@tinycloud/sdk-core 2.11.0-beta.1 → 2.11.0-beta.10

package/dist/index.js

@@ -1858,13 +1858,12 @@ function digest(input, options2) {
 }
 var identity2 = { code: code2, name, encode: encode4, digest };
 
-// ../../node_modules/multiformats/dist/src/hashes/sha2.js
-var sha2_exports = {};
-__export(sha2_exports, {
+// ../../node_modules/multiformats/dist/src/hashes/sha2-browser.js
+var sha2_browser_exports = {};
+__export(sha2_browser_exports, {
   sha256: () => sha2562,
   sha512: () => sha512
 });
-import crypto2 from "crypto";
 
 // ../../node_modules/multiformats/dist/src/hashes/hasher.js
 var DEFAULT_MIN_DIGEST_LENGTH = 20;
@@ -1914,21 +1913,24 @@ function createDigest(digest4, code3, truncate) {
   return create(code3, digest4);
 }
 
-// ../../node_modules/multiformats/dist/src/hashes/sha2.js
+// ../../node_modules/multiformats/dist/src/hashes/sha2-browser.js
+function sha(name2) {
+  return async (data) => new Uint8Array(await crypto.subtle.digest(name2, data));
+}
 var sha2562 = from2({
   name: "sha2-256",
   code: 18,
-  encode: (input) => coerce(crypto2.createHash("sha256").update(input).digest())
+  encode: sha("SHA-256")
 });
 var sha512 = from2({
   name: "sha2-512",
   code: 19,
-  encode: (input) => coerce(crypto2.createHash("sha512").update(input).digest())
+  encode: sha("SHA-512")
 });
 
 // ../../node_modules/multiformats/dist/src/basics.js
 var bases = { ...identity_exports, ...base2_exports, ...base8_exports, ...base10_exports, ...base16_exports, ...base32_exports, ...base36_exports, ...base58_exports, ...base64_exports, ...base256emoji_exports };
-var hashes = { ...sha2_exports, ...identity_exports2 };
+var hashes = { ...sha2_browser_exports, ...identity_exports2 };
 
