@tinycloud/sdk-core 2.7.0-beta.2 → 2.7.0-beta.4

package/dist/index.cjs

@@ -5,15 +5,19 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
+var __copyProps = (to, from3, except, desc) => {
+  if (from3 && typeof from3 === "object" || typeof from3 === "function") {
+    for (let key of __getOwnPropNames(from3))
       if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+        __defProp(to, key, { get: () => from3[key], enumerable: !(desc = __getOwnPropDesc(from3, key)) || desc.enumerable });
   }
   return to;
 };
@@ -26,6 +30,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
 
 // src/index.ts
 var index_exports = {};
@@ -49,6 +58,7 @@ __export(index_exports, {
   CAPABILITY_REGISTRY: () => import_bootstrap3.CAPABILITY_REGISTRY,
   CapabilityKeyRegistry: () => CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes: () => CapabilityKeyRegistryErrorCodes,
+  CaveatedDelegationUnsupportedError: () => CaveatedDelegationUnsupportedError,
   ClientSessionSchema: () => ClientSessionSchema,
   CloudLocationResolutionError: () => CloudLocationResolutionError,
   DECRYPT_ACTION: () => import_sdk_services7.DECRYPT_ACTION,
@@ -67,6 +77,7 @@ __export(index_exports, {
   DUCKDB: () => import_bootstrap3.DUCKDB,
   DataVaultService: () => import_sdk_services7.DataVaultService,
   DatabaseHandle: () => import_sdk_services7.DatabaseHandle,
+  DecryptTransportResponseError: () => import_sdk_services7.DecryptTransportResponseError,
   DelegationErrorCodes: () => DelegationErrorCodes,
   DelegationManager: () => DelegationManager,
   DuckDbAction: () => import_sdk_services7.DuckDbAction,
@@ -174,6 +185,7 @@ __export(index_exports, {
   canonicalizeDidUrl: () => canonicalizeDidUrl,
   canonicalizeEncryptionJson: () => import_sdk_services7.canonicalizeEncryptionJson,
   canonicalizeNetworkId: () => canonicalizeNetworkId,
+  canonicalizeRecapCaveats: () => canonicalizeRecapCaveats,
   canonicalizeSecretScope: () => import_sdk_services7.canonicalizeSecretScope,
   canonicalizeSignedObjectUnsigned: () => canonicalizeSignedObjectUnsigned,
   checkDecryptInvocationInput: () => import_sdk_services7.checkDecryptInvocationInput,
@@ -247,6 +259,7 @@ __export(index_exports, {
   pkhDid: () => pkhDid,
   principalDid: () => principalDid,
   principalDidEquals: () => principalDidEquals,
+  recapCaveatsEqual: () => recapCaveatsEqual,
   resolveCloudLocation: () => resolveCloudLocation,
   resolveManifest: () => resolveManifest,
   resolveManifestKnowledgeRoot: () => resolveManifestKnowledgeRoot,
@@ -399,40 +412,945 @@ function canonicalizeDidUrl(didUrl) {
 function principalDid(didUrl) {
   return canonicalizeDid(splitDidUrl(didUrl).did);
 }
-function didEquals(a, b, options = {}) {
-  const canonicalize = options.ignoreFragment ? principalDid : canonicalizeDidUrl;
+function didEquals(a, b, options2 = {}) {
+  const canonicalize = options2.ignoreFragment ? principalDid : canonicalizeDidUrl;
   return canonicalize(a) === canonicalize(b);
 }
 function principalDidEquals(a, b) {
   return didEquals(a, b, { ignoreFragment: true });
 }
-function didCacheKey(input, options = {}) {
+function didCacheKey(input, options2 = {}) {
   const { did, fragment } = splitDidUrl(input);
   const pkh = parsePkhDid(did);
-  const base = pkh ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}` : canonicalizeDid(did);
-  return options.preserveFragment ? `${base}${fragment}` : base;
+  const base3 = pkh ? `did:pkh:eip155:${pkh.chainId}:${addressStorageKey(pkh.address)}` : canonicalizeDid(did);
+  return options2.preserveFragment ? `${base3}${fragment}` : base3;
 }
-function makePkhSpaceId(address, chainId, name) {
+function makePkhSpaceId(address, chainId, name2) {
   assertValidChainId(chainId);
-  if (!name) {
+  if (!name2) {
     throw new IdentityParseError("Space name cannot be empty");
   }
-  return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name}`;
+  return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name2}`;
 }
 
 // src/requester/index.ts
 var import_viem4 = require("viem");
 var import_blake3 = require("@noble/hashes/blake3");
-var import_cid = require("multiformats/cid");
-var import_digest = require("multiformats/hashes/digest");
+
+// ../../node_modules/multiformats/dist/src/bases/base32.js
+var base32_exports = {};
+__export(base32_exports, {
+  base32: () => base32,
+  base32hex: () => base32hex,
+  base32hexpad: () => base32hexpad,
+  base32hexpadupper: () => base32hexpadupper,
+  base32hexupper: () => base32hexupper,
+  base32pad: () => base32pad,
+  base32padupper: () => base32padupper,
+  base32upper: () => base32upper,
+  base32z: () => base32z
+});
+
+// ../../node_modules/multiformats/dist/src/bytes.js
+var empty = new Uint8Array(0);
+function equals(aa, bb) {
+  if (aa === bb) {
+    return true;
+  }
+  if (aa.byteLength !== bb.byteLength) {
+    return false;
+  }
+  for (let ii = 0; ii < aa.byteLength; ii++) {
+    if (aa[ii] !== bb[ii]) {
+      return false;
+    }
+  }
+  return true;
+}
+function coerce(o) {
+  if (o instanceof Uint8Array && o.constructor.name === "Uint8Array") {
+    return o;
+  }
+  if (o instanceof ArrayBuffer) {
+    return new Uint8Array(o);
+  }
+  if (ArrayBuffer.isView(o)) {
+    return new Uint8Array(o.buffer, o.byteOffset, o.byteLength);
+  }
+  throw new Error("Unknown type, must be binary type");
+}
+function fromString(str) {
+  return new TextEncoder().encode(str);
+}
+function toString(b) {
+  return new TextDecoder().decode(b);
+}
+
+// ../../node_modules/multiformats/dist/src/vendor/base-x.js
+function base(ALPHABET, name2) {
+  if (ALPHABET.length >= 255) {
+    throw new TypeError("Alphabet too long");
+  }
+  var BASE_MAP = new Uint8Array(256);
+  for (var j = 0; j < BASE_MAP.length; j++) {
+    BASE_MAP[j] = 255;
+  }
+  for (var i = 0; i < ALPHABET.length; i++) {
+    var x = ALPHABET.charAt(i);
+    var xc = x.charCodeAt(0);
+    if (BASE_MAP[xc] !== 255) {
+      throw new TypeError(x + " is ambiguous");
+    }
+    BASE_MAP[xc] = i;
+  }
+  var BASE = ALPHABET.length;
+  var LEADER = ALPHABET.charAt(0);
+  var FACTOR = Math.log(BASE) / Math.log(256);
+  var iFACTOR = Math.log(256) / Math.log(BASE);
+  function encode5(source) {
+    if (source instanceof Uint8Array)
+      ;
+    else if (ArrayBuffer.isView(source)) {
+      source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+    } else if (Array.isArray(source)) {
+      source = Uint8Array.from(source);
+    }
+    if (!(source instanceof Uint8Array)) {
+      throw new TypeError("Expected Uint8Array");
+    }
+    if (source.length === 0) {
+      return "";
+    }
+    var zeroes = 0;
+    var length2 = 0;
+    var pbegin = 0;
+    var pend = source.length;
+    while (pbegin !== pend && source[pbegin] === 0) {
+      pbegin++;
+      zeroes++;
+    }
+    var size = (pend - pbegin) * iFACTOR + 1 >>> 0;
+    var b58 = new Uint8Array(size);
+    while (pbegin !== pend) {
+      var carry = source[pbegin];
+      var i2 = 0;
+      for (var it1 = size - 1; (carry !== 0 || i2 < length2) && it1 !== -1; it1--, i2++) {
+        carry += 256 * b58[it1] >>> 0;
+        b58[it1] = carry % BASE >>> 0;
+        carry = carry / BASE >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length2 = i2;
+      pbegin++;
+    }
+    var it2 = size - length2;
+    while (it2 !== size && b58[it2] === 0) {
+      it2++;
+    }
+    var str = LEADER.repeat(zeroes);
+    for (; it2 < size; ++it2) {
+      str += ALPHABET.charAt(b58[it2]);
+    }
+    return str;
+  }
+  function decodeUnsafe(source) {
+    if (typeof source !== "string") {
+      throw new TypeError("Expected String");
+    }
+    if (source.length === 0) {
+      return new Uint8Array();
+    }
+    var psz = 0;
+    if (source[psz] === " ") {
+      return;
+    }
+    var zeroes = 0;
+    var length2 = 0;
+    while (source[psz] === LEADER) {
+      zeroes++;
+      psz++;
+    }
+    var size = (source.length - psz) * FACTOR + 1 >>> 0;
+    var b256 = new Uint8Array(size);
+    while (source[psz]) {
+      var carry = BASE_MAP[source.charCodeAt(psz)];
+      if (carry === 255) {
+        return;
+      }
+      var i2 = 0;
+      for (var it3 = size - 1; (carry !== 0 || i2 < length2) && it3 !== -1; it3--, i2++) {
+        carry += BASE * b256[it3] >>> 0;
+        b256[it3] = carry % 256 >>> 0;
+        carry = carry / 256 >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length2 = i2;
+      psz++;
+    }
+    if (source[psz] === " ") {
+      return;
+    }
+    var it4 = size - length2;
+    while (it4 !== size && b256[it4] === 0) {
+      it4++;
+    }
+    var vch = new Uint8Array(zeroes + (size - it4));
+    var j2 = zeroes;
+    while (it4 !== size) {
+      vch[j2++] = b256[it4++];
+    }
+    return vch;
+  }
+  function decode7(string2) {
+    var buffer = decodeUnsafe(string2);
+    if (buffer) {
+      return buffer;
+    }
+    throw new Error(`Non-${name2} character`);
+  }
+  return {
+    encode: encode5,
+    decodeUnsafe,
+    decode: decode7
+  };
+}
+var src = base;
+var _brrp__multiformats_scope_baseX = src;
+var base_x_default = _brrp__multiformats_scope_baseX;
+
+// ../../node_modules/multiformats/dist/src/bases/base.js
+var Encoder = class {
+  constructor(name2, prefix, baseEncode) {
+    __publicField(this, "name");
+    __publicField(this, "prefix");
+    __publicField(this, "baseEncode");
+    this.name = name2;
+    this.prefix = prefix;
+    this.baseEncode = baseEncode;
+  }
+  encode(bytes) {
+    if (bytes instanceof Uint8Array) {
+      return `${this.prefix}${this.baseEncode(bytes)}`;
+    } else {
+      throw Error("Unknown type, must be binary type");
+    }
+  }
+};
+var Decoder = class {
+  constructor(name2, prefix, baseDecode) {
+    __publicField(this, "name");
+    __publicField(this, "prefix");
+    __publicField(this, "baseDecode");
+    __publicField(this, "prefixCodePoint");
+    this.name = name2;
+    this.prefix = prefix;
+    const prefixCodePoint = prefix.codePointAt(0);
+    if (prefixCodePoint === void 0) {
+      throw new Error("Invalid prefix character");
+    }
+    this.prefixCodePoint = prefixCodePoint;
+    this.baseDecode = baseDecode;
+  }
+  decode(text) {
+    if (typeof text === "string") {
+      if (text.codePointAt(0) !== this.prefixCodePoint) {
+        throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`);
+      }
+      return this.baseDecode(text.slice(this.prefix.length));
+    } else {
+      throw Error("Can only multibase decode strings");
+    }
+  }
+  or(decoder) {
+    return or(this, decoder);
+  }
+};
+var ComposedDecoder = class {
+  constructor(decoders2) {
+    __publicField(this, "decoders");
+    this.decoders = decoders2;
+  }
+  or(decoder) {
+    return or(this, decoder);
+  }
+  decode(input) {
+    const prefix = input[0];
+    const decoder = this.decoders[prefix];
+    if (decoder != null) {
+      return decoder.decode(input);
+    } else {
+      throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`);
+    }
+  }
+};
+function or(left, right) {
+  return new ComposedDecoder({
+    ...left.decoders ?? { [left.prefix]: left },
+    ...right.decoders ?? { [right.prefix]: right }
+  });
+}
+var Codec = class {
+  constructor(name2, prefix, baseEncode, baseDecode) {
+    __publicField(this, "name");
+    __publicField(this, "prefix");
+    __publicField(this, "baseEncode");
+    __publicField(this, "baseDecode");
+    __publicField(this, "encoder");
+    __publicField(this, "decoder");
+    this.name = name2;
+    this.prefix = prefix;
+    this.baseEncode = baseEncode;
+    this.baseDecode = baseDecode;
+    this.encoder = new Encoder(name2, prefix, baseEncode);
+    this.decoder = new Decoder(name2, prefix, baseDecode);
+  }
