@tinycloud/sdk-core 2.3.0-beta.2 → 2.3.0-beta.4

package/dist/index.cjs

@@ -37,51 +37,52 @@ __export(index_exports, {
   CapabilityKeyRegistryErrorCodes: () => CapabilityKeyRegistryErrorCodes,
   ClientSessionSchema: () => ClientSessionSchema,
   CloudLocationResolutionError: () => CloudLocationResolutionError,
-  DECRYPT_ACTION: () => import_sdk_services5.DECRYPT_ACTION,
-  DECRYPT_FACT_TYPE: () => import_sdk_services5.DECRYPT_FACT_TYPE,
-  DECRYPT_RESULT_TYPE: () => import_sdk_services5.DECRYPT_RESULT_TYPE,
+  DECRYPT_ACTION: () => import_sdk_services6.DECRYPT_ACTION,
+  DECRYPT_FACT_TYPE: () => import_sdk_services6.DECRYPT_FACT_TYPE,
+  DECRYPT_RESULT_TYPE: () => import_sdk_services6.DECRYPT_RESULT_TYPE,
   DEFAULT_DEFAULTS: () => DEFAULT_DEFAULTS,
-  DEFAULT_ENCRYPTION_ALG: () => import_sdk_services5.DEFAULT_ENCRYPTION_ALG,
+  DEFAULT_ENCRYPTION_ALG: () => import_sdk_services6.DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY: () => DEFAULT_EXPIRY,
-  DEFAULT_KEY_VERSION: () => import_sdk_services5.DEFAULT_KEY_VERSION,
+  DEFAULT_KEY_VERSION: () => import_sdk_services6.DEFAULT_KEY_VERSION,
   DEFAULT_MANIFEST_SPACE: () => DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION: () => DEFAULT_MANIFEST_VERSION,
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
   DEFAULT_TINYCLOUD_FALLBACK_HOST: () => DEFAULT_TINYCLOUD_FALLBACK_HOST,
   DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL: () => DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
-  DataVaultService: () => import_sdk_services5.DataVaultService,
-  DatabaseHandle: () => import_sdk_services5.DatabaseHandle,
+  DataVaultService: () => import_sdk_services6.DataVaultService,
+  DatabaseHandle: () => import_sdk_services6.DatabaseHandle,
   DelegationErrorCodes: () => DelegationErrorCodes,
   DelegationManager: () => DelegationManager,
-  DuckDbAction: () => import_sdk_services5.DuckDbAction,
-  DuckDbDatabaseHandle: () => import_sdk_services5.DuckDbDatabaseHandle,
-  DuckDbService: () => import_sdk_services5.DuckDbService,
+  DuckDbAction: () => import_sdk_services6.DuckDbAction,
+  DuckDbDatabaseHandle: () => import_sdk_services6.DuckDbDatabaseHandle,
+  DuckDbService: () => import_sdk_services6.DuckDbService,
   ENCRYPTION_MANIFEST_SPACE: () => ENCRYPTION_MANIFEST_SPACE,
-  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_services5.ENCRYPTION_NETWORK_URN_PREFIX,
+  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_services6.ENCRYPTION_NETWORK_URN_PREFIX,
   ENCRYPTION_PERMISSION_SERVICE: () => ENCRYPTION_PERMISSION_SERVICE,
-  ENCRYPTION_SERVICE: () => import_sdk_services5.ENCRYPTION_SERVICE,
-  ENCRYPTION_SERVICE_SHORT: () => import_sdk_services5.ENCRYPTION_SERVICE_SHORT,
-  ENVELOPE_VERSION: () => import_sdk_services5.ENVELOPE_VERSION,
+  ENCRYPTION_SERVICE: () => import_sdk_services6.ENCRYPTION_SERVICE,
+  ENCRYPTION_SERVICE_SHORT: () => import_sdk_services6.ENCRYPTION_SERVICE_SHORT,
+  ENVELOPE_VERSION: () => import_sdk_services6.ENVELOPE_VERSION,
   EXPIRY: () => EXPIRY,
-  EncryptionService: () => import_sdk_services5.EncryptionService,
+  EncryptionService: () => import_sdk_services6.EncryptionService,
   EnsDataSchema: () => EnsDataSchema,
-  ErrorCodes: () => import_sdk_services5.ErrorCodes,
-  HooksService: () => import_sdk_services5.HooksService,
-  KVService: () => import_sdk_services5.KVService,
+  ErrorCodes: () => import_sdk_services6.ErrorCodes,
+  HooksService: () => import_sdk_services6.HooksService,
+  IdentityParseError: () => IdentityParseError,
+  KVService: () => import_sdk_services6.KVService,
   LocationRecordValidationError: () => LocationRecordValidationError,
   ManifestValidationError: () => ManifestValidationError,
-  NETWORK_NAME_PATTERN: () => import_sdk_services5.NETWORK_NAME_PATTERN,
-  NetworkIdError: () => import_sdk_services5.NetworkIdError,
+  NETWORK_NAME_PATTERN: () => import_sdk_services6.NETWORK_NAME_PATTERN,
+  NetworkIdError: () => import_sdk_services6.NetworkIdError,
   PermissionNotInManifestError: () => PermissionNotInManifestError,
-  PrefixedKVService: () => import_sdk_services5.PrefixedKVService,
+  PrefixedKVService: () => import_sdk_services6.PrefixedKVService,
   ProtocolMismatchError: () => ProtocolMismatchError,
-  SECRET_NAME_RE: () => import_sdk_services5.SECRET_NAME_RE,
+  SECRET_NAME_RE: () => import_sdk_services6.SECRET_NAME_RE,
   SERVICE_LONG_TO_SHORT: () => SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG: () => SERVICE_SHORT_TO_LONG,
-  SQLAction: () => import_sdk_services5.SQLAction,
-  SQLService: () => import_sdk_services5.SQLService,
-  SecretsService: () => import_sdk_services5.SecretsService,
-  ServiceContext: () => import_sdk_services5.ServiceContext,
+  SQLAction: () => import_sdk_services6.SQLAction,
+  SQLService: () => import_sdk_services6.SQLService,
+  SecretsService: () => import_sdk_services6.SecretsService,
+  ServiceContext: () => import_sdk_services6.ServiceContext,
   SessionExpiredError: () => SessionExpiredError,
   SharingService: () => SharingService,
   SilentNotificationHandler: () => SilentNotificationHandler,
@@ -93,84 +94,98 @@ __export(index_exports, {
   TinyCloud: () => TinyCloud,
   UnsupportedFeatureError: () => UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE: () => VAULT_PERMISSION_SERVICE,
-  VaultHeaders: () => import_sdk_services5.VaultHeaders,
-  VaultPublicSpaceKVActions: () => import_sdk_services5.VaultPublicSpaceKVActions,
+  VaultHeaders: () => import_sdk_services6.VaultHeaders,
+  VaultPublicSpaceKVActions: () => import_sdk_services6.VaultPublicSpaceKVActions,
   VersionCheckError: () => VersionCheckError,
   activateSessionWithHost: () => activateSessionWithHost,
+  addressStorageKey: () => addressStorageKey,
   applyPrefix: () => applyPrefix,
-  buildCanonicalDecryptRequest: () => import_sdk_services5.buildCanonicalDecryptRequest,
