE,
-  EIP191_JCS_SIGNATURE_SUITE,
-  ENCRYPTION,
-  ENCRYPTION_MANIFEST_SPACE,
-  ENCRYPTION_NETWORK_URN_PREFIX,
-  ENCRYPTION_PERMISSION_SERVICE,
-  ENCRYPTION_SERVICE,
-  ENCRYPTION_SERVICE_SHORT,
-  ENVELOPE_VERSION,
-  EXPIRY,
-  EncryptionService,
-  EnsDataSchema,
-  ErrorCodes,
-  HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,
-  HOOKS,
-  HooksService,
-  IdentityParseError,
-  KV,
-  KVService,
-  LISTEN_SQL_STATEMENT_CATALOG,
-  LOCAL_LINK_HOST_SUFFIX,
-  LOCAL_LINK_PROBE_TIMEOUT_MS,
-  LOCAL_LOOPBACK_PROBE_TIMEOUT_MS,
-  LocationRecordValidationError,
-  MAX_CONTENT_BYTES,
-  MAX_SEALED_SHARE_CONTENT_BYTES,
-  MAX_SHARE_ARTIFACT_BYTES,
-  MAX_SHARE_CONTENT_BYTES,
-  ManifestValidationError,
-  MemorySenderShareKeyStorage,
-  MemorySenderShareRecordStorage,
-  MemoryShareCache,
-  NETWORK_NAME_PATTERN,
-  NetworkIdError,
-  POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA,
-  POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA,
-  POLICY_ENGINE_DENIAL_SCHEMA,
-  POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES,
-  POLICY_ENGINE_RECORD_SCHEMA,
-  POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA,
-  POLICY_SCHEMA,
-  POLICY_STATUS_SCHEMA,
-  PORTABLE_DELEGATION_SCHEMA,
-  PermissionNotInManifestError,
-  PrefixedKVService,
-  ProtocolMismatchError,
-  REQUESTER_ENGINE_RETRY_ATTEMPTS,
-  REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,
-  REQUESTER_NEAR_EXPIRY_SECONDS,
-  SECRETS_SPACE,
-  SECRET_NAME_RE,
-  SECRET_RECORDS_SCHEMA,
-  SERVICE_LONG_TO_SHORT,
-  SERVICE_SHORT_TO_LONG,
-  SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
-  SPACE,
-  SQL,
-  SQLAction,
-  SQLService,
-  SecretsService,
-  SenderShareStore,
-  ServiceContext,
-  SessionExpiredError,
-  ShareAccessError,
-  ShareAddressedDelegationEnvelopeV2Schema,
-  ShareAddressedDelegationRequestV2Schema,
-  ShareAddressedDelegationResponseV2Schema,
-  ShareConflict,
-  ShareEnvelopeError,
-  ShareNativeResponseSchema,
-  ShareRecipientClient,
-  SharingService,
-  SignatureMaterialError,
-  SignatureVerificationError,
-  SignedObjectCanonicalizationError,
-  SignedObjectDigestError,
-  SignedObjectIdError,
-  SignedObjectProfileError,
-  SignedObjectSchemaError,
-  SigningKeyBindingError,
-  SilentNotificationHandler,
-  SiweConfigSchema,
-  SiweMessage,
-  Space,
-  SpaceErrorCodes,
-  SpaceService,
-  TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
-  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
-  TINYCLOUD_DEFAULT_SPACE_MANIFEST,
-  TINYCLOUD_PUBLIC_SPACE_MANIFEST,
-  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
-  TinyCloud,
-  TinyCloudDebugLogger,
-  TranscriptRequester,
-  TranscriptRequesterError,
-  UnsupportedFeatureError,
-  UnsupportedSignatureSuiteError,
-  VAULT_PERMISSION_SERVICE,
-  VaultHeaders,
-  VaultPublicSpaceKVActions,
-  VersionCheckError,
-  actionContains,
-  activateSessionWithHost,
-  addressStorageKey,
-  applyPrefix,
-  bootstrapEncryptionNetworkId,
-  bootstrapSpaceId,
-  bootstrapSteps,
-  buildCanonicalDecryptRequest,
-  buildDecryptAttenuation,
-  buildDecryptFacts,
-  buildDecryptInvocation,
-  buildNetworkId,
-  buildSpaceUri,
-  canonicalHashHex,
-  canonicalLocationPayload,
-  canonicalOwnerSharePolicy,
-  canonicalSignedResponse,
-  canonicalizeAddress,
-  canonicalizeDid,
-  canonicalizeDidUrl,
-  canonicalizeEncryptionJson,
-  canonicalizeNetworkId,
-  canonicalizeRecapCaveats,
-  canonicalizeSecretScope,
-  canonicalizeSignedObjectUnsigned,
-  checkDecryptInvocationInput,
-  checkNodeInfo,
-  clearTinyCloudDebugLogs,
-  composeBootstrapSpaceManifest,