+  encode(input) {
+    return this.encoder.encode(input);
+  }
+  decode(input) {
+    return this.decoder.decode(input);
+  }
+};
+function from({ name: name2, prefix, encode: encode5, decode: decode7 }) {
+  return new Codec(name2, prefix, encode5, decode7);
+}
+function baseX({ name: name2, prefix, alphabet: alphabet2 }) {
+  const { encode: encode5, decode: decode7 } = base_x_default(alphabet2, name2);
+  return from({
+    prefix,
+    name: name2,
+    encode: encode5,
+    decode: (text) => coerce(decode7(text))
+  });
+}
+function decode(string2, alphabetIdx, bitsPerChar, name2) {
+  let end = string2.length;
+  while (string2[end - 1] === "=") {
+    --end;
+  }
+  const out = new Uint8Array(end * bitsPerChar / 8 | 0);
+  let bits = 0;
+  let buffer = 0;
+  let written = 0;
+  for (let i = 0; i < end; ++i) {
+    const value = alphabetIdx[string2[i]];
+    if (value === void 0) {
+      throw new SyntaxError(`Non-${name2} character`);
+    }
+    buffer = buffer << bitsPerChar | value;
+    bits += bitsPerChar;
+    if (bits >= 8) {
+      bits -= 8;
+      out[written++] = 255 & buffer >> bits;
+    }
+  }
+  if (bits >= bitsPerChar || (255 & buffer << 8 - bits) !== 0) {
+    throw new SyntaxError("Unexpected end of data");
+  }
+  return out;
+}
+function encode(data, alphabet2, bitsPerChar) {
+  const pad = alphabet2[alphabet2.length - 1] === "=";
+  const mask = (1 << bitsPerChar) - 1;
+  let out = "";
+  let bits = 0;
+  let buffer = 0;
+  for (let i = 0; i < data.length; ++i) {
+    buffer = buffer << 8 | data[i];
+    bits += 8;
+    while (bits > bitsPerChar) {
+      bits -= bitsPerChar;
+      out += alphabet2[mask & buffer >> bits];
+    }
+  }
+  if (bits !== 0) {
+    out += alphabet2[mask & buffer << bitsPerChar - bits];
+  }
+  if (pad) {
+    while ((out.length * bitsPerChar & 7) !== 0) {
+      out += "=";
+    }
+  }
+  return out;
+}
+function createAlphabetIdx(alphabet2) {
+  const alphabetIdx = {};
+  for (let i = 0; i < alphabet2.length; ++i) {
+    alphabetIdx[alphabet2[i]] = i;
+  }
+  return alphabetIdx;
+}
+function rfc4648({ name: name2, prefix, bitsPerChar, alphabet: alphabet2 }) {
+  const alphabetIdx = createAlphabetIdx(alphabet2);
+  return from({
+    prefix,
+    name: name2,
+    encode(input) {
+      return encode(input, alphabet2, bitsPerChar);
+    },
+    decode(input) {
+      return decode(input, alphabetIdx, bitsPerChar, name2);
+    }
+  });
+}
+
+// ../../node_modules/multiformats/dist/src/bases/base32.js
+var base32 = rfc4648({
+  prefix: "b",
+  name: "base32",
+  alphabet: "abcdefghijklmnopqrstuvwxyz234567",
+  bitsPerChar: 5
+});
+var base32upper = rfc4648({
+  prefix: "B",
+  name: "base32upper",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",
+  bitsPerChar: 5
+});
+var base32pad = rfc4648({
+  prefix: "c",
+  name: "base32pad",
+  alphabet: "abcdefghijklmnopqrstuvwxyz234567=",
+  bitsPerChar: 5
+});
+var base32padupper = rfc4648({
+  prefix: "C",
+  name: "base32padupper",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=",
+  bitsPerChar: 5
+});
+var base32hex = rfc4648({
+  prefix: "v",
+  name: "base32hex",
+  alphabet: "0123456789abcdefghijklmnopqrstuv",
+  bitsPerChar: 5
+});
+var base32hexupper = rfc4648({
+  prefix: "V",
+  name: "base32hexupper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUV",
+  bitsPerChar: 5
+});
+var base32hexpad = rfc4648({
+  prefix: "t",
+  name: "base32hexpad",
+  alphabet: "0123456789abcdefghijklmnopqrstuv=",
+  bitsPerChar: 5
+});
+var base32hexpadupper = rfc4648({
+  prefix: "T",
+  name: "base32hexpadupper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUV=",
+  bitsPerChar: 5
+});
+var base32z = rfc4648({
+  prefix: "h",
+  name: "base32z",
+  alphabet: "ybndrfg8ejkmcpqxot1uwisza345h769",
+  bitsPerChar: 5
+});
+
+// ../../node_modules/multiformats/dist/src/bases/base36.js
+var base36_exports = {};
+__export(base36_exports, {
+  base36: () => base36,
+  base36upper: () => base36upper
+});
+var base36 = baseX({
+  prefix: "k",
+  name: "base36",
+  alphabet: "0123456789abcdefghijklmnopqrstuvwxyz"
+});
+var base36upper = baseX({
+  prefix: "K",
+  name: "base36upper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+});
+
+// ../../node_modules/multiformats/dist/src/bases/base58.js
+var base58_exports = {};
+__export(base58_exports, {
+  base58btc: () => base58btc,
+  base58flickr: () => base58flickr
+});
+var base58btc = baseX({
+  name: "base58btc",
+  prefix: "z",
+  alphabet: "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+});
+var base58flickr = baseX({
+  name: "base58flickr",
+  prefix: "Z",
+  alphabet: "123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ"
+});
+
+// ../../node_modules/multiformats/dist/src/vendor/varint.js
+var encode_1 = encode2;
+var MSB = 128;
+var REST = 127;
+var MSBALL = ~REST;
+var INT = Math.pow(2, 31);
+function encode2(num, out, offset) {
+  out = out || [];
+  offset = offset || 0;
+  var oldOffset = offset;
+  while (num >= INT) {
+    out[offset++] = num & 255 | MSB;
+    num /= 128;
+  }
+  while (num & MSBALL) {
+    out[offset++] = num & 255 | MSB;
+    num >>>= 7;
+  }
+  out[offset] = num | 0;
+  encode2.bytes = offset - oldOffset + 1;
+  return out;
+}
+var decode2 = read;
+var MSB$1 = 128;
+var REST$1 = 127;
+function read(buf, offset) {
+  var res = 0, offset = offset || 0, shift = 0, counter = offset, b, l = buf.length;
+  do {
+    if (counter >= l) {
+      read.bytes = 0;
+      throw new RangeError("Could not decode varint");
+    }
+    b = buf[counter++];
+    res += shift < 28 ? (b & REST$1) << shift : (b & REST$1) * Math.pow(2, shift);
+    shift += 7;
+  } while (b >= MSB$1);
+  read.bytes = counter - offset;
+  return res;
+}
+var N1 = Math.pow(2, 7);
+var N2 = Math.pow(2, 14);
+var N3 = Math.pow(2, 21);
+var N4 = Math.pow(2, 28);
+var N5 = Math.pow(2, 35);
+var N6 = Math.pow(2, 42);
+var N7 = Math.pow(2, 49);
+var N8 = Math.pow(2, 56);
+var N9 = Math.pow(2, 63);
+var length = function(value) {
+  return value < N1 ? 1 : value < N2 ? 2 : value < N3 ? 3 : value < N4 ? 4 : value < N5 ? 5 : value < N6 ? 6 : value < N7 ? 7 : value < N8 ? 8 : value < N9 ? 9 : 10;
+};
+var varint = {
+  encode: encode_1,
+  decode: decode2,
+  encodingLength: length
+};
+var _brrp_varint = varint;
+var varint_default = _brrp_varint;
+
+// ../../node_modules/multiformats/dist/src/varint.js
+function decode3(data, offset = 0) {
+  const code2 = varint_default.decode(data, offset);
+  return [code2, varint_default.decode.bytes];
+}
+function encodeTo(int, target, offset = 0) {
+  varint_default.encode(int, target, offset);
+  return target;
+}
+function encodingLength(int) {
+  return varint_default.encodingLength(int);
+}
+
+// ../../node_modules/multiformats/dist/src/hashes/digest.js
+function create(code2, digest2) {
+  const size = digest2.byteLength;
+  const sizeOffset = encodingLength(code2);
+  const digestOffset = sizeOffset + encodingLength(size);
+  const bytes = new Uint8Array(digestOffset + size);
+  encodeTo(code2, bytes, 0);
+  encodeTo(size, bytes, sizeOffset);
+  bytes.set(digest2, digestOffset);
+  return new Digest(code2, size, digest2, bytes);
+}
+function decode4(multihash) {
+  const bytes = coerce(multihash);
+  const [code2, sizeOffset] = decode3(bytes);
+  const [size, digestOffset] = decode3(bytes.subarray(sizeOffset));
+  const digest2 = bytes.subarray(sizeOffset + digestOffset);
+  if (digest2.byteLength !== size) {
+    throw new Error("Incorrect length");
+  }
+  return new Digest(code2, size, digest2, bytes);
+}
+function equals2(a, b) {
+  if (a === b) {
+    return true;
+  } else {
+    const data = b;
+    return a.code === data.code && a.size === data.size && data.bytes instanceof Uint8Array && equals(a.bytes, data.bytes);
+  }
+}
+var Digest = class {
+  /**
+   * Creates a multihash digest.
+   */
+  constructor(code2, size, digest2, bytes) {
+    __publicField(this, "code");
+    __publicField(this, "size");
+    __publicField(this, "digest");
+    __publicField(this, "bytes");
+    this.code = code2;
+    this.size = size;
+    this.digest = digest2;
+    this.bytes = bytes;
+  }
+};
+
+// ../../node_modules/multiformats/dist/src/cid.js
+function format(link, base3) {
+  const { bytes, version } = link;
+  switch (version) {
+    case 0:
+      return toStringV0(bytes, baseCache(link), base3 ?? base58btc.encoder);
+    default:
+      return toStringV1(bytes, baseCache(link), base3 ?? base32.encoder);
+  }
+}
+var cache = /* @__PURE__ */ new WeakMap();
+function baseCache(cid) {
+  const baseCache2 = cache.get(cid);
+  if (baseCache2 == null) {
+    const baseCache3 = /* @__PURE__ */ new Map();
+    cache.set(cid, baseCache3);
+    return baseCache3;
+  }
+  return baseCache2;
+}
+var _a;
+var CID = class _CID {
+  /**
+   * @param version - Version of the CID
+   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
+   * @param multihash - (Multi)hash of the of the content.
+   */
+  constructor(version, code2, multihash, bytes) {
+    __publicField(this, "code");
+    __publicField(this, "version");
+    __publicField(this, "multihash");
+    __publicField(this, "bytes");
+    __publicField(this, "/");
+    __publicField(this, _a, "CID");
+    this.code = code2;
+    this.version = version;
+    this.multihash = multihash;
+    this.bytes = bytes;
+    this["/"] = bytes;
+  }
+  /**
+   * Signalling `cid.asCID === cid` has been replaced with `cid['/'] === cid.bytes`
+   * please either use `CID.asCID(cid)` or switch to new signalling mechanism
+   *
+   * @deprecated
+   */
+  get asCID() {
+    return this;
+  }
+  // ArrayBufferView
+  get byteOffset() {
+    return this.bytes.byteOffset;
+  }
+  // ArrayBufferView
+  get byteLength() {
+    return this.bytes.byteLength;
+  }
+  toV0() {
+    switch (this.version) {
+      case 0: {
+        return this;
+      }
+      case 1: {
+        const { code: code2, multihash } = this;
+        if (code2 !== DAG_PB_CODE) {
+          throw new Error("Cannot convert a non dag-pb CID to CIDv0");
+        }
+        if (multihash.code !== SHA_256_CODE) {
+          throw new Error("Cannot convert non sha2-256 multihash CID to CIDv0");
+        }
+        return _CID.createV0(multihash);
+      }
+      default: {
+        throw Error(`Can not convert CID version ${this.version} to version 0. This is a bug please report`);
+      }
+    }
+  }
+  toV1() {
+    switch (this.version) {
+      case 0: {
+        const { code: code2, digest: digest2 } = this.multihash;
+        const multihash = create(code2, digest2);
+        return _CID.createV1(this.code, multihash);
+      }
+      case 1: {
+        return this;
+      }
+      default: {
+        throw Error(`Can not convert CID version ${this.version} to version 1. This is a bug please report`);
+      }
+    }
+  }
+  equals(other) {
+    return _CID.equals(this, other);
+  }
+  static equals(self, other) {
+    const unknown = other;
+    return unknown != null && self.code === unknown.code && self.version === unknown.version && equals2(self.multihash, unknown.multihash);
+  }
+  toString(base3) {
+    return format(this, base3);
+  }
+  toJSON() {
+    return { "/": format(this) };
+  }
+  link() {
+    return this;
+  }
+  // Legacy
+  [(_a = Symbol.toStringTag, /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom"))]() {
+    return `CID(${this.toString()})`;
+  }
+  /**
+   * Takes any input `value` and returns a `CID` instance if it was
+   * a `CID` otherwise returns `null`. If `value` is instanceof `CID`
+   * it will return value back. If `value` is not instance of this CID
+   * class, but is compatible CID it will return new instance of this
+   * `CID` class. Otherwise returns null.