-  buildDecryptAttenuation: () => import_sdk_services5.buildDecryptAttenuation,
-  buildDecryptFacts: () => import_sdk_services5.buildDecryptFacts,
-  buildDecryptInvocation: () => import_sdk_services5.buildDecryptInvocation,
-  buildNetworkId: () => import_sdk_services5.buildNetworkId,
+  buildCanonicalDecryptRequest: () => import_sdk_services6.buildCanonicalDecryptRequest,
+  buildDecryptAttenuation: () => import_sdk_services6.buildDecryptAttenuation,
+  buildDecryptFacts: () => import_sdk_services6.buildDecryptFacts,
+  buildDecryptInvocation: () => import_sdk_services6.buildDecryptInvocation,
+  buildNetworkId: () => import_sdk_services6.buildNetworkId,
   buildSpaceUri: () => buildSpaceUri,
-  canonicalHashHex: () => import_sdk_services5.canonicalHashHex,
+  canonicalHashHex: () => import_sdk_services6.canonicalHashHex,
   canonicalLocationPayload: () => canonicalLocationPayload,
-  canonicalSignedResponse: () => import_sdk_services5.canonicalSignedResponse,
-  canonicalizeEncryptionJson: () => import_sdk_services5.canonicalizeEncryptionJson,
-  canonicalizeSecretScope: () => import_sdk_services5.canonicalizeSecretScope,
-  checkDecryptInvocationInput: () => import_sdk_services5.checkDecryptInvocationInput,
+  canonicalSignedResponse: () => import_sdk_services6.canonicalSignedResponse,
+  canonicalizeAddress: () => canonicalizeAddress,
+  canonicalizeDid: () => canonicalizeDid,
+  canonicalizeDidUrl: () => canonicalizeDidUrl,
+  canonicalizeEncryptionJson: () => import_sdk_services6.canonicalizeEncryptionJson,
+  canonicalizeNetworkId: () => canonicalizeNetworkId,
+  canonicalizeSecretScope: () => import_sdk_services6.canonicalizeSecretScope,
+  checkDecryptInvocationInput: () => import_sdk_services6.checkDecryptInvocationInput,
   checkNodeInfo: () => checkNodeInfo,
   composeManifestRequest: () => composeManifestRequest,
   createCapabilityKeyRegistry: () => createCapabilityKeyRegistry,
   createSharingService: () => createSharingService,
   createSpaceService: () => createSpaceService,
-  createVaultCrypto: () => import_sdk_services5.createVaultCrypto,
-  decryptEnvelopeWithKey: () => import_sdk_services5.decryptEnvelopeWithKey,
-  defaultRetryPolicy: () => import_sdk_services5.defaultRetryPolicy,
+  createVaultCrypto: () => import_sdk_services6.createVaultCrypto,
+  decryptEnvelopeWithKey: () => import_sdk_services6.decryptEnvelopeWithKey,
+  defaultRetryPolicy: () => import_sdk_services6.defaultRetryPolicy,
   defaultSignStrategy: () => defaultSignStrategy,
   defaultSpaceCreationHandler: () => defaultSpaceCreationHandler,
-  deriveSignedReceiverKey: () => import_sdk_services5.deriveSignedReceiverKey,
-  discoverNetwork: () => import_sdk_services5.discoverNetwork,
-  encryptToNetwork: () => import_sdk_services5.encryptToNetwork,
-  encryptionBase64Decode: () => import_sdk_services5.base64Decode,
-  encryptionBase64Encode: () => import_sdk_services5.base64Encode,
-  encryptionError: () => import_sdk_services5.encryptionError,
-  encryptionUtf8Decode: () => import_sdk_services5.utf8Decode,
-  encryptionUtf8Encode: () => import_sdk_services5.utf8Encode,
-  ensureNetworkUsableForDecrypt: () => import_sdk_services5.ensureNetworkUsableForDecrypt,
-  err: () => import_sdk_services5.err,
+  deriveSignedReceiverKey: () => import_sdk_services6.deriveSignedReceiverKey,
+  didCacheKey: () => didCacheKey,
+  didEquals: () => didEquals,
+  discoverNetwork: () => import_sdk_services6.discoverNetwork,
+  encryptToNetwork: () => import_sdk_services6.encryptToNetwork,
+  encryptionBase64Decode: () => import_sdk_services6.base64Decode,
+  encryptionBase64Encode: () => import_sdk_services6.base64Encode,
+  encryptionError: () => import_sdk_services6.encryptionError,
+  encryptionUtf8Decode: () => import_sdk_services6.utf8Decode,
+  encryptionUtf8Encode: () => import_sdk_services6.utf8Encode,
+  ensureNetworkUsableForDecrypt: () => import_sdk_services6.ensureNetworkUsableForDecrypt,
+  err: () => import_sdk_services6.err,
   expandActionShortNames: () => expandActionShortNames,
   expandPermissionEntries: () => expandPermissionEntries,
   expandPermissionEntry: () => expandPermissionEntry,
   fetchLocationRecord: () => fetchLocationRecord,
   fetchPeerId: () => fetchPeerId,
-  generateRandomReceiverKey: () => import_sdk_services5.generateRandomReceiverKey,
-  hexDecode: () => import_sdk_services5.hexDecode,
-  hexEncode: () => import_sdk_services5.hexEncode,
+  generateRandomReceiverKey: () => import_sdk_services6.generateRandomReceiverKey,
+  hexDecode: () => import_sdk_services6.hexDecode,
+  hexEncode: () => import_sdk_services6.hexEncode,
   httpUrlToMultiaddr: () => httpUrlToMultiaddr,
   isCapabilitySubset: () => isCapabilitySubset,
-  isNetworkId: () => import_sdk_services5.isNetworkId,
+  isEvmAddress: () => isEvmAddress,
+  isNetworkId: () => import_sdk_services6.isNetworkId,
   loadManifest: () => loadManifest,
   locationPayloadForRecord: () => locationPayloadForRecord,
+  makePkhSpaceId: () => makePkhSpaceId,
   makePublicSpaceId: () => makePublicSpaceId,
   manifestAbilitiesUnion: () => manifestAbilitiesUnion,
   multiaddrToHttpUrl: () => multiaddrToHttpUrl,
-  networkDiscoveryKey: () => import_sdk_services5.networkDiscoveryKey,
+  networkDiscoveryKey: () => import_sdk_services6.networkDiscoveryKey,
   normalizeDefaults: () => normalizeDefaults,
-  ok: () => import_sdk_services5.ok,
-  openWrappedKey: () => import_sdk_services5.openWrappedKey,
+  ok: () => import_sdk_services6.ok,
+  openWrappedKey: () => import_sdk_services6.openWrappedKey,
+  parseCanonicalNetworkId: () => parseCanonicalNetworkId,
   parseExpiry: () => parseExpiry,
-  parseNetworkId: () => import_sdk_services5.parseNetworkId,
+  parseNetworkId: () => import_sdk_services6.parseNetworkId,
+  parsePkhDid: () => parsePkhDid,
   parseRecapCapabilities: () => parseRecapCapabilities,