 // src/policy/signed-object.ts
 import { bytesToHex as bytesToHex2, sha256 as sha2563, verifyMessage } from "viem";
@@ -6360,15 +6362,28 @@ function normalizeSpace(space) {
 function isCapabilitySubset(requested, granted) {
   const missing = [];
   for (const req of requested) {
-    const match = granted.find((g) => canonicalizeEntryMatches(req, g));
-    if (match === void 0) {
+    const matchingScope = granted.filter(
+      (entry) => canonicalizeEntryScopeMatches(req, entry)
+    );
+    const requestedActions = expandActionShortNames(
+      req.service,
+      req.actions
+    );
+    const grantedActions = matchingScope.flatMap(
+      (entry) => expandActionShortNames(entry.service, entry.actions)
+    );
+    const covered = requestedActions.every(
+      (requestedAction) => grantedActions.some(
+        (grantedAction) => actionContains(grantedAction, requestedAction)
+      )
+    );
+    if (!covered) {
       missing.push(cloneEntry(req));
-      continue;
     }
   }
   return { subset: missing.length === 0, missing };
 }
-function canonicalizeEntryMatches(requested, granted) {
+function canonicalizeEntryScopeMatches(requested, granted) {
   if (requested.service !== granted.service) {
     return false;
   }
@@ -6378,15 +6393,6 @@ function canonicalizeEntryMatches(requested, granted) {
   if (!pathContains2(granted.path, requested.path)) {
     return false;
   }
-  const reqActions = new Set(
-    expandActionShortNames(requested.service, requested.actions)
-  );
-  const grantedActions = expandActionShortNames(granted.service, granted.actions);
-  for (const a of reqActions) {
-    if (!grantedActions.some((grantedAction) => actionContains(grantedAction, a))) {
-      return false;
-    }
-  }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
     return false;
   }
@@ -6654,6 +6660,10 @@ function normalizeRecipient(recipient) {
     }
     return { kind: recipient.kind, value: domain };
   }
+  if (recipient.kind === "recipientDid") {
+    if (!isCanonicalRecipientDid(recipient.value)) throw new ShareEnvelopeError("invalid-envelope", "recipient DID is invalid");
+    return { kind: recipient.kind, value: recipient.value };
+  }
   const exact = recipient.value.trim();
   const at = exact.lastIndexOf("@");
   const normalizedExact = at > 0 ? `${exact.slice(0, at)}@${exact.slice(at + 1).toLowerCase()}` : exact;
@@ -6662,6 +6672,28 @@ function normalizeRecipient(recipient) {
   }
   return { kind: recipient.kind, value: normalizedExact };
 }
+function isCanonicalRecipientDid(value) {
+  if (value.length === 0 || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value)) return false;
+  const parts = value.split(":");
+  if (parts.length < 3 || parts[0] !== "did" || !/^[a-z0-9]+$/.test(parts[1] ?? "")) return false;
+  const identifier = parts.slice(2);
+  if (identifier.some((part) => part.length === 0)) return false;
+  if (parts[1] === "web") {
+    const host = identifier[0] ?? "";
+    if (host.length > 253 || host.split(".").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-"))) return false;
+    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  }
+  if (parts[1] === "pkh") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  if (parts[1] === "key") {
+    try {
+      const bytes2 = base58btc.decode(identifier.join(":"));
+      return bytes2.length === 34 && bytes2[0] === 237 && bytes2[1] === 1;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
 function normalizeShareRecipientTarget(recipient) {
   const normalized = normalizeRecipient(recipient);
   if (normalized === void 0) throw new ShareEnvelopeError("invalid-envelope", "recipient matcher is required");
@@ -6748,9 +6780,9 @@ function verifyShareEnvelope(envelope, options2 = {}) {
     const recipient = normalizeRecipient(envelope.recipient);
     if (recipient !== void 0 && JSON.stringify(recipient) !== JSON.stringify(envelope.recipient)) throw new ShareEnvelopeError("invalid-envelope", "recipient is not canonical");
     if (recipient?.kind === "exactEmail" || recipient?.kind === "emailDomain") throw new ShareEnvelopeError("unsafe-plaintext", "recipient matchers are not public envelope fields");
-    if (envelope.recipientKind !== void 0 && !["exactEmail", "emailDomain", "bearer"].includes(envelope.recipientKind)) throw new ShareEnvelopeError("invalid-envelope", "recipient mode is invalid");
+    if (envelope.recipientKind !== void 0 && !["exactEmail", "emailDomain", "recipientDid", "bearer"].includes(envelope.recipientKind)) throw new ShareEnvelopeError("invalid-envelope", "recipient mode is invalid");
     if (envelope.recipientKind === "bearer" && recipient?.kind !== void 0 && recipient.kind !== "bearer") throw new ShareEnvelopeError("invalid-envelope", "recipient mode does not match recipient");
-    if ((envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain") && !envelope.encrypted) throw new ShareEnvelopeError("unsafe-plaintext", "policy shares require encryption");
+    if ((envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain" || envelope.recipientKind === "recipientDid") && !envelope.encrypted) throw new ShareEnvelopeError("unsafe-plaintext", "addressed shares require encryption");
     if (typeof envelope.spaceId !== "string" || envelope.spaceId.length === 0 || typeof envelope.content.mimeType !== "string" || envelope.content.mimeType.length === 0 || typeof envelope.content.digest !== "string" || !/^[A-Za-z0-9_-]+$/.test(envelope.content.digest)) throw new ShareEnvelopeError("invalid-envelope", "content metadata is invalid");
     const maxContentBytes = envelope.encrypted ? options2.maxSealedContentBytes ?? MAX_SEALED_SHARE_CONTENT_BYTES : options2.maxContentBytes ?? MAX_SHARE_CONTENT_BYTES;
     if (!Number.isInteger(envelope.content.size) || envelope.content.size < 0 || envelope.content.size > maxContentBytes) throw new ShareEnvelopeError("content-too-large", "share content exceeds the configured limit");
@@ -6889,7 +6921,7 @@ function parsePolicyMetadata(policyBytes, target, expectedExpiry) {
     assertKeys(policy, ["type", "version", "issuerDid", "recipientMatcher", "target", "delegation", "authority", "actions", "resource", "content-source", "expiresAt"], "published canonical policy material");
     if (typeof policy.issuerDid !== "string" || typeof policy.expiresAt !== "string" || policy.expiresAt !== expectedExpiry) throw new ShareEnvelopeError("invalid-envelope", "policy expiry is not bound to the envelope");
     const matcherValue = policy.recipientMatcher;
-    if (!isPlainObject(matcherValue) || matcherValue.kind !== "exactEmail" && matcherValue.kind !== "emailDomain" || typeof matcherValue.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
+    if (!isPlainObject(matcherValue) || matcherValue.kind !== "exactEmail" && matcherValue.kind !== "emailDomain" && matcherValue.kind !== "recipientDid" || typeof matcherValue.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
     const matcher2 = normalizeRecipient(matcherValue);
     if (matcher2 === void 0 || matcher2.kind === "bearer") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
     if (!isPlainObject(policy.target)) throw new ShareEnvelopeError("invalid-envelope", "policy target is invalid");
@@ -6976,7 +7008,7 @@ function parseCanonicalPublishedV2(value, options2) {
   if (!Number.isFinite(expiry) || expiry <= (options2.now ?? /* @__PURE__ */ new Date()).getTime() || new Date(expiry).toISOString() !== value.expiry) throw new ShareEnvelopeError("expired", "published share envelope has expired");
   if (typeof delegation.cid !== "string" || typeof delegation.issuerDid !== "string" || typeof delegation.audience !== "string" || typeof delegation.expiresAt !== "string" || Date.parse(delegation.expiresAt) > expiry) throw new ShareEnvelopeError("invalid-envelope", "published v2 delegation is invalid");
   const matcher = value.recipientMatcher;
-  if (!isPlainObject(matcher) || matcher.kind !== "exactEmail" && matcher.kind !== "emailDomain" || typeof matcher.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
+  if (!isPlainObject(matcher) || matcher.kind !== "exactEmail" && matcher.kind !== "emailDomain" && matcher.kind !== "recipientDid" || typeof matcher.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
   const normalizedMatcher = normalizeRecipient(matcher);
   if (normalizedMatcher === void 0 || normalizedMatcher.kind === "bearer") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
   if (!Array.isArray(value.actions)) throw new ShareEnvelopeError("invalid-envelope", "published v2 actions are invalid");
@@ -7417,10 +7449,11 @@ var ShareConflict = class extends Error {
   }
 };
 var ShareAccessError = class extends Error {
-  constructor(code3, message) {
+  constructor(code3, message, details) {
     super(message ?? "shared access could not be completed");
     this.name = "ShareAccessError";
     this.code = code3;
+    this.details = details;
   }
 };
 