-  composeManifestRequest,
-  computeOwnerShareRegistrationCid,
-  computeShareCid,
-  createAndSignPolicy,
-  createAndSignPolicyEngineRecord,
-  createAndSignPolicyStatus,
-  createAndSignSignedObject,
-  createCapabilityKeyRegistry,
-  createDelegatedShareKey,
-  createInMemoryLocalNodeIdentityStore,
-  createLocalStorageLocalNodeIdentityStore,
-  createOpenKeyCallbackSigningStrategy,
-  createPolicyEnforcementDelegation,
-  createShareArtifact,
-  createShareArtifactAsync,
-  createSharePolicy,
-  createSharingService,
-  createSpaceService,
-  createTranscriptRequester,
-  createVaultCrypto,
-  decryptEnvelopeWithKey,
-  decryptShareBytesAsync,
-  defaultRetryPolicy,
-  defaultSignStrategy,
-  defaultSpaceCreationHandler,
-  deriveDelegationCid,
-  deriveSignedObjectMaterial,
-  deriveSignedReceiverKey,
-  didCacheKey,
-  didEquals,
-  disableTinyCloudDebug,
-  discoverLocalTinyCloudNode,
-  discoverNetwork,
-  enableTinyCloudDebug,
-  encodeInlineShareUrl,
-  encodeShareArtifact,
-  encodeShareUrl,
-  encryptShareBytes,
-  encryptShareBytesAsync,
-  encryptToNetwork,
-  encryptionBase64Decode,
-  encryptionBase64Encode,
-  encryptionError,
-  encryptionUtf8Decode,
-  encryptionUtf8Encode,
-  ensureNetworkUsableForDecrypt,
-  err,
-  expandActionShortNames,
-  expandPermissionEntries,
-  expandPermissionEntry,
-  fetchLocationRecord,
-  fetchPeerId,
-  generateRandomReceiverKey,
-  getTinyCloudDebugLogs,
-  hexDecode,
-  hexEncode,
-  httpUrlToMultiaddr,
-  installTinyCloudDebugGlobals,
-  intersectShareCapabilities,
-  isCapabilitySubset,
-  isEvmAddress,
-  isNetworkId,
-  isV2ShareLink,
-  jcsCanonicalize,
-  loadManifest,
-  locationPayloadForRecord,
-  makePkhSpaceId,
-  makePublicSpaceId,
-  manifestAbilitiesUnion,
-  multiaddrToHttpUrl,
-  networkDiscoveryKey,
-  normalizeDefaults,
-  normalizeJson,
-  normalizeShareActions,
-  normalizeShareRecipientTarget,
-  normalizeShareResource,
-  ok,
-  openWrappedKey,
-  parseCanonicalNetworkId,
-  parseExpiry,
-  parseNetworkId,
-  parseNodeNativePortableDelegation,
-  parsePkhDid,
-  parseRecapCapabilities,
-  parseShareArtifact,
-  parseShareUrl,
-  parseSpaceUri,
-  pkhDid,
-  principalDid,
-  principalDidEquals,
-  recapCaveatsEqual,
-  resolveCloudLocation,
-  resolveManifest,
-  resolveManifestKnowledgeRoot,
-  resolveSecretListPrefix,
-  resolveSecretPath,
-  resolveTinyCloudHosts,
-  resourceCapabilitiesToAbilitiesMap,
-  resourceCapabilitiesToSpaceAbilitiesMap,
-  restoreDelegatedShareKey,
-  serializeJcsJson,
-  serviceError,
-  shareCapabilityAllows,
-  shareDeliveryTrustedKid,
-  signLocationRecord,
-  signShareEnvelope,
-  signedObjectIdFor,
-  submitHostDelegation,
-  tinyCloudDebugLogger,
-  toSignedObjectError,
-  validateClientSession,
-  validateEnvelope,
-  validateLocationRecord,
-  validateLocationRecordPayload,
-  validateManifest,
-  validateOwnerSharePolicyRegistration,
-  validateOwnerSharePolicyRegistrationBytes,
-  validatePersistedSessionData,
-  validatePolicyEngineRecordSigned,
-  validatePolicyEngineRecordSignedShape,
-  validatePolicyEngineRecordUnsigned,
-  validatePolicySigned,
-  validatePolicySignedShape,
-  validatePolicyStatusSigned,
-  validatePolicyStatusSignedShape,
-  validatePolicyStatusUnsigned,
-  validatePolicyUnsigned,
-  validateShareDeliveryAuthorizationBytes,
-  verifyDecryptResponse,
-  verifyDidKeyEd25519Signature,
-  verifyLocationRecord,
-  verifyPolicy,
-  verifyPolicyEngineRecord,
-  verifyPolicyStatus,
-  verifyShareCid,
-  verifyShareEnvelope,
-  verifySignedObject
-});
 //# sourceMappingURL=index.cjs.map