   parseSpaceUri: () => parseSpaceUri,
+  pkhDid: () => pkhDid,
+  principalDid: () => principalDid,
+  principalDidEquals: () => principalDidEquals,
   resolveCloudLocation: () => resolveCloudLocation,
   resolveManifest: () => resolveManifest,
-  resolveSecretListPrefix: () => import_sdk_services5.resolveSecretListPrefix,
-  resolveSecretPath: () => import_sdk_services5.resolveSecretPath,
+  resolveSecretListPrefix: () => import_sdk_services6.resolveSecretListPrefix,
+  resolveSecretPath: () => import_sdk_services6.resolveSecretPath,
   resolveTinyCloudHosts: () => resolveTinyCloudHosts,
   resourceCapabilitiesToAbilitiesMap: () => resourceCapabilitiesToAbilitiesMap,
   resourceCapabilitiesToSpaceAbilitiesMap: () => resourceCapabilitiesToSpaceAbilitiesMap,
-  serviceError: () => import_sdk_services5.serviceError,
+  serviceError: () => import_sdk_services6.serviceError,
   signLocationRecord: () => signLocationRecord,
   submitHostDelegation: () => submitHostDelegation,
   validateClientSession: () => validateClientSession,
-  validateEnvelope: () => import_sdk_services5.validateEnvelope,
+  validateEnvelope: () => import_sdk_services6.validateEnvelope,
   validateLocationRecord: () => validateLocationRecord,
   validateLocationRecordPayload: () => validateLocationRecordPayload,
   validateManifest: () => validateManifest,
   validatePersistedSessionData: () => validatePersistedSessionData,
-  verifyDecryptResponse: () => import_sdk_services5.verifyDecryptResponse,
+  verifyDecryptResponse: () => import_sdk_services6.verifyDecryptResponse,
   verifyDidKeyEd25519Signature: () => verifyDidKeyEd25519Signature,
   verifyLocationRecord: () => verifyLocationRecord
 });
@@ -218,6 +233,108 @@ var SilentNotificationHandler = class {
   }
 };
 
+// src/identity.ts
+var import_viem = require("viem");
+var IdentityParseError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IdentityParseError";
+  }
+};
+var PKH_DID_RE = /^did:pkh:eip155:(\d+):(0x[a-fA-F0-9]{40})$/;
+var DID_RE = /^did:[a-z0-9]+:.+$/;
+function splitDidUrl(input) {
+  const fragmentIndex = input.indexOf("#");
+  if (fragmentIndex < 0) {
+    return { did: input, fragment: "" };
+  }
+  return {
+    did: input.slice(0, fragmentIndex),
+    fragment: input.slice(fragmentIndex)
+  };
+}
+function assertValidChainId(chainId) {
+  if (!Number.isSafeInteger(chainId) || chainId <= 0) {
+    throw new IdentityParseError(`Invalid EIP-155 chain ID: ${chainId}`);
+  }
+}
+function isEvmAddress(input) {
+  return (0, import_viem.isAddress)(input, { strict: false });
+}
+function canonicalizeAddress(address) {
+  if (!isEvmAddress(address)) {
+    throw new IdentityParseError(`Invalid EVM address: ${address}`);
+  }
+  return (0, import_viem.getAddress)(address);
+}
+function addressStorageKey(address) {
+  return canonicalizeAddress(address).toLowerCase();
+}
+function pkhDid(address, chainId = 1) {
+  assertValidChainId(chainId);
+  return `did:pkh:eip155:${chainId}:${canonicalizeAddress(address)}`;
+}
+function parsePkhDid(did) {
+  const match = did.match(PKH_DID_RE);
+  if (!match) return null;
+  const chainId = Number(match[1]);
+  assertValidChainId(chainId);
+  return {
+    method: "pkh",
+    namespace: "eip155",
+    chainId,
+    address: canonicalizeAddress(match[2])
+  };
+}
+function canonicalizeDid(did) {
+  const pkh = parsePkhDid(did);
+  if (pkh) {
+    return pkhDid(pkh.address, pkh.chainId);
+  }
+  if (DID_RE.test(did)) {
+    return did;
+  }
+  throw new IdentityParseError(`Invalid DID: ${did}`);
+}
+function canonicalizeDidUrl(didUrl) {
+  const { did, fragment } = splitDidUrl(didUrl);
+  return `${canonicalizeDid(did)}${fragment}`;
+}
+function principalDid(didUrl) {
+  return canonicalizeDid(splitDidUrl(didUrl).did);
+}
+function didEquals(a, b, options = {}) {
+  const canonicalize = options.ignoreFragment ? principalDid : canonicalizeDidUrl;
+  return canonicalize(a) === canonicalize(b);
+}
+function principalDidEquals(a, b) {
+  return didEquals(a, b, { ignoreFragment: true });
+}
+function didCacheKey(input, options = {}) {
+  const { did, fragment } = splitDidUrl(input);
+  const pkh = parsePkhDid(did);
+  const base = pkh ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}` : canonicalizeDid(did);
+  return options.preserveFragment ? `${base}${fragment}` : base;
+}
+function makePkhSpaceId(address, chainId, name) {
+  assertValidChainId(chainId);
+  if (!name) {
+    throw new IdentityParseError("Space name cannot be empty");
+  }
+  return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name}`;
+}
+
+// src/networkId.ts
+var import_sdk_services = require("@tinycloud/sdk-services");
+function canonicalizeNetworkId(networkId) {
+  const parsed = (0, import_sdk_services.parseNetworkId)(networkId);
+  return (0, import_sdk_services.buildNetworkId)(canonicalizeDid(parsed.ownerDid), parsed.name);
+}
+function parseCanonicalNetworkId(networkId) {
+  const canonical = canonicalizeNetworkId(networkId);
+  return (0, import_sdk_services.parseNetworkId)(canonical);
+}
+
 // src/storage.schema.ts
 var import_zod2 = require("zod");
 var ethereumAddressPattern = /^0x[a-fA-F0-9]{40}$/;
@@ -306,10 +423,10 @@ function validatePersistedSessionData(data) {
 }
 
 // src/TinyCloud.ts
-var import_sdk_services2 = require("@tinycloud/sdk-services");
+var import_sdk_services3 = require("@tinycloud/sdk-services");
 
 // src/spaces/SpaceService.ts
-var import_sdk_services = require("@tinycloud/sdk-services");
+var import_sdk_services2 = require("@tinycloud/sdk-services");
 
 // src/spaces/Space.ts
 var Space = class {
@@ -915,6 +1032,14 @@ var DEFAULT_SIGNED_READ_URL_EXPIRY_MS = EXPIRY.SIGNED_READ_URL_MS;
 
 // src/spaces/SpaceService.ts
 var SERVICE_NAME = "space";
+function ownerDidEquals(a, b) {
+  if (!b) return false;
+  try {
+    return principalDidEquals(a, b);