@@ -7429,6 +7462,7 @@ import { z as z5 } from "zod";
 var ShareRecipientTargetSchema = z5.discriminatedUnion("kind", [
   z5.object({ kind: z5.literal("exactEmail"), value: z5.string().min(1) }).strict(),
   z5.object({ kind: z5.literal("emailDomain"), value: z5.string().min(1) }).strict(),
+  z5.object({ kind: z5.literal("recipientDid"), value: z5.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),
   z5.object({ kind: z5.literal("bearer") }).strict()
 ]);
 var ShareResourceSchema = z5.discriminatedUnion("kind", [
@@ -7472,7 +7506,8 @@ var ShareContentSourceSchema = z5.discriminatedUnion("kind", [
 ]);
 var ShareAddressedRecipientSchema = z5.discriminatedUnion("kind", [
   z5.object({ kind: z5.literal("exactEmail"), value: z5.string().min(1) }).strict(),
-  z5.object({ kind: z5.literal("emailDomain"), value: z5.string().min(1) }).strict()
+  z5.object({ kind: z5.literal("emailDomain"), value: z5.string().min(1) }).strict(),
+  z5.object({ kind: z5.literal("recipientDid"), value: z5.string().regex(/^did:[a-z0-9]+:.+$/) }).strict()
 ]);
 var ShareAddressedDelegationRequestV2Schema = z5.object({
   version: z5.literal(2),
@@ -7727,12 +7762,21 @@ var ShareRecipientClient = class {
       const { envelope } = resolved.artifact;
       const { location } = resolved;
       const bearer = isBearerEnvelope(envelope);
-      const policy = envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain";
+      const policy = envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain" || envelope.authorizationTargetKind === "recipientDid";
       const legacyBearer = !policy && envelope.recipientKind === void 0;
-      if (envelope.authorizationTargetKind === "recipientDid") throw new ShareAccessError("SHARE_RECIPIENT_DID_UNSUPPORTED");
+      let recipientDidSession;
+      if (envelope.authorizationTargetKind === "recipientDid") {
+        if (this.options.establishRecipientDidSession === void 0) throw new ShareAccessError("SHARE_DEVICE_AUTH_REQUIRED", "an OpenKey device authorization is required");
+        const authorization = await this.options.establishRecipientDidSession({ envelope, recipientDid: envelope.recipient?.kind === "recipientDid" ? envelope.recipient.value : "" });
+        if ("state" in authorization) {
+          if (authorization.state === "authorization-required") throw new ShareAccessError("SHARE_DEVICE_AUTH_REQUIRED", "an OpenKey device authorization is required", authorization);
+          throw new ShareAccessError("SHARE_DENIED", "recipient DID authorization was denied", authorization);
+        }
+        recipientDidSession = authorization;
+      }
       if (policy && this.options.bearerSession !== void 0) throw new ShareAccessError("SHARE_POLICY_BEARER_MISMATCH");
       if (bearer && this.options.presentation !== void 0) throw new ShareAccessError("SHARE_BEARER_PRESENTATION_MISMATCH");
-      const session = bearer || legacyBearer ? this.options.bearerSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
+      const session = bearer || legacyBearer ? this.options.bearerSession : recipientDidSession ? recipientDidSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
       const kv = bearer || legacyBearer ? session === void 0 ? void 0 : this.createKV(envelope.origin, session) : void 0;
       const policySession = policy ? session : void 0;
       if (policySession !== void 0) this.assertProvidedPolicySession(policySession, envelope);
@@ -9933,7 +9977,7 @@ function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
   const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
   const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
   const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.jti || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
+  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
     throw new Error("share delivery authorization is not bound to the submitted request");
   }
   if (typeof authorization.issuedAt !== "string" || Date.parse(authorization.issuedAt) > Date.now() + 6e4) throw new Error("share delivery authorization issuedAt is invalid");
@@ -10068,6 +10112,32 @@ var SenderShareStore = class {
   }
 };
 