+   *
+   * This allows two different incompatible versions of CID library to
+   * co-exist and interop as long as binary interface is compatible.
+   */
+  static asCID(input) {
+    if (input == null) {
+      return null;
+    }
+    const value = input;
+    if (value instanceof _CID) {
+      return value;
+    } else if (value["/"] != null && value["/"] === value.bytes || value.asCID === value) {
+      const { version, code: code2, multihash, bytes } = value;
+      return new _CID(version, code2, multihash, bytes ?? encodeCID(version, code2, multihash.bytes));
+    } else if (value[cidSymbol] === true) {
+      const { version, multihash, code: code2 } = value;
+      const digest2 = decode4(multihash);
+      return _CID.create(version, code2, digest2);
+    } else {
+      return null;
+    }
+  }
+  /**
+   * @param version - Version of the CID
+   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
+   * @param digest - (Multi)hash of the of the content.
+   */
+  static create(version, code2, digest2) {
+    if (typeof code2 !== "number") {
+      throw new Error("String codecs are no longer supported");
+    }
+    if (!(digest2.bytes instanceof Uint8Array)) {
+      throw new Error("Invalid digest");
+    }
+    switch (version) {
+      case 0: {
+        if (code2 !== DAG_PB_CODE) {
+          throw new Error(`Version 0 CID must use dag-pb (code: ${DAG_PB_CODE}) block encoding`);
+        } else {
+          return new _CID(version, code2, digest2, digest2.bytes);
+        }
+      }
+      case 1: {
+        const bytes = encodeCID(version, code2, digest2.bytes);
+        return new _CID(version, code2, digest2, bytes);
+      }
+      default: {
+        throw new Error("Invalid version");
+      }
+    }
+  }
+  /**
+   * Simplified version of `create` for CIDv0.
+   */
+  static createV0(digest2) {
+    return _CID.create(0, DAG_PB_CODE, digest2);
+  }
+  /**
+   * Simplified version of `create` for CIDv1.
+   *
+   * @param code - Content encoding format code.
+   * @param digest - Multihash of the content.
+   */
+  static createV1(code2, digest2) {
+    return _CID.create(1, code2, digest2);
+  }
+  /**
+   * Decoded a CID from its binary representation. The byte array must contain
+   * only the CID with no additional bytes.
+   *
+   * An error will be thrown if the bytes provided do not contain a valid
+   * binary representation of a CID.
+   */
+  static decode(bytes) {
+    const [cid, remainder] = _CID.decodeFirst(bytes);
+    if (remainder.length !== 0) {
+      throw new Error("Incorrect length");
+    }
+    return cid;
+  }
+  /**
+   * Decoded a CID from its binary representation at the beginning of a byte
+   * array.
+   *
+   * Returns an array with the first element containing the CID and the second
+   * element containing the remainder of the original byte array. The remainder
+   * will be a zero-length byte array if the provided bytes only contained a
+   * binary CID representation.
+   */
+  static decodeFirst(bytes) {
+    const specs = _CID.inspectBytes(bytes);
+    const prefixSize = specs.size - specs.multihashSize;
+    const multihashBytes = coerce(bytes.subarray(prefixSize, prefixSize + specs.multihashSize));
+    if (multihashBytes.byteLength !== specs.multihashSize) {
+      throw new Error("Incorrect length");
+    }
+    const digestBytes = multihashBytes.subarray(specs.multihashSize - specs.digestSize);
+    const digest2 = new Digest(specs.multihashCode, specs.digestSize, digestBytes, multihashBytes);
+    const cid = specs.version === 0 ? _CID.createV0(digest2) : _CID.createV1(specs.codec, digest2);
+    return [cid, bytes.subarray(specs.size)];
+  }
+  /**
+   * Inspect the initial bytes of a CID to determine its properties.
+   *
+   * Involves decoding up to 4 varints. Typically this will require only 4 to 6
+   * bytes but for larger multicodec code values and larger multihash digest
+   * lengths these varints can be quite large. It is recommended that at least
+   * 10 bytes be made available in the `initialBytes` argument for a complete
+   * inspection.
+   */
+  static inspectBytes(initialBytes) {
+    let offset = 0;
+    const next = () => {
+      const [i, length2] = decode3(initialBytes.subarray(offset));
+      offset += length2;
+      return i;
+    };
+    let version = next();
+    let codec = DAG_PB_CODE;
+    if (version === 18) {
+      version = 0;
+      offset = 0;
+    } else {
+      codec = next();
+    }
+    if (version !== 0 && version !== 1) {
+      throw new RangeError(`Invalid CID version ${version}`);
+    }
+    const prefixSize = offset;
+    const multihashCode = next();
+    const digestSize = next();
+    const size = offset + digestSize;
+    const multihashSize = size - prefixSize;
+    return { version, codec, multihashCode, digestSize, multihashSize, size };
+  }
+  /**
+   * Takes cid in a string representation and creates an instance. If `base`
+   * decoder is not provided will use a default from the configuration. It will
+   * throw an error if encoding of the CID is not compatible with supplied (or
+   * a default decoder).
+   */
+  static parse(source, base3) {
+    const [prefix, bytes] = parseCIDtoBytes(source, base3);
+    const cid = _CID.decode(bytes);
+    if (cid.version === 0 && source[0] !== "Q") {
+      throw Error("Version 0 CID string must not include multibase prefix");
+    }
+    baseCache(cid).set(prefix, source);
+    return cid;
+  }
+};
+function parseCIDtoBytes(source, base3) {
+  switch (source[0]) {
+    // CIDv0 is parsed differently
+    case "Q": {
+      const decoder = base3 ?? base58btc;
+      return [
+        base58btc.prefix,
+        decoder.decode(`${base58btc.prefix}${source}`)
+      ];
+    }
+    case base58btc.prefix: {
+      const decoder = base3 ?? base58btc;
+      return [base58btc.prefix, decoder.decode(source)];
+    }
+    case base32.prefix: {
+      const decoder = base3 ?? base32;
+      return [base32.prefix, decoder.decode(source)];
+    }
+    case base36.prefix: {
+      const decoder = base3 ?? base36;
+      return [base36.prefix, decoder.decode(source)];
+    }
+    default: {
+      if (base3 == null) {
+        throw Error("To parse non base32, base36 or base58btc encoded CID multibase decoder must be provided");
+      }
+      return [source[0], base3.decode(source)];
+    }
+  }
+}
+function toStringV0(bytes, cache2, base3) {
+  const { prefix } = base3;
+  if (prefix !== base58btc.prefix) {
+    throw Error(`Cannot string encode V0 in ${base3.name} encoding`);
+  }
+  const cid = cache2.get(prefix);
+  if (cid == null) {
+    const cid2 = base3.encode(bytes).slice(1);
+    cache2.set(prefix, cid2);
+    return cid2;
+  } else {
+    return cid;
+  }
+}
+function toStringV1(bytes, cache2, base3) {
+  const { prefix } = base3;
+  const cid = cache2.get(prefix);
+  if (cid == null) {
+    const cid2 = base3.encode(bytes);
+    cache2.set(prefix, cid2);
+    return cid2;
+  } else {
+    return cid;
+  }
+}
+var DAG_PB_CODE = 112;
+var SHA_256_CODE = 18;
+function encodeCID(version, code2, multihash) {
+  const codeOffset = encodingLength(version);
+  const hashOffset = codeOffset + encodingLength(code2);
+  const bytes = new Uint8Array(hashOffset + multihash.byteLength);
+  encodeTo(version, bytes, 0);
+  encodeTo(code2, bytes, codeOffset);
+  bytes.set(multihash, hashOffset);
+  return bytes;
+}
+var cidSymbol = /* @__PURE__ */ Symbol.for("@ipld/js-cid/CID");
+
+// src/requester/index.ts
 var import_zod2 = require("zod");
 
 // src/policy/errors.ts
 var SignedObjectProfileError = class extends Error {
-  constructor(code, message) {
+  constructor(code2, message) {
     super(message);
     this.name = "SignedObjectProfileError";
-    this.code = code;
+    this.code = code2;
   }
 };
 var SignedObjectSchemaError = class extends SignedObjectProfileError {
@@ -630,35 +1548,33 @@ function assertNoSymbolKeys(input, path) {
     );
   }
 }
-function isArrayIndexKey(key, length) {
+function isArrayIndexKey(key, length2) {
   if (!/^(0|[1-9]\d*)$/.test(key)) {
     return false;
   }
   const index = Number(key);
-  return Number.isSafeInteger(index) && index >= 0 && index < length;
+  return Number.isSafeInteger(index) && index >= 0 && index < length2;
 }
 function serializeObject(value) {
-  const keys = Object.keys(value).sort(compareCodePoints);
+  const keys = Object.keys(value).sort(compareUtf16CodeUnits);
   const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);
   return `{${parts.join(",")}}`;
 }
-function compareCodePoints(a, b) {
-  const left = Array.from(a);
-  const right = Array.from(b);
-  const max = Math.min(left.length, right.length);
+function compareUtf16CodeUnits(a, b) {
+  const max = Math.min(a.length, b.length);
   for (let index = 0; index < max; index++) {
-    const leftPoint = left[index].codePointAt(0) ?? 0;
-    const rightPoint = right[index].codePointAt(0) ?? 0;
-    if (leftPoint !== rightPoint) {
-      return leftPoint - rightPoint;
+    const leftCodeUnit = a.charCodeAt(index);
+    const rightCodeUnit = b.charCodeAt(index);
+    if (leftCodeUnit !== rightCodeUnit) {
+      return leftCodeUnit - rightCodeUnit;
     }
   }
-  return left.length - right.length;
+  return a.length - b.length;
 }
 function assertUnicodeScalarString(value, path) {
   for (let index = 0; index < value.length; index++) {
-    const code = value.charCodeAt(index);
-    if (code >= 55296 && code <= 56319) {
+    const code2 = value.charCodeAt(index);
+    if (code2 >= 55296 && code2 <= 56319) {
       const next = value.charCodeAt(index + 1);
       if (Number.isNaN(next) || next < 56320 || next > 57343) {
         throw new SignedObjectCanonicalizationError(
@@ -668,7 +1584,7 @@ function assertUnicodeScalarString(value, path) {
       index++;
       continue;
     }
-    if (code >= 56320 && code <= 57343) {
+    if (code2 >= 56320 && code2 <= 57343) {
       throw new SignedObjectCanonicalizationError(
         `${path} contains a lone low surrogate`
       );
@@ -681,10 +1597,10 @@ var import_bootstrap = require("@tinycloud/bootstrap");
 var import_viem2 = require("viem");
 var textEncoder = new TextEncoder();
 var PolicyCapabilityError = class extends Error {
-  constructor(code, message) {
+  constructor(code2, message) {
     super(message);
     this.name = "PolicyCapabilityError";
-    this.code = code;
+    this.code = code2;
   }
 };
 var objectHasOwn2 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
@@ -735,7 +1651,7 @@ function policyCapabilityContains(authority, request) {
   }
   return caveatsContain(auth.caveats, req.caveats);
 }
-function normalizePolicyCapabilityWithOptions(input, options) {
+function normalizePolicyCapabilityWithOptions(input, options2) {
   const object = expectObject(input, "$");
   assertExactKeys(object, ["service", "space", "path", "actions", "caveats"], "$");
   const service = requiredString(object, "service", "$", "policy-capability-malformed-service");
@@ -748,26 +1664,26 @@ function normalizePolicyCapabilityWithOptions(input, options) {
   const space = requiredString(object, "space", "$", "policy-capability-malformed-space");
   validateConcreteSpace(space);
   const canonicalSpace = space.normalize("NFC");
-  if (options.requireCanonical && canonicalSpace !== space) {
+  if (options2.requireCanonical && canonicalSpace !== space) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-space",
       "$.space must already be canonical NFC"
     );
   }
   const rawPath = requiredString(object, "path", "$", "policy-capability-malformed-path");
-  validateRawPath(rawPath, options);
+  validateRawPath(rawPath, options2);
   const path = normalizePath(rawPath);
-  if (options.requireCanonical && path !== rawPath) {
+  if (options2.requireCanonical && path !== rawPath) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-path",
       "$.path must already be canonical"
     );
   }
-  validateRawPath(path, options);
+  validateRawPath(path, options2);
   const actions = normalizeActions(