+  } catch {
+    return a === b;
+  }
+}
 var SpaceErrorCodes = {
   /** Space not found */
   NOT_FOUND: "SPACE_NOT_FOUND",
@@ -932,7 +1057,7 @@ var SpaceErrorCodes = {
   NOT_INITIALIZED: "NOT_INITIALIZED"
 };
 function makePublicSpaceId(address, chainId) {
-  return `tinycloud:pkh:eip155:${chainId}:${address}:public`;
+  return makePkhSpaceId(address, chainId, "public");
 }
 function parseSpaceUri(uri) {
   const fullUriMatch = uri.match(
@@ -940,12 +1065,18 @@ function parseSpaceUri(uri) {
   );
   if (fullUriMatch) {
     const [, chainId, address, name] = fullUriMatch;
-    return {
-      owner: `did:pkh:eip155:${chainId}:${address}`,
-      name,
-      chainId,
-      address
-    };
+    try {
+      const chainIdNumber = Number(chainId);
+      const canonicalAddress = canonicalizeAddress(address);
+      return {
+        owner: pkhDid(canonicalAddress, chainIdNumber),
+        name,
+        chainId: String(chainIdNumber),
+        address: canonicalAddress
+      };
+    } catch {
+      return null;
+    }
   }
   if (/^[a-zA-Z0-9_-]+$/.test(uri)) {
     return {
@@ -957,10 +1088,9 @@ function parseSpaceUri(uri) {
   return null;
 }
 function buildSpaceUri(owner, name) {
-  const pkhMatch = owner.match(/^did:pkh:eip155:(\d+):(0x[a-fA-F0-9]{40})$/);
-  if (pkhMatch) {
-    const [, chainId, address] = pkhMatch;
-    return `tinycloud:pkh:eip155:${chainId}:${address}:${name}`;
+  const pkh = parsePkhDid(owner);
+  if (pkh) {
+    return makePkhSpaceId(pkh.address, pkh.chainId, name);
   }
   return `tinycloud:${owner}:${name}`;
 }
@@ -1070,8 +1200,8 @@ var SpaceService = class {
    */
   async list() {
     if (!this.session) {
-      return (0, import_sdk_services.err)(
-        (0, import_sdk_services.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+      return (0, import_sdk_services2.err)(
+        (0, import_sdk_services2.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     try {
@@ -1085,10 +1215,10 @@ var SpaceService = class {
         spaces.push(...delegatedSpaces);
       }
       const uniqueSpaces = this.deduplicateSpaces(spaces);
-      return (0, import_sdk_services.ok)(uniqueSpaces);
+      return (0, import_sdk_services2.ok)(uniqueSpaces);
     } catch (error) {
-      return (0, import_sdk_services.err)(
-        (0, import_sdk_services.serviceError)(
+      return (0, import_sdk_services2.err)(
+        (0, import_sdk_services2.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Failed to list spaces: ${String(error)}`,
           SERVICE_NAME,
@@ -1109,8 +1239,8 @@ var SpaceService = class {
       });
       if (!response.ok) {
         const errorText = await response.text();
-        return (0, import_sdk_services.err)(
-          (0, import_sdk_services.serviceError)(
+        return (0, import_sdk_services2.err)(
+          (0, import_sdk_services2.serviceError)(
             SpaceErrorCodes.NETWORK_ERROR,
             `Failed to list owned spaces: ${response.status} - ${errorText}`,
             SERVICE_NAME,
@@ -1121,8 +1251,8 @@ var SpaceService = class {
       const rawData = await response.json();
       const validationResult = validateServerOwnedSpacesResponse(rawData);
       if (!validationResult.ok) {
-        return (0, import_sdk_services.err)(
-          (0, import_sdk_services.serviceError)(
+        return (0, import_sdk_services2.err)(
+          (0, import_sdk_services2.serviceError)(
             SpaceErrorCodes.NETWORK_ERROR,
             validationResult.error.message,
             SERVICE_NAME,
@@ -1138,10 +1268,10 @@ var SpaceService = class {
         permissions: ["*"]
         // Full permissions for owned spaces
       }));
-      return (0, import_sdk_services.ok)(spaces);
+      return (0, import_sdk_services2.ok)(spaces);
     } catch (error) {
-      return (0, import_sdk_services.err)(
-        (0, import_sdk_services.serviceError)(
+      return (0, import_sdk_services2.err)(
+        (0, import_sdk_services2.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error listing owned spaces: ${String(error)}`,
           SERVICE_NAME,
@@ -1222,13 +1352,13 @@ var SpaceService = class {
    */
   async create(name) {
     if (!this.session) {
-      return (0, import_sdk_services.err)(
-        (0, import_sdk_services.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+      return (0, import_sdk_services2.err)(
+        (0, import_sdk_services2.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     if (!name || !/^[a-zA-Z0-9_-]+$/.test(name)) {
-      return (0, import_sdk_services.err)(
-        (0, import_sdk_services.serviceError)(
+      return (0, import_sdk_services2.err)(
+        (0, import_sdk_services2.serviceError)(
           SpaceErrorCodes.INVALID_NAME,
           "Space name must contain only alphanumeric characters, underscores, and hyphens",
           SERVICE_NAME
@@ -1245,16 +1375,16 @@ var SpaceService = class {
       if (!response.ok) {
         const errorText = await response.text();
         if (response.status === 409) {
-          return (0, import_sdk_services.err)(
-            (0, import_sdk_services.serviceError)(
+          return (0, import_sdk_services2.err)(
+            (0, import_sdk_services2.serviceError)(
               SpaceErrorCodes.ALREADY_EXISTS,
               `Space "${name}" already exists`,
               SERVICE_NAME
             )
           );
         }
-        return (0, import_sdk_services.err)(
-          (0, import_sdk_services.serviceError)(
+        return (0, import_sdk_services2.err)(
+          (0, import_sdk_services2.serviceError)(
             SpaceErrorCodes.CREATION_FAILED,
             `Failed to create space: ${response.status} - ${errorText}`,
             SERVICE_NAME,
@@ -1265,8 +1395,8 @@ var SpaceService = class {
       const rawData = await response.json();