+// src/delegations/index.ts
+import {
+  authorizeShare,
+  authorizationMethodForTarget,
+  notifyShare,
+  revokeShare,
+  listShares,
+  showShare,
+  publishTargetShare,
+  publishPolicyShare,
+  claimShare,
+  resumeShareAuthorization,
+  isLegacyShareLink,
+  receiveLegacyShare,
+  migrateShare,
+  MemoryEncryptedShareHistoryStorage,
+  EncryptedSenderShareHistory
+} from "@tinycloud/share-sdk";
+import {
+  inspectShare,
+  receiveShare,
+  ShareReceiveError,
+  toShareErrorInfo,
+  verifyBearerEnvelope
+} from "@tinycloud/share-sdk";
+
 // src/networkId.ts
 import {
   buildNetworkId,
@@ -11789,7 +11859,8 @@ var TinyCloud = class _TinyCloud {
 import {
   err as err3,
   ok as ok3,
-  serviceError as serviceError3
+  serviceError as serviceError3,
+  ErrorCodes as ErrorCodes3
 } from "@tinycloud/sdk-services";
 import { ACCOUNT_INDEX_SCHEMA } from "@tinycloud/bootstrap";
 var SERVICE_NAME2 = "account";
@@ -11799,6 +11870,22 @@ var ACCOUNT_SPACES_PATH = "spaces/";
 var AccountService = class {
   constructor(config) {
     this.config = config;
+    /**
+     * Per-account-space memo for {@link ensureAccountIndex}.
+     *
+     * Applying the index migration is a no-op once the schema exists, but the
+     * SQL service still spends two round trips discovering that (create the
+     * migrations table, then read the applied-migration rows). Account bootstrap
+     * touches the index eight times, so without a memo that is ~14 wasted
+     * requests on the cold sign-in path. The in-flight dedupe inside SQLService
+     * never helps here: the node SDK builds a fresh SQLService per
+     * `getAccountDb()` call, so its lock map is always empty.
+     *
+     * Keyed by account space id, so a different account never reuses this entry.
+     * Failures are evicted so a later call retries instead of inheriting a
+     * permanently poisoned result.
+     */
+    this.accountIndexReady = /* @__PURE__ */ new Map();
     this.applications = {
       list: async (options2 = {}) => {
         if (options2.preferIndex) {
@@ -11832,7 +11919,7 @@ var AccountService = class {
         if (!loaded.ok) return accountErr(loaded.error);
         return ok3(applicationFromRecord(key, loaded.data.data));
       },
-      register: async (manifest) => {
+      register: async (manifest, options2 = {}) => {
         const manifests = Array.isArray(manifest) ? manifest : [manifest];
         const request = composeManifestRequest(manifests);
         if (request.registryRecords.length === 0) {
@@ -11850,7 +11937,7 @@ var AccountService = class {
         let registered;
         for (const record of request.registryRecords) {
           const manifestHash = hashJson(record.manifests);
-          if (await this.indexHasApplicationHash(record.app_id, manifestHash)) {
+          if (!options2.assumeUnregistered && await this.indexHasApplicationHash(record.app_id, manifestHash)) {
             registered = {
               appId: record.app_id,
               manifests: record.manifests,
@@ -11925,6 +12012,60 @@ var AccountService = class {
         await this.upsertSpaceIndexQuietly(registered);
         return ok3(registered);
       },
+      /**
+       * Register multiple spaces in one KV batch write + one multi-row index
+       * write, instead of one `register()` round trip per space (TC-373).
+       *
+       * The stored records are computed exactly once and reused for both the
+       * batch attempt and any reconciliation below, so a fallback never mints a
+       * fresh timestamp for a space that already has a written record — a
+       * second `spaceRecordFromInput` call would produce a new content hash and
+       * leave the first attempt's blocks orphaned.
+       */
+      registerBatch: async (spaces) => {
+        if (spaces.length === 0) return ok3({ spaces: [] });
+        await this.config.ensureAccountSpaceHosted?.();
+        const kvResult = this.accountKV();
+        if (!kvResult.ok) return kvResult;
+        const stored = spaces.map((space) => spaceRecordFromInput(space));
+        const registered = stored.map(
+          (record) => spaceFromRecord(spaceKey(record.space_id), record)
+        );
+        const items = stored.map((record) => ({
+          key: spaceKey(record.space_id),
+          value: record
+        }));
+        const batchResult = await kvResult.data.batchPut(items);
+        if (batchResult.ok) {
+          await this.upsertSpacesIndexQuietly(registered);
+          return ok3({ spaces: registered });
+        }
+        if (!isAmbiguousBatchFailure(batchResult.error)) {
+          return accountErr(batchResult.error);
+        }
+        const reconcileFailures = [];
+        for (const record of stored) {
+          const written = await kvResult.data.put(spaceKey(record.space_id), record);
+          if (!written.ok) {
+            reconcileFailures.push(`${record.space_id}: ${written.error.message}`);
+          }
+        }
+        if (reconcileFailures.length > 0) {
+          return err3(
+            serviceError3(
+              "KV_BATCH_RECONCILE_FAILED",
+              `KV batch write for ${items.length} space(s) failed ambiguously (${batchResult.error.message}) and per-space reconciliation also failed for: ${reconcileFailures.join("; ")}`,
+              SERVICE_NAME2,
+              { cause: batchResult.error.cause, meta: { originalError: batchResult.error } }
+            )
+          );
+        }
+        console.warn(
+          `[AccountService] KV batch write for ${items.length} space(s) returned an ambiguous error and was reconciled via per-space fallback. Original error: ${batchResult.error.message}`
+        );
+        await this.upsertSpacesIndexQuietly(registered);
+        return ok3({ spaces: registered, recoveredFromBatchError: batchResult.error });
+      },
       syncAccessible: async () => {
         const listed = await this.config.getSpaces().list();
         if (!listed.ok) return accountErr(listed.error);
@@ -12031,6 +12172,7 @@ var AccountService = class {
         const delegations = await this.delegations.list();
         if (!delegations.ok) return delegations;
         const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+        this.invalidateAccountIndexMemo();
         const schema = await this.ensureAccountIndex(dbResult.data);
         if (!schema.ok) return schema;
         const statements = [
@@ -12310,6 +12452,47 @@ var AccountService = class {
     if (!written.ok) return accountErr(written.error);
     return ok3(void 0);
   }
+  async upsertSpacesIndexQuietly(spaces) {
+    await ignoreIndexFailure(() => this.upsertSpacesIndex(spaces));
+  }
+  /**
+   * Upsert multiple space index rows in ONE multi-row `INSERT OR REPLACE`
+   * statement (TC-373), rather than one statement per space. This matters
+   * because `IDatabaseHandle.batch()` executes its statement list as a plain
+   * loop, not a single database transaction — an N-statement batch is not
+   * atomic. A single multi-row INSERT is one SQLite statement, so it applies
+   * atomically: all rows or none.
+   */
+  async upsertSpacesIndex(spaces) {
+    if (spaces.length === 0) return ok3(void 0);
+    const dbResult = this.accountDb();
+    if (!dbResult.ok) return ok3(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
+    const placeholders = spaces.map(() => "(?, ?, ?, ?, ?, ?, ?, ?, ?)").join(", ");
+    const params = spaces.flatMap((space) => {
+      const updatedAt = space.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+      return [
+        space.spaceId,
+        space.name,
+        space.ownerDid,
+        space.type,
+        JSON.stringify(space.permissions),
+        space.status,
+        space.registeredAt ?? updatedAt,
+        updatedAt,
+        space.expiresAt?.toISOString() ?? null
+      ];
+    });
+    const written = await dbResult.data.batch([
+      {
+        sql: `INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES ${placeholders}`,
+        params
+      }
+    ]);
+    if (!written.ok) return accountErr(written.error);
+    return ok3(void 0);
+  }
   async deleteSpaceIndexQuietly(spaceId) {
     await ignoreIndexFailure(() => this.deleteSpaceIndex(spaceId));
   }
@@ -12430,7 +12613,41 @@ var AccountService = class {
       ]);
     });
   }
+  /**
+   * Apply the account index schema at most once per account space.
+   *
+   * The index is a cache over canonical KV state, and every caller already
+   * tolerates it being absent (`ignoreIndexFailure` / `isMissingIndexError`),
+   * so a memo that is wrong in the "already applied" direction degrades to a
+   * `no such table` read that the caller handles. A memo that is wrong in the
+   * other direction would be a real bug, so failures are never cached.
+   */
   async ensureAccountIndex(db) {
+    const key = this.config.getAccountSpaceId() ?? "";
+    const cached = this.accountIndexReady.get(key);
+    if (cached) return cached;
+    const pending = this.applyAccountIndex(db);
+    this.accountIndexReady.set(key, pending);
+    const evict = () => {
+      if (this.accountIndexReady.get(key) === pending) {
+        this.accountIndexReady.delete(key);
+      }
+    };
+    let settled;
+    try {
+      settled = await pending;
+    } catch (error) {
+      evict();
+      throw error;
+    }
+    if (!settled.ok) evict();
+    return settled;
+  }
+  /** Drop the memo so the next {@link ensureAccountIndex} re-applies the schema. */
+  invalidateAccountIndexMemo() {
+    this.accountIndexReady.delete(this.config.getAccountSpaceId() ?? "");
+  }
+  async applyAccountIndex(db) {
     const migrated = await db.migrations.apply({
       namespace: ACCOUNT_INDEX_NAMESPACE,
       migrations: [
@@ -12602,6 +12819,17 @@ function accountErr(error) {
 function isMissingIndexError(error) {
   return /no such table:/i.test(error.message);
 }
+var AMBIGUOUS_WRITE_STATUSES = /* @__PURE__ */ new Set([500, 502, 503, 504, 520, 522, 524]);
+function isAmbiguousBatchFailure(error) {
+  if (error.code === ErrorCodes3.NETWORK_ERROR || error.code === ErrorCodes3.TIMEOUT) {
+    return error.meta?.requestMayHaveDispatched === true;
+  }
+  if (error.code === ErrorCodes3.KV_WRITE_FAILED) {
+    const status = error.meta?.status;
+    return typeof status === "number" && AMBIGUOUS_WRITE_STATUSES.has(status);
+  }
+  return false;
+}
 async function ignoreIndexFailure(task) {
   try {
     await task();
@@ -12617,7 +12845,7 @@ import {
   ok as ok5,
   err as err5,
   serviceError as serviceError5,
-  ErrorCodes as ErrorCodes3,
+  ErrorCodes as ErrorCodes4,
   TinyCloudDebugLogger,
   tinyCloudDebugLogger,
   enableTinyCloudDebug,
@@ -13291,6 +13519,279 @@ var AutoApproveSpaceCreationHandler = class {
 };
 var defaultSpaceCreationHandler = new AutoApproveSpaceCreationHandler();
 