     requiredArray(object, "actions", "$", "policy-capability-malformed-action"),
     service,
-    options
+    options2
   );
   const output = /* @__PURE__ */ Object.create(null);
   output.service = service;
@@ -810,23 +1726,23 @@ function assertExactKeys(object, allowed, path) {
     }
   }
 }
-function requiredValue(object, key, path, code) {
+function requiredValue(object, key, path, code2) {
   if (!hasOwn(object, key)) {
-    throw new PolicyCapabilityError(code, `${path}.${key} is required`);
+    throw new PolicyCapabilityError(code2, `${path}.${key} is required`);
   }
   return object[key];
 }
-function requiredString(object, key, path, code) {
-  const value = requiredValue(object, key, path, code);
+function requiredString(object, key, path, code2) {
+  const value = requiredValue(object, key, path, code2);
   if (typeof value !== "string" || value.length === 0) {
-    throw new PolicyCapabilityError(code, `${path}.${key} must be a non-empty string`);
+    throw new PolicyCapabilityError(code2, `${path}.${key} must be a non-empty string`);
   }
   return value;
 }
-function requiredArray(object, key, path, code) {
-  const value = requiredValue(object, key, path, code);
+function requiredArray(object, key, path, code2) {
+  const value = requiredValue(object, key, path, code2);
   if (!Array.isArray(value)) {
-    throw new PolicyCapabilityError(code, `${path}.${key} must be an array`);
+    throw new PolicyCapabilityError(code2, `${path}.${key} must be an array`);
   }
   return value;
 }
@@ -838,11 +1754,11 @@ function validateConcreteSpace(space) {
     );
   }
 }
-function validateRawPath(path, options) {
+function validateRawPath(path, options2) {
   if (path.length === 0) {
     throw new PolicyCapabilityError("policy-capability-malformed-path", "$.path is empty");
   }
-  if (!options.allowPrefixPaths && path.endsWith("/")) {
+  if (!options2.allowPrefixPaths && path.endsWith("/")) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-path",
       "$.path must be an exact concrete path, not a prefix"
@@ -854,7 +1770,7 @@ function validateRawPath(path, options) {
   const segments = path.split("/");
   for (let index = 0; index < segments.length; index++) {
     const segment = segments[index];
-    const isTrailingPrefixSegment = options.allowPrefixPaths && index === segments.length - 1 && segment.length === 0;
+    const isTrailingPrefixSegment = options2.allowPrefixPaths && index === segments.length - 1 && segment.length === 0;
     if (segment.length === 0 && !isTrailingPrefixSegment) {
       throw new PolicyCapabilityError("policy-capability-malformed-path", "$.path has an empty segment");
     }
@@ -881,7 +1797,7 @@ function decodeUnreserved(path) {
     return /^[A-Za-z0-9._~-]$/.test(char) ? char : encoded.toUpperCase();
   });
 }
-function normalizeActions(actions, service, options) {
+function normalizeActions(actions, service, options2) {
   const accepted = GRANTABLE_ACTIONS.get(service);
   if (accepted === void 0) {
     throw new PolicyCapabilityError(
@@ -915,7 +1831,7 @@ function normalizeActions(actions, service, options) {
     );
   }
   const normalizedActions = [...unique].sort();
-  if (options.requireCanonical && (rawActions.length !== normalizedActions.length || rawActions.some((action, index) => action !== normalizedActions[index]))) {
+  if (options2.requireCanonical && (rawActions.length !== normalizedActions.length || rawActions.some((action, index) => action !== normalizedActions[index]))) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-action",
       "$.actions must already be sorted, deduplicated canonical action URNs"
@@ -1057,50 +1973,291 @@ function hasOwn(object, key) {
 
 // src/policy/signed-object.ts
 var import_ed25519 = require("@noble/curves/ed25519");
-var import_basics = require("multiformats/basics");
-var import_viem3 = require("viem");
-var POLICY_SCHEMA = "xyz.tinycloud.policy/policy/v0";
-var POLICY_STATUS_SCHEMA = "xyz.tinycloud.policy/status/v0";
-var POLICY_ENGINE_RECORD_SCHEMA = "xyz.tinycloud.policy/engine-record/v0";
-var ED25519_JCS_SIGNATURE_SUITE = "eddsa-ed25519-sha256-jcs-v1";
-var EIP191_JCS_SIGNATURE_SUITE = "eip191-secp256k1-sha256-jcs-v1";
-var DESCRIPTORS = {
-  Policy: {
-    kind: "Policy",
-    schema: POLICY_SCHEMA,
-    idField: "policyId",
-    idPrefix: "pol_",
-    domain: POLICY_SCHEMA
-  },
-  PolicyStatus: {
-    kind: "PolicyStatus",
-    schema: POLICY_STATUS_SCHEMA,
-    idField: "statusId",
-    idPrefix: "polst_",
-    domain: POLICY_STATUS_SCHEMA
-  },
-  PolicyEngineRecord: {
-    kind: "PolicyEngineRecord",
-    schema: POLICY_ENGINE_RECORD_SCHEMA,
-    idField: "engineRecordId",
-    idPrefix: "peng_",
-    domain: POLICY_ENGINE_RECORD_SCHEMA
-  }
-};
-var textEncoder2 = new TextEncoder();
-var BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
-var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
-var objectHasOwn3 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
-  Object.prototype.hasOwnProperty
-);
-function canonicalizeSignedObjectUnsigned(input) {
-  return jcsCanonicalize(input);
-}
-function deriveSignedObjectMaterial(input) {
-  const descriptor = descriptorForUnsigned(input);
-  const unsigned = validateUnsignedForDescriptor(input, descriptor);
-  return materialForUnsigned(unsigned, descriptor);
-}
+
+// ../../node_modules/multiformats/dist/src/bases/base10.js
+var base10_exports = {};
+__export(base10_exports, {
+  base10: () => base10
+});
+var base10 = baseX({
+  prefix: "9",
+  name: "base10",
+  alphabet: "0123456789"
+});
+
+// ../../node_modules/multiformats/dist/src/bases/base16.js
+var base16_exports = {};
+__export(base16_exports, {
+  base16: () => base16,
+  base16upper: () => base16upper
+});
+var base16 = rfc4648({
+  prefix: "f",
+  name: "base16",
+  alphabet: "0123456789abcdef",
+  bitsPerChar: 4
+});
+var base16upper = rfc4648({
+  prefix: "F",
+  name: "base16upper",
+  alphabet: "0123456789ABCDEF",
+  bitsPerChar: 4
+});
+
+// ../../node_modules/multiformats/dist/src/bases/base2.js
+var base2_exports = {};
+__export(base2_exports, {
+  base2: () => base2
+});
+var base2 = rfc4648({
+  prefix: "0",
+  name: "base2",
+  alphabet: "01",
+  bitsPerChar: 1
+});
+
+// ../../node_modules/multiformats/dist/src/bases/base256emoji.js
+var base256emoji_exports = {};
+__export(base256emoji_exports, {
+  base256emoji: () => base256emoji
+});
+var alphabet = Array.from("\u{1F680}\u{1FA90}\u2604\u{1F6F0}\u{1F30C}\u{1F311}\u{1F312}\u{1F313}\u{1F314}\u{1F315}\u{1F316}\u{1F317}\u{1F318}\u{1F30D}\u{1F30F}\u{1F30E}\u{1F409}\u2600\u{1F4BB}\u{1F5A5}\u{1F4BE}\u{1F4BF}\u{1F602}\u2764\u{1F60D}\u{1F923}\u{1F60A}\u{1F64F}\u{1F495}\u{1F62D}\u{1F618}\u{1F44D}\u{1F605}\u{1F44F}\u{1F601}\u{1F525}\u{1F970}\u{1F494}\u{1F496}\u{1F499}\u{1F622}\u{1F914}\u{1F606}\u{1F644}\u{1F4AA}\u{1F609}\u263A\u{1F44C}\u{1F917}\u{1F49C}\u{1F614}\u{1F60E}\u{1F607}\u{1F339}\u{1F926}\u{1F389}\u{1F49E}\u270C\u2728\u{1F937}\u{1F631}\u{1F60C}\u{1F338}\u{1F64C}\u{1F60B}\u{1F497}\u{1F49A}\u{1F60F}\u{1F49B}\u{1F642}\u{1F493}\u{1F929}\u{1F604}\u{1F600}\u{1F5A4}\u{1F603}\u{1F4AF}\u{1F648}\u{1F447}\u{1F3B6}\u{1F612}\u{1F92D}\u2763\u{1F61C}\u{1F48B}\u{1F440}\u{1F62A}\u{1F611}\u{1F4A5}\u{1F64B}\u{1F61E}\u{1F629}\u{1F621}\u{1F92A}\u{1F44A}\u{1F973}\u{1F625}\u{1F924}\u{1F449}\u{1F483}\u{1F633}\u270B\u{1F61A}\u{1F61D}\u{1F634}\u{1F31F}\u{1F62C}\u{1F643}\u{1F340}\u{1F337}\u{1F63B}\u{1F613}\u2B50\u2705\u{1F97A}\u{1F308}\u{1F608}\u{1F918}\u{1F4A6}\u2714\u{1F623}\u{1F3C3}\u{1F490}\u2639\u{1F38A}\u{1F498}\u{1F620}\u261D\u{1F615}\u{1F33A}\u{1F382}\u{1F33B}\u{1F610}\u{1F595}\u{1F49D}\u{1F64A}\u{1F639}\u{1F5E3}\u{1F4AB}\u{1F480}\u{1F451}\u{1F3B5}\u{1F91E}\u{1F61B}\u{1F534}\u{1F624}\u{1F33C}\u{1F62B}\u26BD\u{1F919}\u2615\u{1F3C6}\u{1F92B}\u{1F448}\u{1F62E}\u{1F646}\u{1F37B}\u{1F343}\u{1F436}\u{1F481}\u{1F632}\u{1F33F}\u{1F9E1}\u{1F381}\u26A1\u{1F31E}\u{1F388}\u274C\u270A\u{1F44B}\u{1F630}\u{1F928}\u{1F636}\u{1F91D}\u{1F6B6}\u{1F4B0}\u{1F353}\u{1F4A2}\u{1F91F}\u{1F641}\u{1F6A8}\u{1F4A8}\u{1F92C}\u2708\u{1F380}\u{1F37A}\u{1F913}\u{1F619}\u{1F49F}\u{1F331}\u{1F616}\u{1F476}\u{1F974}\u25B6\u27A1\u2753\u{1F48E}\u{1F4B8}\u2B07\u{1F628}\u{1F31A}\u{1F98B}\u{1F637}\u{1F57A}\u26A0\u{1F645}\u{1F61F}\u{1F635}\u{1F44E}\u{1F932}\u{1F920}\u{1F927}\u{1F4CC}\u{1F535}\u{1F485}\u{1F9D0}\u{1F43E}\u{1F352}\u{1F617}\u{1F911}\u{1F30A}\u{1F92F}\u{1F437}\u260E\u{1F4A7}\u{1F62F}\u{1F486}\u{1F446}\u{1F3A4}\u{1F647}\u{1F351}\u2744\u{1F334}\u{1F4A3}\u{1F438}\u{1F48C}\u{1F4CD}\u{1F940}\u{1F922}\u{1F445}\u{1F4A1}\u{1F4A9}\u{1F450}\u{1F4F8}\u{1F47B}\u{1F910}\u{1F92E}\u{1F3BC}\u{1F975}\u{1F6A9}\u{1F34E}\u{1F34A}\u{1F47C}\u{1F48D}\u{1F4E3}\u{1F942}");
+var alphabetBytesToChars = alphabet.reduce((p, c, i) => {
+  p[i] = c;
+  return p;
+}, []);
+var alphabetCharsToBytes = alphabet.reduce((p, c, i) => {
+  const codePoint = c.codePointAt(0);
+  if (codePoint == null) {
+    throw new Error(`Invalid character: ${c}`);
+  }
+  p[codePoint] = i;
+  return p;
+}, []);
+function encode3(data) {
+  return data.reduce((p, c) => {
+    p += alphabetBytesToChars[c];
+    return p;
+  }, "");
+}
+function decode5(str) {
+  const byts = [];
+  for (const char of str) {
+    const codePoint = char.codePointAt(0);
+    if (codePoint == null) {
+      throw new Error(`Invalid character: ${char}`);
+    }
+    const byt = alphabetCharsToBytes[codePoint];
+    if (byt == null) {
+      throw new Error(`Non-base256emoji character: ${char}`);
+    }
+    byts.push(byt);
+  }
+  return new Uint8Array(byts);
+}
+var base256emoji = from({
+  prefix: "\u{1F680}",
+  name: "base256emoji",
+  encode: encode3,
+  decode: decode5
+});
+
+// ../../node_modules/multiformats/dist/src/bases/base64.js
+var base64_exports = {};
+__export(base64_exports, {
+  base64: () => base64,
+  base64pad: () => base64pad,
+  base64url: () => base64url,
+  base64urlpad: () => base64urlpad
+});
+var base64 = rfc4648({
+  prefix: "m",
+  name: "base64",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
+  bitsPerChar: 6
+});
+var base64pad = rfc4648({
+  prefix: "M",
+  name: "base64pad",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
+  bitsPerChar: 6
+});
+var base64url = rfc4648({
+  prefix: "u",
+  name: "base64url",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_",
+  bitsPerChar: 6
+});
+var base64urlpad = rfc4648({
+  prefix: "U",
+  name: "base64urlpad",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_=",
+  bitsPerChar: 6
+});
+
+// ../../node_modules/multiformats/dist/src/bases/base8.js
+var base8_exports = {};
+__export(base8_exports, {
+  base8: () => base8
+});
+var base8 = rfc4648({
+  prefix: "7",
+  name: "base8",
+  alphabet: "01234567",
+  bitsPerChar: 3
+});
+
+// ../../node_modules/multiformats/dist/src/bases/identity.js
+var identity_exports = {};
+__export(identity_exports, {
+  identity: () => identity
+});
+var identity = from({
+  prefix: "\0",
+  name: "identity",
+  encode: (buf) => toString(buf),
+  decode: (str) => fromString(str)
+});
+
+// ../../node_modules/multiformats/dist/src/codecs/json.js
+var textEncoder2 = new TextEncoder();
+var textDecoder = new TextDecoder();
+
+// ../../node_modules/multiformats/dist/src/hashes/identity.js
+var identity_exports2 = {};
+__export(identity_exports2, {
+  identity: () => identity2
+});
+var code = 0;
+var name = "identity";
+var encode4 = coerce;
+function digest(input, options2) {
+  if (options2?.truncate != null && options2.truncate !== input.byteLength) {
+    if (options2.truncate < 0 || options2.truncate > input.byteLength) {
+      throw new Error(`Invalid truncate option, must be less than or equal to ${input.byteLength}`);
+    }
+    input = input.subarray(0, options2.truncate);
+  }
+  return create(code, encode4(input));
+}
+var identity2 = { code, name, encode: encode4, digest };
+
+// ../../node_modules/multiformats/dist/src/hashes/sha2.js
+var sha2_exports = {};
+__export(sha2_exports, {
+  sha256: () => sha2562,
+  sha512: () => sha512
+});
+var import_crypto = __toESM(require("crypto"), 1);
+
+// ../../node_modules/multiformats/dist/src/hashes/hasher.js
+var DEFAULT_MIN_DIGEST_LENGTH = 20;