       const validationResult = validateServerCreateSpaceResponse(rawData);
       if (!validationResult.ok) {
-        return (0, import_sdk_services.err)(
-          (0, import_sdk_services.serviceError)(
+        return (0, import_sdk_services2.err)(
+          (0, import_sdk_services2.serviceError)(
             SpaceErrorCodes.CREATION_FAILED,
             validationResult.error.message,
             SERVICE_NAME,
@@ -1282,10 +1412,10 @@ var SpaceService = class {
         permissions: ["*"]
       };
       this.infoCache.set(spaceInfo.id, { info: spaceInfo, cachedAt: Date.now() });
-      return (0, import_sdk_services.ok)(spaceInfo);
+      return (0, import_sdk_services2.ok)(spaceInfo);
     } catch (error) {
-      return (0, import_sdk_services.err)(
-        (0, import_sdk_services.serviceError)(
+      return (0, import_sdk_services2.err)(
+        (0, import_sdk_services2.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error creating space: ${String(error)}`,
           SERVICE_NAME,
@@ -1349,10 +1479,10 @@ var SpaceService = class {
     const spaceId = this.resolveSpaceId(nameOrUri);
     const cached = this.infoCache.get(spaceId);
     if (cached && Date.now() - cached.cachedAt < this.cacheTTL) {
-      return (0, import_sdk_services.ok)(true);
+      return (0, import_sdk_services2.ok)(true);
     }
     const infoResult = await this.getSpaceInfo(spaceId);
-    return (0, import_sdk_services.ok)(infoResult.ok);
+    return (0, import_sdk_services2.ok)(infoResult.ok);
   }
   // ===========================================================================
   // Space Info
@@ -1363,11 +1493,11 @@ var SpaceService = class {
   async getSpaceInfo(spaceId) {
     const cached = this.infoCache.get(spaceId);
     if (cached && Date.now() - cached.cachedAt < this.cacheTTL) {
-      return (0, import_sdk_services.ok)(cached.info);
+      return (0, import_sdk_services2.ok)(cached.info);
     }
     if (!this.session) {
-      return (0, import_sdk_services.err)(
-        (0, import_sdk_services.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+      return (0, import_sdk_services2.err)(
+        (0, import_sdk_services2.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     try {
@@ -1379,13 +1509,13 @@ var SpaceService = class {
       });
       if (!response.ok) {
         if (response.status === 404) {
-          return (0, import_sdk_services.err)(
-            (0, import_sdk_services.serviceError)(SpaceErrorCodes.NOT_FOUND, `Space not found: ${spaceId}`, SERVICE_NAME)
+          return (0, import_sdk_services2.err)(
+            (0, import_sdk_services2.serviceError)(SpaceErrorCodes.NOT_FOUND, `Space not found: ${spaceId}`, SERVICE_NAME)
           );
         }
         const errorText = await response.text();
-        return (0, import_sdk_services.err)(
-          (0, import_sdk_services.serviceError)(
+        return (0, import_sdk_services2.err)(
+          (0, import_sdk_services2.serviceError)(
             SpaceErrorCodes.NETWORK_ERROR,
             `Failed to get space info: ${response.status} - ${errorText}`,
             SERVICE_NAME
@@ -1395,8 +1525,8 @@ var SpaceService = class {
       const rawData = await response.json();
       const validationResult = validateServerSpaceInfoResponse(rawData);
       if (!validationResult.ok) {
-        return (0, import_sdk_services.err)(
-          (0, import_sdk_services.serviceError)(
+        return (0, import_sdk_services2.err)(
+          (0, import_sdk_services2.serviceError)(
             SpaceErrorCodes.NETWORK_ERROR,
             validationResult.error.message,
             SERVICE_NAME,
@@ -1409,15 +1539,15 @@ var SpaceService = class {
         id: data.id,
         name: data.name ?? this.extractNameFromId(data.id),
         owner: data.owner,
-        type: data.type ?? (data.owner === this.userDid ? "owned" : "delegated"),
+        type: data.type ?? (ownerDidEquals(data.owner, this.userDid) ? "owned" : "delegated"),
         permissions: data.permissions,
         expiresAt: data.expiresAt ? new Date(data.expiresAt) : void 0
       };
       this.infoCache.set(spaceId, { info: spaceInfo, cachedAt: Date.now() });
-      return (0, import_sdk_services.ok)(spaceInfo);
+      return (0, import_sdk_services2.ok)(spaceInfo);
     } catch (error) {
-      return (0, import_sdk_services.err)(
-        (0, import_sdk_services.serviceError)(
+      return (0, import_sdk_services2.err)(
+        (0, import_sdk_services2.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error getting space info: ${String(error)}`,
           SERVICE_NAME,
@@ -1488,8 +1618,8 @@ var SpaceService = class {
           });
           if (!response.ok) {
             const errorText = await response.text();
-            return (0, import_sdk_services.err)(
-              (0, import_sdk_services.serviceError)(
+            return (0, import_sdk_services2.err)(
+              (0, import_sdk_services2.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 `Failed to list delegations: ${response.status} - ${errorText}`,
                 SERVICE_NAME
@@ -1499,8 +1629,8 @@ var SpaceService = class {
           const rawData = await response.json();
           const validationResult = validateServerDelegationsResponse(rawData);
           if (!validationResult.ok) {
-            return (0, import_sdk_services.err)(
-              (0, import_sdk_services.serviceError)(
+            return (0, import_sdk_services2.err)(
+              (0, import_sdk_services2.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 validationResult.error.message,
                 SERVICE_NAME,
@@ -1509,10 +1639,10 @@ var SpaceService = class {
             );
           }
           const delegations = transformServerDelegations(validationResult.data, spaceId);
-          return (0, import_sdk_services.ok)(delegations);