+// src/authorization/openkey-protocol.ts
+function validateAuthorizationResultV1(value) {
+  if (!value || typeof value !== "object") {
+    return { ok: false, error: "authorization result must be an object" };
+  }
+  const v = value;
+  if (v.protocolVersion !== 1) {
+    return { ok: false, error: `unsupported protocolVersion ${String(v.protocolVersion)}` };
+  }
+  if (typeof v.address !== "string" || !v.address) {
+    return { ok: false, error: "address must be a non-empty string" };
+  }
+  if (typeof v.signature !== "string" || !v.signature) {
+    return { ok: false, error: "signature must be a non-empty string" };
+  }
+  if (typeof v.signedMessage !== "string" || !v.signedMessage) {
+    return { ok: false, error: "signedMessage must be a non-empty string" };
+  }
+  if (!Array.isArray(v.selectedActionKeys) || v.selectedActionKeys.some((k) => typeof k !== "string")) {
+    return { ok: false, error: "selectedActionKeys must be a string[]" };
+  }
+  if (!Array.isArray(v.permissions)) {
+    return { ok: false, error: "permissions must be an array" };
+  }
+  const permissions = [];
+  for (const [index, entry] of v.permissions.entries()) {
+    if (!entry || typeof entry !== "object") {
+      return { ok: false, error: `permissions[${index}] must be an object` };
+    }
+    const e = entry;
+    if (typeof e.service !== "string" || typeof e.space !== "string" || typeof e.path !== "string") {
+      return { ok: false, error: `permissions[${index}] must have string service/space/path` };
+    }
+    if (!Array.isArray(e.actions) || e.actions.some((a) => typeof a !== "string")) {
+      return { ok: false, error: `permissions[${index}].actions must be a string[]` };
+    }
+    permissions.push({
+      service: e.service,
+      space: e.space,
+      path: e.path,
+      actions: e.actions
+    });
+  }
+  return {
+    ok: true,
+    value: {
+      protocolVersion: 1,
+      address: v.address,
+      signature: v.signature,
+      signedMessage: v.signedMessage,
+      selectedActionKeys: v.selectedActionKeys,
+      permissions
+    }
+  };
+}
+var OPENKEY_ACTION_ID_SEPARATOR = "\0";
+function isPlausibleOpenKeyActionId(id) {
+  return typeof id === "string" && id.split(OPENKEY_ACTION_ID_SEPARATOR).length === 4 && id.length > 0;
+}
+function parseCanonicalRecapResource(resource) {
+  if (!resource.startsWith("tinycloud:")) {
+    return { space: resource, path: "" };
+  }
+  const firstSlash = resource.indexOf("/");
+  if (firstSlash < 0) {
+    return { space: resource, path: "" };
+  }
+  const space = resource.slice(0, firstSlash);
+  const rest = resource.slice(firstSlash + 1);
+  const secondSlash = rest.indexOf("/");
+  if (secondSlash < 0) {
+    return { space, path: "" };
+  }
+  return { space, path: rest.slice(secondSlash + 1) };
+}
+function extractImmutableSiweFields(siwe) {
+  const lines = siwe.split(/\r?\n/);
+  const result = {};
+  const headerLine = lines[0];
+  if (headerLine) {
+    const domainMatch = headerLine.match(/^(.+?)\s+wants you to sign in/);
+    if (domainMatch) {
+      result.domain = domainMatch[1];
+    }
+  }
+  for (let i = 1; i < lines.length && i < 5; i++) {
+    const line = lines[i]?.trim() ?? "";
+    if (/^0x[0-9a-fA-F]{40}$/.test(line)) {
+      result.address = line;
+      break;
+    }
+  }
+  for (const line of lines) {
+    const match = line.match(/^([A-Z][A-Za-z ]*):\s*(.*)$/);
+    if (!match) continue;
+    const [, key, value] = match;
+    switch (key) {
+      case "URI":
+        result.uri = value;
+        break;
+      case "Version":
+        result.version = value;
+        break;
+      case "Chain ID":
+        result.chainId = value;
+        break;
+      case "Nonce":
+        result.nonce = value;
+        break;
+      case "Issued At":
+        result.issuedAt = value;
+        break;
+      // Sol MAJOR-4: complete immutable-field coverage.
+      case "Expiration Time":
+        result.expirationTime = value;
+        break;
+      case "Not Before":
+        result.notBefore = value;
+        break;
+      case "Request ID":
+        result.requestId = value;
+        break;
+      default:
+        break;
+    }
+  }
+  const uriLineIdx = lines.findIndex((l) => /^URI:/.test(l));
+  if (uriLineIdx > 3) {
+    let end = uriLineIdx - 1;
+    while (end > 3 && lines[end] === "") end -= 1;
+    if (end >= 3) {
+      result.statement = lines.slice(3, end + 1).join("\n");
+    } else {
+      result.statement = "";
+    }
+  } else {
+    result.statement = "";
+  }
+  result.nonRecapResources = lines.filter((l) => /^- /.test(l) && !/^- urn:recap:/.test(l)).join("\n");
+  return result;
+}
+function diffImmutableSiweFields(original, signed, options2) {
+  const baseKeys = [
+    "domain",
+    "address",
+    "uri",
+    "version",
+    "chainId",
+    "nonce",
+    "issuedAt",
+    "expirationTime",
+    "notBefore",
+    "requestId",
+    "nonRecapResources"
+  ];
+  const keys = options2?.originalHasRecap ? baseKeys : [...baseKeys, "statement"];
+  const diffs = [];
+  for (const key of keys) {
+    const a = original[key] ?? "";
+    const b = signed[key] ?? "";
+    if (a !== b) {
+      diffs.push(key);
+    }
+  }
+  return diffs;
+}
+function extractRecapAttenuations(siwe) {
+  const merged = {};
+  const lines = siwe.split(/\r?\n/);
+  for (const line of lines) {
+    const match = line.match(/urn:recap:([A-Za-z0-9_-]+=*)/);
+    if (!match) continue;
+    const encoded = match[1];
+    let decodedJson;
+    try {
+      const normalized = encoded.replace(/-/g, "+").replace(/_/g, "/");
+      const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+      decodedJson = Buffer.from(padded, "base64").toString("utf8");
+    } catch (err6) {
+      throw new Error(
+        `Failed to decode urn:recap: payload: ${err6.message}`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(decodedJson);
+    } catch (err6) {
+      throw new Error(
+        `urn:recap: payload is not valid JSON: ${err6.message}`
+      );
+    }
+    if (!parsed || typeof parsed !== "object") {
+      throw new Error("urn:recap: payload must be an object");
+    }
+    const att = parsed.att;
+    if (att === void 0) {
+      continue;
+    }
+    if (typeof att !== "object" || att === null || Array.isArray(att)) {
+      throw new Error("urn:recap: att must be an object");
+    }
+    for (const [resource, actionMap] of Object.entries(att)) {
+      if (!actionMap || typeof actionMap !== "object" || Array.isArray(actionMap)) {
+        throw new Error(`urn:recap: att[${resource}] must be an object`);
+      }
+      const existing = merged[resource] ?? {};
+      for (const [action, caveats] of Object.entries(actionMap)) {
+        if (!Array.isArray(caveats)) {
+          throw new Error(
+            `urn:recap: att[${resource}][${action}] must be an array`
+          );
+        }
+        const previous = existing[action] ?? [];
+        existing[action] = previous.concat(caveats);
+      }
+      merged[resource] = existing;
+    }
+  }
+  return merged;
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(",")}]`;
+  }
+  const entries = Object.entries(value).sort(
+    ([a], [b]) => a.localeCompare(b)
+  );
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+}
+function caveatsDeepEqual(a, b) {
+  return stableStringify(a) === stableStringify(b);
+}
+function unauthorizedRecapCapabilities(child, parent) {
+  const unauthorized = [];
+  for (const [resource, actions] of Object.entries(child)) {
+    const parentActions = parent[resource];
+    for (const [action, childCaveatsRaw] of Object.entries(actions)) {
+      if (!parentActions || parentActions[action] === void 0) {
+        unauthorized.push({ resource, action });
+        continue;
+      }
+      const parentCaveatsRaw = parentActions[action];
+      const parentCaveats = Array.isArray(parentCaveatsRaw) ? parentCaveatsRaw : [];
+      const childCaveats = Array.isArray(childCaveatsRaw) ? childCaveatsRaw : [];
+      const parentCanonCounts = /* @__PURE__ */ new Map();
+      for (const c of parentCaveats) {
+        const k = stableStringify(c);
+        parentCanonCounts.set(k, (parentCanonCounts.get(k) ?? 0) + 1);
+      }
+      const childCanonCounts = /* @__PURE__ */ new Map();
+      for (const c of childCaveats) {
+        const k = stableStringify(c);
+        childCanonCounts.set(k, (childCanonCounts.get(k) ?? 0) + 1);
+      }
+      let equal = parentCanonCounts.size === childCanonCounts.size;
+      if (equal) {
+        for (const [k, n] of parentCanonCounts) {
+          if (childCanonCounts.get(k) !== n) {
+            equal = false;
+            break;
+          }
+        }
+      }
+      if (!equal) {
+        unauthorized.push({ resource, action });
+      }
+      void caveatsDeepEqual;
+    }
+  }
+  return unauthorized;
+}
+
 // src/version.ts
 var ProtocolMismatchError = class extends Error {
   constructor(sdkProtocol, nodeProtocol, nodeVersion, host) {
@@ -13402,17 +13903,9 @@ function equals3(a, b) {
   return true;
 }
 