+function from2({ name: name2, code: code2, encode: encode5, minDigestLength, maxDigestLength }) {
+  return new Hasher(name2, code2, encode5, minDigestLength, maxDigestLength);
+}
+var Hasher = class {
+  constructor(name2, code2, encode5, minDigestLength, maxDigestLength) {
+    __publicField(this, "name");
+    __publicField(this, "code");
+    __publicField(this, "encode");
+    __publicField(this, "minDigestLength");
+    __publicField(this, "maxDigestLength");
+    this.name = name2;
+    this.code = code2;
+    this.encode = encode5;
+    this.minDigestLength = minDigestLength ?? DEFAULT_MIN_DIGEST_LENGTH;
+    this.maxDigestLength = maxDigestLength;
+  }
+  digest(input, options2) {
+    if (options2?.truncate != null) {
+      if (options2.truncate < this.minDigestLength) {
+        throw new Error(`Invalid truncate option, must be greater than or equal to ${this.minDigestLength}`);
+      }
+      if (this.maxDigestLength != null && options2.truncate > this.maxDigestLength) {
+        throw new Error(`Invalid truncate option, must be less than or equal to ${this.maxDigestLength}`);
+      }
+    }
+    if (input instanceof Uint8Array) {
+      const result = this.encode(input);
+      if (result instanceof Uint8Array) {
+        return createDigest(result, this.code, options2?.truncate);
+      }
+      return result.then((digest2) => createDigest(digest2, this.code, options2?.truncate));
+    } else {
+      throw Error("Unknown type, must be binary type");
+    }
+  }
+};
+function createDigest(digest2, code2, truncate) {
+  if (truncate != null && truncate !== digest2.byteLength) {
+    if (truncate > digest2.byteLength) {
+      throw new Error(`Invalid truncate option, must be less than or equal to ${digest2.byteLength}`);
+    }
+    digest2 = digest2.subarray(0, truncate);
+  }
+  return create(code2, digest2);
+}
+
+// ../../node_modules/multiformats/dist/src/hashes/sha2.js
+var sha2562 = from2({
+  name: "sha2-256",
+  code: 18,
+  encode: (input) => coerce(import_crypto.default.createHash("sha256").update(input).digest())
+});
+var sha512 = from2({
+  name: "sha2-512",
+  code: 19,
+  encode: (input) => coerce(import_crypto.default.createHash("sha512").update(input).digest())
+});
+
+// ../../node_modules/multiformats/dist/src/basics.js
+var bases = { ...identity_exports, ...base2_exports, ...base8_exports, ...base10_exports, ...base16_exports, ...base32_exports, ...base36_exports, ...base58_exports, ...base64_exports, ...base256emoji_exports };
+var hashes = { ...sha2_exports, ...identity_exports2 };
+
+// src/policy/signed-object.ts
+var import_viem3 = require("viem");
+var POLICY_SCHEMA = "xyz.tinycloud.policy/policy/v0";
+var POLICY_STATUS_SCHEMA = "xyz.tinycloud.policy/status/v0";
+var POLICY_ENGINE_RECORD_SCHEMA = "xyz.tinycloud.policy/engine-record/v0";
+var ED25519_JCS_SIGNATURE_SUITE = "eddsa-ed25519-sha256-jcs-v1";
+var EIP191_JCS_SIGNATURE_SUITE = "eip191-secp256k1-sha256-jcs-v1";
+var DESCRIPTORS = {
+  Policy: {
+    kind: "Policy",
+    schema: POLICY_SCHEMA,
+    idField: "policyId",
+    idPrefix: "pol_",
+    domain: POLICY_SCHEMA
+  },
+  PolicyStatus: {
+    kind: "PolicyStatus",
+    schema: POLICY_STATUS_SCHEMA,
+    idField: "statusId",
+    idPrefix: "polst_",
+    domain: POLICY_STATUS_SCHEMA
+  },
+  PolicyEngineRecord: {
+    kind: "PolicyEngineRecord",
+    schema: POLICY_ENGINE_RECORD_SCHEMA,
+    idField: "engineRecordId",
+    idPrefix: "peng_",
+    domain: POLICY_ENGINE_RECORD_SCHEMA
+  }
+};
+var textEncoder3 = new TextEncoder();
+var BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+var objectHasOwn3 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
+  Object.prototype.hasOwnProperty
+);
+function canonicalizeSignedObjectUnsigned(input) {
+  return jcsCanonicalize(input);
+}
+function deriveSignedObjectMaterial(input) {
+  const descriptor = descriptorForUnsigned(input);
+  const unsigned = validateUnsignedForDescriptor(input, descriptor);
+  return materialForUnsigned(unsigned, descriptor);
+}
 function signedObjectIdFor(input) {
   return deriveSignedObjectMaterial(input).id;
 }
@@ -1536,9 +2693,9 @@ function validateAudit(input, path) {
 }
 function materialForUnsigned(unsigned, descriptor) {
   const jcs = jcsCanonicalize(unsigned);
-  const jcsBytes = textEncoder2.encode(jcs);
-  const digest = sha256Bytes(concatBytes(textEncoder2.encode(`${descriptor.domain}\0`), jcsBytes));
-  const id = `${descriptor.idPrefix}${base32LowerNoPad(digest)}`;
+  const jcsBytes = textEncoder3.encode(jcs);
+  const digest2 = sha256Bytes(concatBytes(textEncoder3.encode(`${descriptor.domain}\0`), jcsBytes));
+  const id = `${descriptor.idPrefix}${base32LowerNoPad(digest2)}`;
   return {
     kind: descriptor.kind,
     idField: descriptor.idField,
@@ -1547,8 +2704,8 @@ function materialForUnsigned(unsigned, descriptor) {
     unsigned,
     jcs,
     jcsBytes,
-    digest,
-    digestHex: (0, import_viem3.bytesToHex)(digest).slice(2)
+    digest: digest2,
+    digestHex: (0, import_viem3.bytesToHex)(digest2).slice(2)
   };
 }
 function assertIdMatches(signed, material, descriptor) {
@@ -1596,12 +2753,12 @@ function assertSignerDidMatchesSuite(signerDid, suite) {
   }
   throw new UnsupportedSignatureSuiteError(`unsupported signature suite: ${suite}`);
 }
-async function verifySignature(signature, digest) {
+async function verifySignature(signature, digest2) {
   if (signature.suite === ED25519_JCS_SIGNATURE_SUITE) {
     const publicKey = ed25519PublicKeyFromDidKey(signature.signerDid);
     const signatureBytes = decodeSignatureValue(signature.value, signature.suite);
     try {
-      return import_ed25519.ed25519.verify(signatureBytes, digest, publicKey);
+      return import_ed25519.ed25519.verify(signatureBytes, digest2, publicKey);
     } catch {
       throw new SignatureVerificationError("Ed25519 signature verification failed");
     }
@@ -1612,7 +2769,7 @@ async function verifySignature(signature, digest) {
     try {
       return (0, import_viem3.verifyMessage)({
         address: pkh.address,
-        message: { raw: digest },
+        message: { raw: digest2 },
         signature: (0, import_viem3.bytesToHex)(signatureBytes)
       });
     } catch {
@@ -1631,7 +2788,7 @@ function ed25519PublicKeyFromDidKey(did) {
   }
   let bytes;
   try {
-    bytes = import_basics.bases.base58btc.decode(identifier);
+    bytes = bases.base58btc.decode(identifier);
   } catch {
     throw new SignatureMaterialError("did:key signerDid is undecodable");
   }
@@ -1844,20 +3001,20 @@ function base32LowerNoPad(bytes) {
   return output;
 }
 function base64UrlEncode(bytes) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+  const alphabet2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
   for (let index = 0; index < bytes.length; index += 3) {
     const a = bytes[index];
     const b = bytes[index + 1];
     const c = bytes[index + 2];
     const triplet = a << 16 | (b ?? 0) << 8 | (c ?? 0);
-    output += alphabet[triplet >> 18 & 63];
-    output += alphabet[triplet >> 12 & 63];
+    output += alphabet2[triplet >> 18 & 63];
+    output += alphabet2[triplet >> 12 & 63];
     if (index + 1 < bytes.length) {
-      output += alphabet[triplet >> 6 & 63];
+      output += alphabet2[triplet >> 6 & 63];
     }
     if (index + 2 < bytes.length) {
-      output += alphabet[triplet & 63];
+      output += alphabet2[triplet & 63];
     }
   }
   return output;
@@ -1866,12 +3023,12 @@ function base64UrlDecode(value) {
   if (value.length % 4 === 1) {
     throw new SignatureMaterialError("signature value is not canonical base64url");
   }
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+  const alphabet2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   const bytes = [];
   let buffer = 0;
   let bits = 0;
   for (const char of value) {
-    const index = alphabet.indexOf(char);
+    const index = alphabet2.indexOf(char);
     if (index < 0) {
       throw new SignatureMaterialError("signature value is not base64url");
     }
@@ -1906,14 +3063,14 @@ var OWNER_NODE_ENDPOINT_SCHEMA = "xyz.tinycloud.exchange/owner-node-endpoint/v1"
 var POLICY_VERSION_V0 = "v0";
 var W3C_VC_CREDENTIAL_VERIFIER = "w3c.vc/credential/v1";
 var PolicyAuthoringError = class extends Error {
-  constructor(code, message) {
+  constructor(code2, message) {
     super(message);
     this.name = "PolicyAuthoringError";
-    this.code = code;
+    this.code = code2;
   }
 };
-async function verifyPolicyEngineRecordForRequester(options) {
-  const normalized = expectObject2(options, "$", "policy-authoring-malformed");
+async function verifyPolicyEngineRecordForRequester(options2) {
+  const normalized = expectObject2(options2, "$", "policy-authoring-malformed");
   assertExactKeys3(
     normalized,
     [
@@ -2020,11 +3177,11 @@ async function verifyPolicyEngineRecordForRequester(options) {
   }
   return verified;
 }
-function expectObject2(input, path, code) {
+function expectObject2(input, path, code2) {
   try {
     const normalized = normalizeJson(input);
     if (normalized === null || typeof normalized !== "object" || Array.isArray(normalized)) {
-      throw new PolicyAuthoringError(code, `${path} must be an object`);
+      throw new PolicyAuthoringError(code2, `${path} must be an object`);
     }
     return normalized;
   } catch (error) {
@@ -2032,7 +3189,7 @@ function expectObject2(input, path, code) {
       throw error;
     }
     throw new PolicyAuthoringError(
-      code,
+      code2,
       error instanceof Error ? error.message : String(error)
     );
   }
@@ -2067,14 +3224,14 @@ function requiredString3(object, key, path) {
   }
   return value;
 }
-function fieldString(object, key, path, code) {
+function fieldString(object, key, path, code2) {
   if (!hasOwn3(object, key)) {
-    throw new PolicyAuthoringError(code, `${path}.${key} is required`);
+    throw new PolicyAuthoringError(code2, `${path}.${key} is required`);
   }
   const value = object[key];
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
-      code,
+      code2,
       `${path}.${key} must be a non-empty string`
     );
   }
@@ -2180,10 +3337,10 @@ var POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES = [
   "rate-limited"
 ];
 var TranscriptRequesterError = class extends Error {
-  constructor(code, message, state = "invalid", denialCode, status) {
+  constructor(code2, message, state = "invalid", denialCode, status) {
     super(message);
     this.name = "TranscriptRequesterError";
-    this.code = code;
+    this.code = code2;
     this.state = state;
     this.denialCode = denialCode;
     this.status = status;
@@ -2321,50 +3478,50 @@ var LISTEN_SQL_STATEMENT_BY_NAME = new Map(
   ])
 );
 var TranscriptRequester = class _TranscriptRequester {
-  constructor(bootstrap, requestedCapabilities, nativeAuthorityCeiling, requestedCapabilitiesHash2, policyEngineRecordExpiresAtMs, policyEngineAddresses, ownerNodeAddresses, options) {
+  constructor(bootstrap, requestedCapabilities, nativeAuthorityCeiling, requestedCapabilitiesHash2, policyEngineRecordExpiresAtMs, policyEngineAddresses, ownerNodeAddresses, options2) {
     this.usedChallengeNonces = /* @__PURE__ */ new Set();
     this.accessEnded = false;
     this.bootstrap = bootstrap;
     this.requestedCapabilities = requestedCapabilities;
     this.nativeAuthorityCeiling = nativeAuthorityCeiling;
     this.requestedCapabilitiesHash = requestedCapabilitiesHash2;
-    this.requesterDid = options.requesterDid;
-    this.ownerDid = options.ownerDid;
-    this.audience = options.audience;
-    this.grantIssuerDid = options.grantIssuerDid;
-    this.transport = options.transport;
-    this.signingCapability = options.signingCapability;
-    this.invocationCapability = options.invocationCapability;
+    this.requesterDid = options2.requesterDid;
+    this.ownerDid = options2.ownerDid;
+    this.audience = options2.audience;
+    this.grantIssuerDid = options2.grantIssuerDid;
+    this.transport = options2.transport;
+    this.signingCapability = options2.signingCapability;