+          return (0, import_sdk_services2.ok)(delegations);
         } catch (error) {
-          return (0, import_sdk_services.err)(
-            (0, import_sdk_services.serviceError)(
+          return (0, import_sdk_services2.err)(
+            (0, import_sdk_services2.serviceError)(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error listing delegations: ${String(error)}`,
               SERVICE_NAME
@@ -1543,8 +1673,8 @@ var SpaceService = class {
           });
           if (!response.ok) {
             const errorText = await response.text();
-            return (0, import_sdk_services.err)(
-              (0, import_sdk_services.serviceError)(
+            return (0, import_sdk_services2.err)(
+              (0, import_sdk_services2.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 `Failed to list received delegations: ${response.status} - ${errorText}`,
                 SERVICE_NAME
@@ -1554,8 +1684,8 @@ var SpaceService = class {
           const rawData = await response.json();
           const validationResult = validateServerDelegationsResponse(rawData);
           if (!validationResult.ok) {
-            return (0, import_sdk_services.err)(
-              (0, import_sdk_services.serviceError)(
+            return (0, import_sdk_services2.err)(
+              (0, import_sdk_services2.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 validationResult.error.message,
                 SERVICE_NAME,
@@ -1564,10 +1694,10 @@ var SpaceService = class {
             );
           }
           const delegations = transformServerDelegations(validationResult.data, spaceId);
-          return (0, import_sdk_services.ok)(delegations);
+          return (0, import_sdk_services2.ok)(delegations);
         } catch (error) {
-          return (0, import_sdk_services.err)(
-            (0, import_sdk_services.serviceError)(
+          return (0, import_sdk_services2.err)(
+            (0, import_sdk_services2.serviceError)(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error listing received delegations: ${String(error)}`,
               SERVICE_NAME
@@ -1579,8 +1709,8 @@ var SpaceService = class {
         if (self.createDelegationFn) {
           return self.createDelegationFn({ ...params, spaceId });
         }
-        return (0, import_sdk_services.err)(
-          (0, import_sdk_services.serviceError)(
+        return (0, import_sdk_services2.err)(
+          (0, import_sdk_services2.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Delegation creation requires a createDelegation function. This should be provided by the platform SDK (web-sdk or node-sdk).",
             SERVICE_NAME
@@ -1602,18 +1732,18 @@ var SpaceService = class {
           });
           if (!response.ok) {
             const errorText = await response.text();
-            return (0, import_sdk_services.err)(
-              (0, import_sdk_services.serviceError)(
+            return (0, import_sdk_services2.err)(
+              (0, import_sdk_services2.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 `Failed to revoke delegation: ${response.status} - ${errorText}`,
                 SERVICE_NAME
               )
             );
           }
-          return (0, import_sdk_services.ok)(void 0);
+          return (0, import_sdk_services2.ok)(void 0);
         } catch (error) {
-          return (0, import_sdk_services.err)(
-            (0, import_sdk_services.serviceError)(
+          return (0, import_sdk_services2.err)(
+            (0, import_sdk_services2.serviceError)(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error revoking delegation: ${String(error)}`,
               SERVICE_NAME
@@ -1636,18 +1766,18 @@ var SpaceService = class {
         if (self.sharingService) {
           const result = await self.sharingService.generate(params);
           if (!result.ok) {
-            return (0, import_sdk_services.err)(
-              (0, import_sdk_services.serviceError)(
+            return (0, import_sdk_services2.err)(
+              (0, import_sdk_services2.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 result.error.message || "Failed to generate share link",
                 SERVICE_NAME
               )
             );
           }
-          return (0, import_sdk_services.ok)(result.data);
+          return (0, import_sdk_services2.ok)(result.data);
         }
-        return (0, import_sdk_services.err)(
-          (0, import_sdk_services.serviceError)(
+        return (0, import_sdk_services2.err)(
+          (0, import_sdk_services2.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "SharingService not configured. V2 sharing requires a SharingService instance.",
             SERVICE_NAME
@@ -1655,8 +1785,8 @@ var SpaceService = class {
         );
       },
       async list() {
-        return (0, import_sdk_services.err)(
-          (0, import_sdk_services.serviceError)(
+        return (0, import_sdk_services2.err)(
+          (0, import_sdk_services2.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Listing share links is not supported in v2. Share links are self-contained tokens that are not tracked on the server.",
             SERVICE_NAME
@@ -1664,8 +1794,8 @@ var SpaceService = class {
         );
       },
       async revoke(token) {
-        return (0, import_sdk_services.err)(
-          (0, import_sdk_services.serviceError)(
+        return (0, import_sdk_services2.err)(
+          (0, import_sdk_services2.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Revoking share links by token is not supported in v2. To revoke access, revoke the underlying delegation using space.delegations.revoke(cid).",
             SERVICE_NAME
@@ -1725,7 +1855,7 @@ var TinyCloud = class _TinyCloud {
         "hosts are required to initialize services. Provide them via config.hosts or initializeServices()."