-// ../../node_modules/uint8arrays/dist/src/alloc.node.js
-import { Buffer as Buffer2 } from "buffer";
-
-// ../../node_modules/uint8arrays/dist/src/util/as-uint8array.node.js
-function asUint8Array(buf) {
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-
-// ../../node_modules/uint8arrays/dist/src/alloc.node.js
+// ../../node_modules/uint8arrays/dist/src/alloc.js
 function allocUnsafe(size = 0) {
-  return asUint8Array(Buffer2.allocUnsafe(size));
+  return new Uint8Array(size);
 }
 
 // ../../node_modules/uint8-varint/dist/src/index.js
@@ -13588,14 +14081,24 @@ function decode6(buf, offset = 0) {
   }
 }
 
-// ../../node_modules/uint8arrays/dist/src/concat.node.js
-import { Buffer as Buffer3 } from "buffer";
-function concat(arrays, length2) {
-  return asUint8Array(Buffer3.concat(arrays, length2));
+// ../../node_modules/uint8arrays/dist/src/util/as-uint8array.js
+function asUint8Array(buf) {
+  return buf;
 }
 
-// ../../node_modules/uint8arrays/dist/src/from-string.node.js
-import { Buffer as Buffer4 } from "buffer";
+// ../../node_modules/uint8arrays/dist/src/concat.js
+function concat(arrays, length2) {
+  if (length2 == null) {
+    length2 = arrays.reduce((acc, curr) => acc + curr.length, 0);
+  }
+  const output = allocUnsafe(length2);
+  let offset = 0;
+  for (const arr of arrays) {
+    output.set(arr, offset);
+    offset += arr.length;
+  }
+  return asUint8Array(output);
+}
 
 // ../../node_modules/uint8arrays/dist/src/util/bases.js
 function createCodec(name2, prefix, encode5, decode7) {
@@ -13644,28 +14147,21 @@ var BASES = {
 };
 var bases_default = BASES;
 