+    this.invocationCapability = options2.invocationCapability;
     this.policyEngineRecordExpiresAtMs = policyEngineRecordExpiresAtMs;
     this.policyEngineAddresses = policyEngineAddresses;
     this.ownerNodeAddresses = ownerNodeAddresses;
-    this.eligibleSubjectDid = options.eligibleSubjectDid ?? options.signingCapability?.eligibleSubjectDid ?? options.requesterDid;
-    this.holderBinding = options.holderBinding ?? options.signingCapability?.holderBinding ?? {
+    this.eligibleSubjectDid = options2.eligibleSubjectDid ?? options2.signingCapability?.eligibleSubjectDid ?? options2.requesterDid;
+    this.holderBinding = options2.holderBinding ?? options2.signingCapability?.holderBinding ?? {
       type: "enrolled-agent",
       enrollment: {
         schema: "xyz.tinycloud.policy/holder-enrollment/v0",
-        holderDid: options.requesterDid
+        holderDid: options2.requesterDid
       }
     };
-    this.evidence = options.evidence ?? options.signingCapability?.evidence;
+    this.evidence = options2.evidence ?? options2.signingCapability?.evidence;
     this.presentationTtlSeconds = Math.min(
-      Math.max(options.presentationTtlSeconds ?? 60, 1),
+      Math.max(options2.presentationTtlSeconds ?? 60, 1),
       300
     );
-    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-    this.sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
-    this.random = options.random ?? Math.random;
-    this.engineRetryAttempts = options.engineRetryAttempts ?? REQUESTER_ENGINE_RETRY_ATTEMPTS;
-  }
-  static async create(options) {
-    const bootstrap = parseBootstrap(options.bootstrap);
-    if (bootstrap.ownerNode.endpoint !== options.trustedOwnerNode.endpoint || bootstrap.ownerNode.spaceId !== options.trustedOwnerNode.spaceId) {
+    this.now = options2.now ?? (() => /* @__PURE__ */ new Date());
+    this.sleep = options2.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    this.random = options2.random ?? Math.random;
+    this.engineRetryAttempts = options2.engineRetryAttempts ?? REQUESTER_ENGINE_RETRY_ATTEMPTS;
+  }
+  static async create(options2) {
+    const bootstrap = parseBootstrap(options2.bootstrap);
+    if (bootstrap.ownerNode.endpoint !== options2.trustedOwnerNode.endpoint || bootstrap.ownerNode.spaceId !== options2.trustedOwnerNode.spaceId) {
       throw endpointError(
         "owner-node",
         "bootstrap owner-node binding does not match trusted discovery/config"
       );
     }
-    const record = await verifyRecordBeforeEgress(bootstrap, options);
+    const record = await verifyRecordBeforeEgress(bootstrap, options2);
     if (record.endpoint !== bootstrap.policyEngine.endpoint) {
       throw new TranscriptRequesterError(
         "requester-engine-record-endpoint-mismatch",
@@ -2381,12 +3538,12 @@ var TranscriptRequester = class _TranscriptRequester {
     }
     const policyEngineAddresses = await validateAndResolvePublicEndpoint(
       bootstrap.policyEngine.endpoint,
-      options.transport,
+      options2.transport,
       "policy-engine"
     );
     const ownerNodeAddresses = await validateAndResolveOwnerNode(
       bootstrap.ownerNode.endpoint,
-      options.transport
+      options2.transport
     );
     const requestedCapabilities = bootstrap.resourceHint.requestedCapabilities.map(
       (capability, index) => parsePolicyCapability(
@@ -2406,7 +3563,7 @@ var TranscriptRequester = class _TranscriptRequester {
       parseStrictRfc33392(record.expiresAt),
       policyEngineAddresses,
       ownerNodeAddresses,
-      options
+      options2
     );
   }
   get accessState() {
@@ -2930,8 +4087,8 @@ var TranscriptRequester = class _TranscriptRequester {
     }
   }
 };
-async function createTranscriptRequester(options) {
-  return TranscriptRequester.create(options);
+async function createTranscriptRequester(options2) {
+  return TranscriptRequester.create(options2);
 }
 function parseBootstrap(input) {
   const normalized = normalizeExternal(input, "requester-bootstrap-malformed");
@@ -2945,35 +4102,35 @@ function parseBootstrap(input) {
   }
   return parsed.data;
 }
-async function verifyRecordBeforeEgress(bootstrap, options) {
+async function verifyRecordBeforeEgress(bootstrap, options2) {
   try {
     return await verifyPolicyEngineRecordForRequester({
       signedRecord: bootstrap.policyEngine.signedRecord,
-      ownerDid: options.ownerDid,
-      audience: options.audience,
-      grantIssuerDid: options.grantIssuerDid,
-      now: (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString().replace(".000Z", "Z"),
+      ownerDid: options2.ownerDid,
+      audience: options2.audience,
+      grantIssuerDid: options2.grantIssuerDid,
+      now: (options2.now ?? (() => /* @__PURE__ */ new Date()))().toISOString().replace(".000Z", "Z"),
       requiredPolicyVersion: POLICY_VERSION_V0,
       requiredEvidenceVerifier: W3C_VC_CREDENTIAL_VERIFIER
     });
   } catch (error) {
-    const code = errorCodeForRecordFailure(error);
+    const code2 = errorCodeForRecordFailure(error);
     throw new TranscriptRequesterError(
-      code,
+      code2,
       error instanceof Error ? error.message : String(error),
       "bootstrap-invalid"
     );
   }
 }
 function errorCodeForRecordFailure(error) {
-  const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
-  if (code === "policy-engine-record-signature-invalid") {
+  const code2 = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+  if (code2 === "policy-engine-record-signature-invalid") {
     return "requester-engine-record-signature-invalid";
   }
-  if (code === "policy-engine-record-owner-mismatch") {
+  if (code2 === "policy-engine-record-owner-mismatch") {
     return "requester-engine-record-owner-mismatch";
   }
-  if (code === "policy-engine-record-audience-mismatch") {
+  if (code2 === "policy-engine-record-audience-mismatch") {
     return "requester-engine-record-audience-mismatch";
   }
   return "requester-engine-record-invalid";
@@ -3273,16 +4430,16 @@ function nodeErrorMessage(body) {
   if (typeof body === "string") return body;
   if (body !== null && typeof body === "object") {
     const record = body;
-    const code = typeof record.code === "string" ? record.code : void 0;
+    const code2 = typeof record.code === "string" ? record.code : void 0;
     const message = typeof record.message === "string" ? record.message : void 0;
-    if (code !== void 0)
-      return message === void 0 ? code : `${code}: ${message}`;
+    if (code2 !== void 0)
+      return message === void 0 ? code2 : `${code2}: ${message}`;
   }
   return "native node refusal";
 }
 function deriveDelegationCid(encoded) {
-  const digest = (0, import_digest.create)(30, (0, import_blake3.blake3)(new TextEncoder().encode(encoded)));
-  return import_cid.CID.createV1(85, digest).toString();
+  const digest2 = create(30, (0, import_blake3.blake3)(new TextEncoder().encode(encoded)));
+  return CID.createV1(85, digest2).toString();
 }
 function headersRecord(headers) {
   return Array.isArray(headers) ? Object.fromEntries(headers) : headers;
@@ -3393,21 +4550,21 @@ function errorForDenial(denial, status) {
   );
 }
 function retryDelay(attempt, random) {
-  const base = Math.min(REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, 50 * 2 ** attempt);
+  const base3 = Math.min(REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, 50 * 2 ** attempt);
   return Math.min(
     REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,
-    Math.floor(base * (0.5 + random))
+    Math.floor(base3 * (0.5 + random))
   );
 }
 function trimTrailingSlash(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
 }
-function normalizeExternal(input, code) {
+function normalizeExternal(input, code2) {
   try {
     return normalizeJson(input);
   } catch (error) {
     throw new TranscriptRequesterError(
-      code,
+      code2,
       error instanceof Error ? error.message : String(error)
     );
   }
@@ -3700,6 +4857,8 @@ var DelegationSchema = import_zod4.z.object({
   path: import_zod4.z.string(),
   /** Actions this delegation authorizes */
   actions: import_zod4.z.array(import_zod4.z.string()),
+  /** Exact ReCap caveats that constrain every action in this scope. */
+  caveats: import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown())).optional(),
   /** When this delegation expires (accepts Date or ISO string from JSON) */
   expiry: import_zod4.z.coerce.date(),
   /** Whether this delegation has been revoked */
@@ -3731,6 +4890,43 @@ var DelegationStatusSchema = import_zod4.z.object({
     });
   }
 });
+var DelegationRevocationReceiptSchema = import_zod4.z.object({
+  revoked: import_zod4.z.literal(true),
+  cid: import_zod4.z.string().min(1)
+}).strict();
+var AccountDelegationResourceSchema = import_zod4.z.object({
+  resource: import_zod4.z.string().min(1),
+  actions: import_zod4.z.array(import_zod4.z.string()),
+  caveats: import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))
+}).strict();
+var AccountDelegationDateSchema = import_zod4.z.string().datetime({ offset: true }).transform((value) => new Date(value));
+var AccountDelegationRecordSchema = import_zod4.z.object({
+  cid: import_zod4.z.string().min(1),
+  direction: import_zod4.z.enum(["granted", "received"]),
+  delegatorDid: import_zod4.z.string().min(1),
+  delegateDid: import_zod4.z.string().min(1),
+  resources: import_zod4.z.array(AccountDelegationResourceSchema),
+  parents: import_zod4.z.array(import_zod4.z.string()),
+  issuedAt: AccountDelegationDateSchema.nullable(),
+  notBefore: AccountDelegationDateSchema.nullable(),
+  expiresAt: AccountDelegationDateSchema.nullable(),
+  status: import_zod4.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]),
+  revokedAt: AccountDelegationDateSchema.nullable().optional(),
+  revokedBy: import_zod4.z.string().optional(),
+  revokedAncestorCid: import_zod4.z.string().optional()
+}).strict();
+var AccountDelegationPageSchema = import_zod4.z.object({
+  schemaVersion: import_zod4.z.literal(2),
+  items: import_zod4.z.array(AccountDelegationRecordSchema),
+  nextCursor: import_zod4.z.string().optional()
+}).strict();
+var AccountDelegationQueryOptionsSchema = import_zod4.z.object({
+  direction: import_zod4.z.enum(["granted", "received", "all"]).optional(),
+  status: import_zod4.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]).optional(),
+  space: import_zod4.z.string().trim().min(1).optional(),
+  limit: import_zod4.z.number().int().min(1).max(100).optional(),
+  cursor: import_zod4.z.string().min(1).optional()
+}).strict();
 var CapabilityEntrySchema = import_zod4.z.object({
   /** Resource URI this capability applies to */
   resource: import_zod4.z.string(),
@@ -3885,6 +5081,8 @@ var GenerateShareParamsSchema = import_zod4.z.object({
 var DelegationManagerConfigSchema = import_zod4.z.object({
   /** TinyCloud host URLs */
   hosts: import_zod4.z.array(import_zod4.z.string()),
+  /** Account space used by account-wide delegation history queries */
+  accountSpaceId: import_zod4.z.string().min(1).optional(),
   /** Active session for authentication */
   session: import_zod4.z.unknown().refine(
     (val) => val !== null && typeof val === "object",
@@ -3941,7 +5139,9 @@ var DelegatedResourceSchema = import_zod4.z.object({
   /** Resource path; empty string when the resource URI had no path segment. */
   path: import_zod4.z.string(),
   /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
-  actions: import_zod4.z.array(import_zod4.z.string())
+  actions: import_zod4.z.array(import_zod4.z.string()),
+  /** Exact ReCap caveats that constrain every action in this scope. */
+  caveats: import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown())).optional()
 });
 var CreateDelegationWasmParamsSchema = import_zod4.z.object({
   /** The session containing delegation credentials */
@@ -4216,13 +5416,13 @@ function parseSpaceUri(uri) {
     /^tinycloud:pkh:eip155:(\d+):(0x[a-fA-F0-9]{40}):(.+)$/
   );
   if (fullUriMatch) {
-    const [, chainId, address, name] = fullUriMatch;
+    const [, chainId, address, name2] = fullUriMatch;