       );
     }
-    this._serviceContext = new import_sdk_services2.ServiceContext({
+    this._serviceContext = new import_sdk_services3.ServiceContext({
       invoke: effectiveInvoke,
       invokeAny: this.config.invokeAny,
       fetch: fetchFn ?? this.config.fetch ?? globalThis.fetch.bind(globalThis),
@@ -1733,10 +1863,10 @@ var TinyCloud = class _TinyCloud {
       retryPolicy: this.config.retryPolicy
     });
     const serviceConstructors = {
-      kv: import_sdk_services2.KVService,
-      sql: import_sdk_services2.SQLService,
-      duckdb: import_sdk_services2.DuckDbService,
-      hooks: import_sdk_services2.HooksService,
+      kv: import_sdk_services3.KVService,
+      sql: import_sdk_services3.SQLService,
+      duckdb: import_sdk_services3.DuckDbService,
+      hooks: import_sdk_services3.HooksService,
       ...this.config.services
     };
     for (const [name, ServiceClass] of Object.entries(serviceConstructors)) {
@@ -1991,18 +2121,18 @@ var TinyCloud = class _TinyCloud {
     const address = this.address();
     const chainId = this.chainId();
     if (!address || !chainId) {
-      return (0, import_sdk_services2.err)(
-        (0, import_sdk_services2.serviceError)(
-          import_sdk_services2.ErrorCodes.AUTH_REQUIRED,
+      return (0, import_sdk_services3.err)(
+        (0, import_sdk_services3.serviceError)(
+          import_sdk_services3.ErrorCodes.AUTH_REQUIRED,
           "Must be signed in to ensure public space",
           "public-space"
         )
       );
     }
     if (!this._serviceContext) {
-      return (0, import_sdk_services2.err)(
-        (0, import_sdk_services2.serviceError)(
-          import_sdk_services2.ErrorCodes.AUTH_REQUIRED,
+      return (0, import_sdk_services3.err)(
+        (0, import_sdk_services3.serviceError)(
+          import_sdk_services3.ErrorCodes.AUTH_REQUIRED,
           "Services not initialized. Call initializeServices() or signIn() first.",
           "public-space"
         )
@@ -2012,9 +2142,9 @@ var TinyCloud = class _TinyCloud {
     try {
       const session = this._serviceContext.session;
       if (!session) {
-        return (0, import_sdk_services2.err)(
-          (0, import_sdk_services2.serviceError)(
-            import_sdk_services2.ErrorCodes.AUTH_REQUIRED,
+        return (0, import_sdk_services3.err)(
+          (0, import_sdk_services3.serviceError)(
+            import_sdk_services3.ErrorCodes.AUTH_REQUIRED,
             "No active session",
             "public-space"
           )
@@ -2031,7 +2161,7 @@ var TinyCloud = class _TinyCloud {
         { method: "POST", headers, body: JSON.stringify({ spaceId }) }
       );
       if (response.ok) {
-        return (0, import_sdk_services2.ok)(void 0);
+        return (0, import_sdk_services3.ok)(void 0);
       }
       if (response.status === 404) {
         const createHeaders = this._serviceContext.invoke(
@@ -2050,31 +2180,31 @@ var TinyCloud = class _TinyCloud {
         );
         if (!createResponse.ok) {
           if (createResponse.status === 409) {
-            return (0, import_sdk_services2.ok)(void 0);
+            return (0, import_sdk_services3.ok)(void 0);
           }
           const errorText2 = await createResponse.text();
-          return (0, import_sdk_services2.err)(
-            (0, import_sdk_services2.serviceError)(
-              import_sdk_services2.ErrorCodes.NETWORK_ERROR,
+          return (0, import_sdk_services3.err)(
+            (0, import_sdk_services3.serviceError)(
+              import_sdk_services3.ErrorCodes.NETWORK_ERROR,
               `Failed to create public space: ${createResponse.status} - ${errorText2}`,
               "public-space"
             )
           );
         }
-        return (0, import_sdk_services2.ok)(void 0);
+        return (0, import_sdk_services3.ok)(void 0);
       }
       const errorText = await response.text();
-      return (0, import_sdk_services2.err)(
-        (0, import_sdk_services2.serviceError)(
-          import_sdk_services2.ErrorCodes.NETWORK_ERROR,
+      return (0, import_sdk_services3.err)(
+        (0, import_sdk_services3.serviceError)(
+          import_sdk_services3.ErrorCodes.NETWORK_ERROR,
           `Failed to check public space: ${response.status} - ${errorText}`,
           "public-space"
         )
       );
     } catch (error) {
-      return (0, import_sdk_services2.err)(
-        (0, import_sdk_services2.serviceError)(
-          import_sdk_services2.ErrorCodes.NETWORK_ERROR,
+      return (0, import_sdk_services3.err)(
+        (0, import_sdk_services3.serviceError)(
+          import_sdk_services3.ErrorCodes.NETWORK_ERROR,
           `Network error ensuring public space: ${String(error)}`,
           "public-space",
           { cause: error instanceof Error ? error : void 0 }
@@ -2107,8 +2237,8 @@ var TinyCloud = class _TinyCloud {
     if (!session) {
       throw new Error("No active session. Sign in first.");
     }
-    const publicKV = new import_sdk_services2.KVService({ prefix: "" });
-    const publicContext = new import_sdk_services2.ServiceContext({
+    const publicKV = new import_sdk_services3.KVService({ prefix: "" });
+    const publicContext = new import_sdk_services3.ServiceContext({
       invoke: this._serviceContext.invoke,
       fetch: this._serviceContext.fetch,
       hosts: this._serviceContext.hosts,
@@ -2140,18 +2270,18 @@ var TinyCloud = class _TinyCloud {
       const response = await doFetch(url, { method: "GET" });
       if (!response.ok) {
         if (response.status === 404) {
-          return (0, import_sdk_services2.err)(
-            (0, import_sdk_services2.serviceError)(
-              import_sdk_services2.ErrorCodes.NOT_FOUND,
+          return (0, import_sdk_services3.err)(
+            (0, import_sdk_services3.serviceError)(
+              import_sdk_services3.ErrorCodes.NOT_FOUND,
               `Key not found: ${key} in space ${spaceId}`,
               "public-space"
             )
           );
         }
         const errorText = await response.text();
-        return (0, import_sdk_services2.err)(
-          (0, import_sdk_services2.serviceError)(
-            import_sdk_services2.ErrorCodes.NETWORK_ERROR,
+        return (0, import_sdk_services3.err)(
+          (0, import_sdk_services3.serviceError)(
+            import_sdk_services3.ErrorCodes.NETWORK_ERROR,