-// ../../node_modules/uint8arrays/dist/src/from-string.node.js
+// ../../node_modules/uint8arrays/dist/src/from-string.js
 function fromString2(string2, encoding = "utf8") {
   const base3 = bases_default[encoding];
   if (base3 == null) {
     throw new Error(`Unsupported encoding "${encoding}"`);
   }
-  if (encoding === "utf8" || encoding === "utf-8") {
-    return asUint8Array(Buffer4.from(string2, "utf-8"));
-  }
   return base3.decoder.decode(`${base3.prefix}${string2}`);
 }
 
-// ../../node_modules/uint8arrays/dist/src/to-string.node.js
-import { Buffer as Buffer5 } from "buffer";
+// ../../node_modules/uint8arrays/dist/src/to-string.js
 function toString2(array, encoding = "utf8") {
   const base3 = bases_default[encoding];
   if (base3 == null) {
     throw new Error(`Unsupported encoding "${encoding}"`);
   }
-  if (encoding === "utf8" || encoding === "utf-8") {
-    return Buffer5.from(array.buffer, array.byteOffset, array.byteLength).toString("utf8");
-  }
   return base3.encoder.encode(array).substring(1);
 }
 
@@ -13699,8 +14195,218 @@ var UnknownProtocolError = class extends Error {
 };
 __publicField(UnknownProtocolError, "name", "UnknownProtocolError");
 
-// ../../node_modules/@chainsafe/is-ip/lib/is-ip.node.js
-import { isIPv4, isIPv6, isIP as ipVersion } from "net";
+// ../../node_modules/@chainsafe/is-ip/lib/parser.js
+var Parser = class {
+  constructor() {
+    __publicField(this, "index", 0);
+    __publicField(this, "input", "");
+  }
+  new(input) {
+    this.index = 0;
+    this.input = input;
+    return this;
+  }
+  /** Run a parser, and restore the pre-parse state if it fails. */
+  readAtomically(fn) {
+    const index = this.index;
+    const result = fn();
+    if (result === void 0) {
+      this.index = index;
+    }
+    return result;
+  }
+  /** Run a parser, but fail if the entire input wasn't consumed. Doesn't run atomically. */
+  parseWith(fn) {
+    const result = fn();
+    if (this.index !== this.input.length) {
+      return void 0;
+    }
+    return result;
+  }
+  /** Peek the next character from the input */
+  peekChar() {
+    if (this.index >= this.input.length) {
+      return void 0;
+    }
+    return this.input[this.index];
+  }
+  /** Read the next character from the input */
+  readChar() {
+    if (this.index >= this.input.length) {
+      return void 0;
+    }
+    return this.input[this.index++];
+  }
+  /** Read the next character from the input if it matches the target. */
+  readGivenChar(target) {
+    return this.readAtomically(() => {
+      const char = this.readChar();
+      if (char !== target) {
+        return void 0;
+      }
+      return char;
+    });
+  }
+  /**
+   * Helper for reading separators in an indexed loop. Reads the separator
+   * character iff index > 0, then runs the parser. When used in a loop,
+   * the separator character will only be read on index > 0 (see
+   * readIPv4Addr for an example)
+   */
+  readSeparator(sep, index, inner) {
+    return this.readAtomically(() => {
+      if (index > 0) {
+        if (this.readGivenChar(sep) === void 0) {
+          return void 0;
+        }
+      }
+      return inner();
+    });
+  }
+  /**
+   * Read a number off the front of the input in the given radix, stopping
+   * at the first non-digit character or eof. Fails if the number has more
+   * digits than max_digits or if there is no number.
+   */
+  readNumber(radix, maxDigits, allowZeroPrefix, maxBytes) {
+    return this.readAtomically(() => {
+      let result = 0;
+      let digitCount = 0;
+      const leadingChar = this.peekChar();
+      if (leadingChar === void 0) {
+        return void 0;
+      }
+      const hasLeadingZero = leadingChar === "0";
+      const maxValue2 = 2 ** (8 * maxBytes) - 1;
+      while (true) {
+        const digit = this.readAtomically(() => {
+          const char = this.readChar();
+          if (char === void 0) {
+            return void 0;
+          }
+          const num = Number.parseInt(char, radix);
+          if (Number.isNaN(num)) {
+            return void 0;
+          }
+          return num;
+        });
+        if (digit === void 0) {
+          break;
+        }
+        result *= radix;
+        result += digit;
+        if (result > maxValue2) {
+          return void 0;
+        }
+        digitCount += 1;
+        if (maxDigits !== void 0) {
+          if (digitCount > maxDigits) {
+            return void 0;
+          }
+        }
+      }
+      if (digitCount === 0) {
+        return void 0;
+      } else if (!allowZeroPrefix && hasLeadingZero && digitCount > 1) {
+        return void 0;
+      } else {
+        return result;
+      }
+    });
+  }
+  /** Read an IPv4 address. */
+  readIPv4Addr() {
+    return this.readAtomically(() => {
+      const out = new Uint8Array(4);
+      for (let i = 0; i < out.length; i++) {
+        const ix = this.readSeparator(".", i, () => this.readNumber(10, 3, false, 1));
+        if (ix === void 0) {
+          return void 0;
+        }
+        out[i] = ix;
+      }
+      return out;
+    });
+  }
+  /** Read an IPv6 Address. */
+  readIPv6Addr() {
+    const readGroups = (groups) => {
+      for (let i = 0; i < groups.length / 2; i++) {
+        const ix = i * 2;
+        if (i < groups.length - 3) {
+          const ipv4 = this.readSeparator(":", i, () => this.readIPv4Addr());
+          if (ipv4 !== void 0) {
+            groups[ix] = ipv4[0];
+            groups[ix + 1] = ipv4[1];
+            groups[ix + 2] = ipv4[2];
+            groups[ix + 3] = ipv4[3];
+            return [ix + 4, true];
+          }
+        }
+        const group = this.readSeparator(":", i, () => this.readNumber(16, 4, true, 2));
+        if (group === void 0) {
+          return [ix, false];
+        }
+        groups[ix] = group >> 8;
+        groups[ix + 1] = group & 255;
+      }
+      return [groups.length, false];
+    };
+    return this.readAtomically(() => {
+      const head = new Uint8Array(16);
+      const [headSize, headIp4] = readGroups(head);
+      if (headSize === 16) {
+        return head;
+      }
+      if (headIp4) {
+        return void 0;
+      }
+      if (this.readGivenChar(":") === void 0) {
+        return void 0;
+      }
+      if (this.readGivenChar(":") === void 0) {
+        return void 0;
+      }
+      const tail = new Uint8Array(14);
+      const limit = 16 - (headSize + 2);
+      const [tailSize] = readGroups(tail.subarray(0, limit));
+      head.set(tail.subarray(0, tailSize), 16 - tailSize);
+      return head;
+    });
+  }
+  /** Read an IP Address, either IPv4 or IPv6. */
+  readIPAddr() {
+    return this.readIPv4Addr() ?? this.readIPv6Addr();
+  }
+};
+
+// ../../node_modules/@chainsafe/is-ip/lib/parse.js
+var MAX_IPV6_LENGTH = 45;
+var MAX_IPV4_LENGTH = 15;
+var parser = new Parser();
+function parseIPv4(input) {
+  if (input.length > MAX_IPV4_LENGTH) {
+    return void 0;
+  }
+  return parser.new(input).parseWith(() => parser.readIPv4Addr());
+}
+function parseIPv6(input) {
+  if (input.includes("%")) {
+    input = input.split("%")[0];
+  }
+  if (input.length > MAX_IPV6_LENGTH) {
+    return void 0;
+  }
+  return parser.new(input).parseWith(() => parser.readIPv6Addr());
+}
+
+// ../../node_modules/@chainsafe/is-ip/lib/is-ip.js
+function isIPv4(input) {
+  return Boolean(parseIPv4(input));
+}
+function isIPv6(input) {
+  return Boolean(parseIPv6(input));
+}
 