     try {
       const chainIdNumber = Number(chainId);
       const canonicalAddress = canonicalizeAddress(address);
       return {
         owner: pkhDid(canonicalAddress, chainIdNumber),
-        name,
+        name: name2,
         chainId: String(chainIdNumber),
         address: canonicalAddress
       };
@@ -4239,12 +5439,12 @@ function parseSpaceUri(uri) {
   }
   return null;
 }
-function buildSpaceUri(owner, name) {
+function buildSpaceUri(owner, name2) {
   const pkh = parsePkhDid(owner);
   if (pkh) {
-    return makePkhSpaceId(pkh.address, pkh.chainId, name);
+    return makePkhSpaceId(pkh.address, pkh.chainId, name2);
   }
-  return `tinycloud:${owner}:${name}`;
+  return `tinycloud:${owner}:${name2}`;
 }
 function transformServerDelegations(validatedData, defaultSpaceId) {
   const result = [];
@@ -4509,13 +5709,13 @@ var SpaceService = class {
    *
    * @param name - The name for the new space
    */
-  async create(name) {
+  async create(name2) {
     if (!this.session) {
       return (0, import_sdk_services2.err)(
         (0, import_sdk_services2.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
-    if (!name || !/^[a-zA-Z0-9_-]+$/.test(name)) {
+    if (!name2 || !/^[a-zA-Z0-9_-]+$/.test(name2)) {
       return (0, import_sdk_services2.err)(
         (0, import_sdk_services2.serviceError)(
           SpaceErrorCodes.INVALID_NAME,
@@ -4525,11 +5725,11 @@ var SpaceService = class {
       );
     }
     try {
-      const headers = this.invoke(this.session, "space", name, "tinycloud.space/create");
+      const headers = this.invoke(this.session, "space", name2, "tinycloud.space/create");
       const response = await this.fetchFn(`${this.host}/invoke`, {
         method: "POST",
         headers,
-        body: JSON.stringify({ name })
+        body: JSON.stringify({ name: name2 })
       });
       if (!response.ok) {
         const errorText = await response.text();
@@ -4537,7 +5737,7 @@ var SpaceService = class {
           return (0, import_sdk_services2.err)(
             (0, import_sdk_services2.serviceError)(
               SpaceErrorCodes.ALREADY_EXISTS,
-              `Space "${name}" already exists`,
+              `Space "${name2}" already exists`,
               SERVICE_NAME
             )
           );
@@ -4565,7 +5765,7 @@ var SpaceService = class {
       }
       const spaceInfo = {
         id: validationResult.data.id,
-        name: validationResult.data.name || name,
+        name: validationResult.data.name || name2,
         owner: validationResult.data.owner || this.userDid || "",
         type: "owned",
         permissions: ["*"]
@@ -4604,10 +5804,10 @@ var SpaceService = class {
       return cached;
     }
     const parsed = parseSpaceUri(spaceId);
-    const name = parsed?.name ?? this.extractNameFromId(spaceId);
+    const name2 = parsed?.name ?? this.extractNameFromId(spaceId);
     const config = {
       id: spaceId,
-      name,
+      name: name2,
       createKV: this.createSpaceScopedKV.bind(this),
       createVault: this.createSpaceScopedVault.bind(this),
       createSecrets: this.createSpaceScopedSecrets.bind(this),
@@ -5051,12 +6251,12 @@ var TinyCloud = class _TinyCloud {
       hooks: import_sdk_services3.HooksService,
       ...this.config.services
     };
-    for (const [name, ServiceClass] of Object.entries(serviceConstructors)) {
-      const serviceConfig = this.config.serviceConfigs?.[name] ?? {};
+    for (const [name2, ServiceClass] of Object.entries(serviceConstructors)) {
+      const serviceConfig = this.config.serviceConfigs?.[name2] ?? {};
       const service = new ServiceClass(serviceConfig);
       service.initialize(this._serviceContext);
-      this._serviceContext.registerService(name, service);
-      this._services.set(name, service);
+      this._serviceContext.registerService(name2, service);
+      this._services.set(name2, service);
     }
     this._servicesInitialized = true;
   }
@@ -5072,14 +6272,23 @@ var TinyCloud = class _TinyCloud {
     }
     return this._serviceContext;
   }
+  /** @internal Retire this service graph after its owner replaces a session. */
+  retireServices() {
+    try {
+      this._serviceContext?.retire();
+    } finally {
+      this._services.clear();
+      this._servicesInitialized = false;
+    }
+  }
   /**
    * Get a registered service by name.
    *
    * @param name - Service name (e.g., 'kv')
    * @returns The service instance or undefined
    */
-  getService(name) {
-    return this._services.get(name);
+  getService(name2) {
+    return this._services.get(name2);
   }
   /**
    * Get the KV service.
@@ -5247,8 +6456,8 @@ var TinyCloud = class _TinyCloud {
    * @param options - Optional per-call SIWE overrides for this sign-in only
    * @returns The new session
    */
-  async signIn(options) {
-    const session = await this.userAuthorization.signIn(options);
+  async signIn(options2) {
+    const session = await this.userAuthorization.signIn(options2);
     const serviceSession = this.toServiceSession(session);
     this.notifyServicesOfSessionChange(serviceSession);
     return session;
@@ -5787,32 +6996,32 @@ function validateManifestSecrets(secrets) {
   if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
     throw new ManifestValidationError("manifest.secrets must be an object");
   }
-  for (const [name, spec] of Object.entries(secrets)) {
-    if (!import_sdk_services4.SECRET_NAME_RE.test(name)) {
+  for (const [name2, spec] of Object.entries(secrets)) {
+    if (!import_sdk_services4.SECRET_NAME_RE.test(name2)) {
       throw new ManifestValidationError(
-        `manifest.secrets.${name} must match ${import_sdk_services4.SECRET_NAME_RE.source}`
+        `manifest.secrets.${name2} must match ${import_sdk_services4.SECRET_NAME_RE.source}`
       );
     }
     try {
       (0, import_sdk_services4.resolveSecretPath)(
-        secretNameFromSpec(name, spec),
+        secretNameFromSpec(name2, spec),
         { scope: secretScopeFromSpec(spec) }
       );
     } catch (error) {
       throw new ManifestValidationError(
-        `manifest.secrets.${name}: ${error instanceof Error ? error.message : String(error)}`
+        `manifest.secrets.${name2}: ${error instanceof Error ? error.message : String(error)}`
       );
     }
-    const actions = secretActionsFromSpec(name, spec);
+    const actions = secretActionsFromSpec(name2, spec);
     if (actions.length === 0) {
       throw new ManifestValidationError(
-        `manifest.secrets.${name} actions must be non-empty`
+        `manifest.secrets.${name2} actions must be non-empty`
       );
     }
     for (const action of actions) {
       if (typeof action !== "string" || action.length === 0) {
         throw new ManifestValidationError(
-          `manifest.secrets.${name} actions must be non-empty strings`
+          `manifest.secrets.${name2} actions must be non-empty strings`
         );
       }
     }
@@ -5854,6 +7063,11 @@ function validatePermissionEntry(p, path) {
       vaultActionExpansion(action);
     }
   }
+  if (entry.caveats !== void 0 && (!Array.isArray(entry.caveats) || entry.caveats.some(
+    (caveat) => caveat === null || typeof caveat !== "object" || Array.isArray(caveat)
+  ))) {
+    throw new ManifestValidationError(`${path}.caveats must be an array of objects`);
+  }
   if (entry.expiry !== void 0) {
     parseExpiry(entry.expiry);
   }
@@ -5971,7 +7185,7 @@ function secretScopeFromSpec(spec) {
   }
   return void 0;
 }
-function secretActionsFromSpec(name, spec) {
+function secretActionsFromSpec(name2, spec) {
   if (spec === true) {
     return ["read"];
   }
@@ -5983,7 +7197,7 @@ function secretActionsFromSpec(name, spec) {
   }
   if (spec === null || typeof spec !== "object") {
     throw new ManifestValidationError(
-      `manifest.secrets.${name} must be true, a string action, an actions array, or an object`
+      `manifest.secrets.${name2} must be true, a string action, an actions array, or an object`
     );
   }
   if (spec.actions === void 0) {
@@ -5996,7 +7210,7 @@ function secretActionsFromSpec(name, spec) {
     return spec.actions;
   }
   throw new ManifestValidationError(
-    `manifest.secrets.${name}.actions must be a string or array`
+    `manifest.secrets.${name2}.actions must be a string or array`
   );
 }
 function secretEntriesForManifest(secrets) {
@@ -6004,10 +7218,10 @@ function secretEntriesForManifest(secrets) {
     return [];
   }
   const entries = [];
-  for (const [name, spec] of Object.entries(secrets)) {
-    const actions = secretActionsFromSpec(name, spec);
+  for (const [name2, spec] of Object.entries(secrets)) {
+    const actions = secretActionsFromSpec(name2, spec);
     const secretPath = (0, import_sdk_services4.resolveSecretPath)(
-      secretNameFromSpec(name, spec),
+      secretNameFromSpec(name2, spec),
       { scope: secretScopeFromSpec(spec) }
     );
     const extra = spec !== true && typeof spec === "object" && !Array.isArray(spec) ? spec : {};
@@ -6048,18 +7262,18 @@ function expandVaultPermissionEntry(entry) {
   const byBase = /* @__PURE__ */ new Map();
   for (const action of entry.actions) {
     const expansion = vaultActionExpansion(action);
-    for (const base of expansion.bases) {
-      const actions = byBase.get(base) ?? [];
+    for (const base3 of expansion.bases) {
+      const actions = byBase.get(base3) ?? [];
       if (!actions.includes(expansion.action)) {
         actions.push(expansion.action);
       }
-      byBase.set(base, actions);
+      byBase.set(base3, actions);
     }
   }
-  return [...byBase.entries()].map(([base, actions]) => ({
+  return [...byBase.entries()].map(([base3, actions]) => ({
     ...entry,
     service: "tinycloud.kv",
-    path: vaultKVPath(base, entry.path),
+    path: vaultKVPath(base3, entry.path),
     actions,
     skipPrefix: true
   }));
@@ -6102,9 +7316,9 @@ function normalizeVaultAction(action) {
   }
   return action;
 }
-function vaultKVPath(base, path) {
+function vaultKVPath(base3, path) {
   const normalized = path.startsWith("/") ? path.slice(1) : path;
-  return `${base}/${normalized}`;
+  return `${base3}/${normalized}`;
 }
 function cloneResourceCapability(entry) {
   return {
@@ -6122,6 +7336,7 @@ function clonePermissionEntry(entry) {
     ...entry.space !== void 0 ? { space: entry.space } : {},
     path: entry.path,
     actions: [...entry.actions],
+    ...entry.caveats !== void 0 ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) } : {},
     ...entry.skipPrefix !== void 0 ? { skipPrefix: entry.skipPrefix } : {},
     ...entry.expiry !== void 0 ? { expiry: entry.expiry } : {},
     ...entry.description !== void 0 ? { description: entry.description } : {}
@@ -6170,12 +7385,20 @@ function withCapabilitiesReadForSpaces(resources) {
   ]);
 }
 function accountRegistryPermissions() {
-  return [ACCOUNT_REGISTRY_PATH, "spaces/"].map((path) => ({
-    service: "tinycloud.kv",
-    space: ACCOUNT_REGISTRY_SPACE,
-    path,
-    actions: ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/list"]
-  }));
+  return [
+    ...[ACCOUNT_REGISTRY_PATH, "spaces/"].map((path) => ({
+      service: "tinycloud.kv",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path,
+      actions: ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/list"]
+    })),
+    {
+      service: "tinycloud.delegation",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: "",
+      actions: ["tinycloud.delegation/list"]
+    }
+  ];
 }
 function accountRegistryIndexPermission() {
   return {
@@ -6185,13 +7408,13 @@ function accountRegistryIndexPermission() {
     actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema"]
   };
 }
-function composeManifestRequest(inputs, options = {}) {
+function composeManifestRequest(inputs, options2 = {}) {
   if (!Array.isArray(inputs) || inputs.length === 0) {
     throw new ManifestValidationError(
       "composeManifestRequest requires at least one manifest"
     );
   }
-  const includeAccountRegistryPermissions = options.includeAccountRegistryPermissions ?? true;