             `Failed to read public space: ${response.status} - ${errorText}`,
             "public-space",
             { meta: { status: response.status } }
@@ -2170,11 +2300,11 @@ var TinyCloud = class _TinyCloud {
           data = text;
         }
       }
-      return (0, import_sdk_services2.ok)(data);
+      return (0, import_sdk_services3.ok)(data);
     } catch (error) {
-      return (0, import_sdk_services2.err)(
-        (0, import_sdk_services2.serviceError)(
-          import_sdk_services2.ErrorCodes.NETWORK_ERROR,
+      return (0, import_sdk_services3.err)(
+        (0, import_sdk_services3.serviceError)(
+          import_sdk_services3.ErrorCodes.NETWORK_ERROR,
           `Network error reading public space: ${String(error)}`,
           "public-space",
           { cause: error instanceof Error ? error : void 0 }
@@ -2200,7 +2330,7 @@ var TinyCloud = class _TinyCloud {
 };
 
 // src/index.ts
-var import_sdk_services5 = require("@tinycloud/sdk-services");
+var import_sdk_services6 = require("@tinycloud/sdk-services");
 
 // src/space.ts
 async function fetchPeerId(host, spaceId) {
@@ -2868,7 +2998,7 @@ function validateEncodedShareData(data) {
 
 // src/manifest.ts
 var import_ms = __toESM(require("ms"), 1);
-var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_sdk_services4 = require("@tinycloud/sdk-services");
 var ManifestValidationError = class extends Error {
   constructor(message) {
     super(`Manifest validation failed: ${message}`);
@@ -3115,13 +3245,13 @@ function validateManifestSecrets(secrets) {
     throw new ManifestValidationError("manifest.secrets must be an object");
   }
   for (const [name, spec] of Object.entries(secrets)) {
-    if (!import_sdk_services3.SECRET_NAME_RE.test(name)) {
+    if (!import_sdk_services4.SECRET_NAME_RE.test(name)) {
       throw new ManifestValidationError(
-        `manifest.secrets.${name} must match ${import_sdk_services3.SECRET_NAME_RE.source}`
+        `manifest.secrets.${name} must match ${import_sdk_services4.SECRET_NAME_RE.source}`
       );
     }
     try {
-      (0, import_sdk_services3.resolveSecretPath)(
+      (0, import_sdk_services4.resolveSecretPath)(
         secretNameFromSpec(name, spec),
         { scope: secretScopeFromSpec(spec) }
       );
@@ -3333,7 +3463,7 @@ function secretEntriesForManifest(secrets) {
   const entries = [];
   for (const [name, spec] of Object.entries(secrets)) {
     const actions = secretActionsFromSpec(name, spec);
-    const secretPath = (0, import_sdk_services3.resolveSecretPath)(
+    const secretPath = (0, import_sdk_services4.resolveSecretPath)(
       secretNameFromSpec(name, spec),
       { scope: secretScopeFromSpec(spec) }
     );
@@ -4264,7 +4394,7 @@ function createSharingService(config) {
 }
 
 // src/authorization/CapabilityKeyRegistry.ts
-var import_sdk_services4 = require("@tinycloud/sdk-services");
+var import_sdk_services5 = require("@tinycloud/sdk-services");
 var SERVICE_NAME2 = "capability-key-registry";
 var CapabilityKeyRegistryErrorCodes = {
   /** Key not found in registry */
@@ -4482,8 +4612,8 @@ var CapabilityKeyRegistry = class {
   revokeDelegation(cid) {
     const stored = this.store.byCid.get(cid);
     if (!stored) {
-      return (0, import_sdk_services4.err)(
-        (0, import_sdk_services4.serviceError)(
+      return (0, import_sdk_services5.err)(
+        (0, import_sdk_services5.serviceError)(
           CapabilityKeyRegistryErrorCodes.KEY_NOT_FOUND,
           `Delegation not found: ${cid}`,
           SERVICE_NAME2
@@ -4505,7 +4635,7 @@ var CapabilityKeyRegistry = class {
         }
       }
     }
-    return (0, import_sdk_services4.ok)(void 0);
+    return (0, import_sdk_services5.ok)(void 0);
   }
   // ===========================================================================
   // Search
@@ -4762,7 +4892,7 @@ var import_multiaddr_to_uri = require("@multiformats/multiaddr-to-uri");
 var import_uri_to_multiaddr = require("@multiformats/uri-to-multiaddr");
 var import_ed25519 = require("@noble/curves/ed25519");
 var import_basics = require("multiformats/basics");
-var import_viem = require("viem");
+var import_viem2 = require("viem");
 var DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 var DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
 var LocationRecordValidationError = class extends Error {
@@ -5068,7 +5198,7 @@ async function verifyPkhSignature(did, payload, signature) {
   if (!/^0x[0-9a-fA-F]+$/.test(signature)) {
     throw new LocationRecordValidationError("did:pkh signature must be hex");
   }
-  return (0, import_viem.verifyMessage)({
+  return (0, import_viem2.verifyMessage)({
     address,
     message: payload,
     signature
@@ -5303,6 +5433,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   EnsDataSchema,
   ErrorCodes,
   HooksService,
+  IdentityParseError,
   KVService,
   LocationRecordValidationError,
   ManifestValidationError,
@@ -5333,6 +5464,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   VaultPublicSpaceKVActions,
   VersionCheckError,
   activateSessionWithHost,
+  addressStorageKey,
   applyPrefix,
   buildCanonicalDecryptRequest,
   buildDecryptAttenuation,
@@ -5343,7 +5475,11 @@ function parseRecapCapabilities(parseWasm, siwe) {
   canonicalHashHex,
   canonicalLocationPayload,
   canonicalSignedResponse,
+  canonicalizeAddress,
+  canonicalizeDid,
+  canonicalizeDidUrl,
   canonicalizeEncryptionJson,
+  canonicalizeNetworkId,
   canonicalizeSecretScope,
   checkDecryptInvocationInput,
   checkNodeInfo,
@@ -5357,6 +5493,8 @@ function parseRecapCapabilities(parseWasm, siwe) {
   defaultSignStrategy,
   defaultSpaceCreationHandler,
   deriveSignedReceiverKey,
+  didCacheKey,
+  didEquals,
   discoverNetwork,
   encryptToNetwork,
   encryptionBase64Decode,
@@ -5376,9 +5514,11 @@ function parseRecapCapabilities(parseWasm, siwe) {
   hexEncode,
   httpUrlToMultiaddr,
   isCapabilitySubset,
+  isEvmAddress,
   isNetworkId,
   loadManifest,
   locationPayloadForRecord,
+  makePkhSpaceId,
   makePublicSpaceId,
   manifestAbilitiesUnion,
   multiaddrToHttpUrl,
@@ -5386,10 +5526,15 @@ function parseRecapCapabilities(parseWasm, siwe) {
   normalizeDefaults,
   ok,
   openWrappedKey,
+  parseCanonicalNetworkId,
   parseExpiry,
   parseNetworkId,
+  parsePkhDid,
   parseRecapCapabilities,
   parseSpaceUri,
+  pkhDid,
+  principalDid,
+  principalDidEquals,
   resolveCloudLocation,
   resolveManifest,
   resolveSecretListPrefix,