 // ../../node_modules/@multiformats/multiaddr/dist/src/constants.js
 var CODE_IP4 = 4;
@@ -14657,25 +15363,17 @@ ipRegex.v4 = (options2) => options2 && options2.exact ? v4exact : new RegExp(`${
 ipRegex.v6 = (options2) => options2 && options2.exact ? v6exact : new RegExp(`${boundry(options2)}${v6}${boundry(options2)}`, "g");
 var ip_regex_default = ipRegex;
 
-// ../../node_modules/function-timeout/index.js
-import vm from "vm";
-function functionTimeout(function_, { timeout } = {}) {
-  const script = new vm.Script("returnValue = function_()");
-  const wrappedFunction = (...arguments_) => {
-    const context = {
-      function_: () => function_(...arguments_)
-    };
-    script.runInNewContext(context, { timeout });
-    return context.returnValue;
-  };
+// ../../node_modules/function-timeout/browser.js
+function functionTimeout(function_) {
+  const wrappedFunction = (...arguments_) => function_(...arguments_);
   Object.defineProperty(wrappedFunction, "name", {
     value: `functionTimeout(${function_.name || "<anonymous>"})`,
     configurable: true
   });
   return wrappedFunction;
 }
-function isTimeoutError(error) {
-  return error?.code === "ERR_SCRIPT_EXECUTION_TIMEOUT";
+function isTimeoutError() {
+  return false;
 }
 
 // ../../node_modules/clone-regexp/node_modules/is-regexp/index.js
@@ -15077,13 +15775,14 @@ async function discoverLocalTinyCloudNode(options2 = {}) {
   }
   const fetchFn = options2.fetch ?? globalThis.fetch;
   const identityStore = options2.identityStore ?? defaultLocalNodeIdentityStore;
-  const staticCandidates = [
-    {
+  const staticCandidates = [];
+  if (options2.localNodeUrl) {
+    staticCandidates.push({
       source: "local-loopback",
-      url: options2.localNodeUrl ?? DEFAULT_LOCAL_NODE_URL,
+      url: options2.localNodeUrl,
       timeoutMs: LOCAL_LOOPBACK_PROBE_TIMEOUT_MS
-    }
-  ];
+    });
+  }
   if (options2.localLinkName) {
     if (isValidDnsLabel(options2.localLinkName)) {
       staticCandidates.push({
@@ -15536,7 +16235,7 @@ export {
   EXPIRY,
   EncryptionService,
   EnsDataSchema,
-  ErrorCodes3 as ErrorCodes,
+  ErrorCodes4 as ErrorCodes,
   HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,
   HOOKS,
   HooksService2 as HooksService,
@@ -15558,6 +16257,7 @@ export {
   MemoryShareCache,
   NETWORK_NAME_PATTERN,
   NetworkIdError,
+  OPENKEY_ACTION_ID_SEPARATOR,
   POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA,
   POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA,
   POLICY_ENGINE_DENIAL_SCHEMA,
@@ -15684,6 +16384,7 @@ export {
   deriveSignedReceiverKey,
   didCacheKey,
   didEquals,
+  diffImmutableSiweFields,
   disableTinyCloudDebug,
   discoverLocalTinyCloudNode,
   discoverNetwork,
@@ -15704,6 +16405,8 @@ export {
   expandActionShortNames,
   expandPermissionEntries,
   expandPermissionEntry,
+  extractImmutableSiweFields,
+  extractRecapAttenuations,
   fetchLocationRecord,
   fetchPeerId,
   generateRandomReceiverKey,
@@ -15716,6 +16419,7 @@ export {
   isCapabilitySubset,
   isEvmAddress,
   isNetworkId,
+  isPlausibleOpenKeyActionId,
   isV2ShareLink,
   jcsCanonicalize,
   loadManifest,
@@ -15733,6 +16437,7 @@ export {
   ok5 as ok,
   openWrappedKey,
   parseCanonicalNetworkId,
+  parseCanonicalRecapResource,
   parseExpiry,
   parseNetworkId2 as parseNetworkId,
   parseNodeNativePortableDelegation,
@@ -15764,6 +16469,8 @@ export {
   submitHostDelegation,
   tinyCloudDebugLogger,
   toSignedObjectError,
+  unauthorizedRecapCapabilities,
+  validateAuthorizationResultV1,
   validateClientSession,
   validateEnvelope,
   validateLocationRecord,