+  const includeAccountRegistryPermissions = options2.includeAccountRegistryPermissions ?? true;
   const manifests = inputs.map(validateManifest);
   const resolved = manifests.map(resolveManifest);
   const resources = resolved.flatMap((entry) => entry.resources);
@@ -6296,13 +7519,13 @@ var AccountService = class {
   constructor(config) {
     this.config = config;
     this.applications = {
-      list: async (options = {}) => {
-        if (options.preferIndex) {
+      list: async (options2 = {}) => {
+        if (options2.preferIndex) {
           const indexed = await this.index.applications.list();
           if (indexed.ok && indexed.data.length > 0) return indexed;
           if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
           const canonical = await this.applications.list();
-          if (canonical.ok && options.refreshIndex !== false) {
+          if (canonical.ok && options2.refreshIndex !== false) {
             await this.replaceApplicationsIndexQuietly(canonical.data);
           }
           return canonical;
@@ -6379,13 +7602,13 @@ var AccountService = class {
       }
     };
     this.spaces = {
-      list: async (options = {}) => {
-        if (options.preferIndex) {
+      list: async (options2 = {}) => {
+        if (options2.preferIndex) {
           const indexed = await this.index.spaces.list();
           if (indexed.ok && indexed.data.length > 0) return indexed;
           if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
           const canonical = await this.spaces.syncAccessible();
-          if (canonical.ok && options.refreshIndex !== false) {
+          if (canonical.ok && options2.refreshIndex !== false) {
             await this.replaceSpacesIndexQuietly(canonical.data);
           }
           return canonical;
@@ -6442,32 +7665,44 @@ var AccountService = class {
       }
     };
     this.delegations = {
-      list: async (options = {}) => {
-        if (options.preferIndex) {
-          const indexed = await this.index.delegations.list(options);
+      query: async (options2 = {}) => {
+        const manager = this.config.getDelegationManager?.();
+        if (!manager) {
+          return (0, import_sdk_services5.err)((0, import_sdk_services5.serviceError)(
+            "NOT_INITIALIZED",
+            "Delegation history requires an authenticated delegation manager",
+            SERVICE_NAME2
+          ));
+        }
+        const queried = await manager.query(options2);
+        return queried.ok ? (0, import_sdk_services5.ok)(queried.data) : accountErr(queried.error);
+      },
+      list: async (options2 = {}) => {
+        if (options2.preferIndex) {
+          const indexed = await this.index.delegations.list(options2);
           if (indexed.ok && indexed.data.length > 0) return indexed;
           if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
           const live = await this.delegations.list({
-            direction: options.direction,
-            space: options.space
+            direction: options2.direction,
+            space: options2.space
           });
-          if (live.ok && options.refreshIndex !== false) {
+          if (live.ok && options2.refreshIndex !== false) {
             await this.replaceDelegationsIndexQuietly(live.data);
           }
           return live;
         }
         const spaces = await this.config.getSpaces().list();
         if (!spaces.ok) return accountErr(spaces.error);
-        const targetSpaces = options.space ? spaces.data.filter((space) => space.id === options.space || space.name === options.space) : spaces.data;
+        const targetSpaces = options2.space ? spaces.data.filter((space) => space.id === options2.space || space.name === options2.space) : spaces.data;
         const delegations = [];
         for (const space of targetSpaces) {
           const scoped = this.config.getSpaces().get(space.id).delegations;
-          if (options.direction !== "received") {
+          if (options2.direction !== "received") {
             const granted = await scoped.list();
             if (!granted.ok) return accountErr(granted.error);
             delegations.push(...granted.data.map((d) => mapDelegation(d, space, "granted")));
           }
-          if (options.direction !== "granted") {
+          if (options2.direction !== "granted") {
             const received = await scoped.listReceived();
             if (!received.ok) return accountErr(received.error);
             delegations.push(...received.data.map((d) => mapDelegation(d, space, "received")));
@@ -6476,10 +7711,23 @@ var AccountService = class {
         delegations.sort((a, b) => a.spaceId.localeCompare(b.spaceId) || a.cid.localeCompare(b.cid));
         return (0, import_sdk_services5.ok)(delegations);
       },
-      revoke: async (options) => {
-        const space = await this.resolveSpace(options.space);
+      revoke: async (input) => {
+        const cid = typeof input === "string" ? input : input.cid;
+        const manager = this.config.getDelegationManager?.();
+        if (manager) {
+          const revoked2 = await manager.revoke(cid);
+          return revoked2.ok ? (0, import_sdk_services5.ok)(revoked2.data) : accountErr(revoked2.error);
+        }
+        if (typeof input === "string") {
+          return (0, import_sdk_services5.err)((0, import_sdk_services5.serviceError)(
+            "NOT_INITIALIZED",
+            "CID-only revocation requires an authenticated delegation manager",
+            SERVICE_NAME2
+          ));
+        }
+        const space = await this.resolveSpace(input.space);
         if (!space.ok) return space;
-        const revoked = await this.config.getSpaces().get(space.data.id).delegations.revoke(options.cid);
+        const revoked = await this.config.getSpaces().get(space.data.id).delegations.revoke(cid);
         if (!revoked.ok) return accountErr(revoked.error);
         return (0, import_sdk_services5.ok)(void 0);
       }
@@ -6602,18 +7850,18 @@ var AccountService = class {
         }
       },
       delegations: {
-        list: async (options = {}) => {
+        list: async (options2 = {}) => {
           const dbResult = this.accountDb();
           if (!dbResult.ok) return dbResult;
           const where = [];
           const params = [];
-          if (options.direction && options.direction !== "all") {
+          if (options2.direction && options2.direction !== "all") {
             where.push("direction = ?");
-            params.push(options.direction);
+            params.push(options2.direction);
           }
-          if (options.space) {
+          if (options2.space) {
             where.push("(space_id = ? OR space_name = ?)");
-            params.push(options.space, options.space);
+            params.push(options2.space, options2.space);
           }
           const queried = await dbResult.data.query(
             `SELECT cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at FROM delegations${where.length > 0 ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY space_id, cid`,
@@ -6934,10 +8182,10 @@ function applicationFromRecord(key, record) {
   };
 }
 function indexedApplicationFromRow(row) {
-  const [appId, name, description, updatedAt, manifestJson, manifestHash] = row;
+  const [appId, name2, description, updatedAt, manifestJson, manifestHash] = row;
   return {
     appId,
-    name: name ?? void 0,
+    name: name2 ?? void 0,
     description: description ?? void 0,
     updatedAt: updatedAt ?? void 0,
     manifests: JSON.parse(manifestJson),
@@ -6988,10 +8236,10 @@ function spaceFromRecord(key, record) {
   };
 }
 function indexedSpaceFromRow(row) {
-  const [spaceId, name, ownerDid, type, permissionsJson, status, registeredAt, updatedAt, expiresAt] = row;
+  const [spaceId, name2, ownerDid, type, permissionsJson, status, registeredAt, updatedAt, expiresAt] = row;
   return {
     spaceId,
-    name,
+    name: name2,
     ownerDid,
     type,
     permissions: JSON.parse(permissionsJson),
@@ -7159,9 +8407,9 @@ var DelegationAction = {
   GET: "tinycloud.delegation/get",
   CHECK: "tinycloud.delegation/check"
 };
-function createError(code, message, cause, meta) {
+function createError(code2, message, cause, meta) {
   return {
-    code,
+    code: code2,
     message,
     service: "delegation",
     cause,
@@ -7180,6 +8428,7 @@ var DelegationManager = class {
     this.invoke = config.invoke;
     this.invokeAny = config.invokeAny;
     this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
+    this.accountSpaceId = config.accountSpaceId;
   }
   /**
    * Updates the session (e.g., after re-authentication).
@@ -7385,7 +8634,19 @@ var DelegationManager = class {
           )
         };
       }
-      return { ok: true, data: void 0 };
+      const parsed = DelegationRevocationReceiptSchema.safeParse(await response.json());
+      if (!parsed.success || parsed.data.cid !== cid) {
+        return {
+          ok: false,
+          error: createError(
+            DelegationErrorCodes.REVOCATION_FAILED,
+            "Node returned an invalid delegation revocation receipt",
+            void 0,
+            { cid }
+          )
+        };
+      }
+      return { ok: true, data: parsed.data };
     } catch (error) {
       if (error instanceof Error && error.name === "AbortError") {
         return {
@@ -7482,6 +8743,86 @@ var DelegationManager = class {
       };
     }
   }
+  /** Query lifecycle-complete delegation history for the authenticated account. */
+  async query(options2 = {}) {
+    const validated = AccountDelegationQueryOptionsSchema.safeParse(options2);
+    if (!validated.success) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.INVALID_INPUT,
+          "Invalid delegation query options",
+          void 0,
+          { issues: validated.error.issues }
+        )
+      };
+    }
+    if (!this.invokeAny) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.NOT_INITIALIZED,
+          "Delegation query requires an invokeAny function"
+        )
+      };
+    }
+    if (!this.accountSpaceId) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.NOT_INITIALIZED,
+          "Delegation query requires an account space"
+        )
+      };
+    }
+    try {
+      const invocationHeaders = this.invokeAny(this.session, [{
+        spaceId: this.accountSpaceId,
+        service: "delegation",
+        path: "",
+        action: DelegationAction.LIST
+      }]);
+      const headers = Object.fromEntries(new Headers(invocationHeaders).entries());
+      headers["content-type"] = "application/json";
+      const response = await this.fetchFn(`${this.host}/delegation/query`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(validated.data)
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        return {
+          ok: false,
+          error: createError(
+            DelegationErrorCodes.NETWORK_ERROR,
+            `Failed to query delegations: ${response.status} - ${errorText}`,
+            void 0,
+            { status: response.status }
+          )
+        };
+      }
+      const parsed = AccountDelegationPageSchema.safeParse(await response.json());
+      if (!parsed.success) {
+        return {
+          ok: false,
+          error: createError(
+            DelegationErrorCodes.INVALID_TOKEN,
+            "Node returned an invalid delegation query response"
+          )
+        };
+      }
+      return { ok: true, data: parsed.data };
+    } catch (error) {
+      return {
+        ok: false,
+        error: createError(
+          DelegationErrorCodes.NETWORK_ERROR,
+          `Network error during delegation query: ${String(error)}`,
+          error instanceof Error ? error : void 0
+        )
+      };
+    }
+  }
   /**
    * Lists all delegations for the current session's space.
    *
@@ -7877,6 +9218,17 @@ var SessionExpiredError = class extends Error {
     this.expiredAt = expiredAt;
   }
 };
+var CaveatedDelegationUnsupportedError = class extends Error {
+  constructor(entries) {
+    super(
+      "Cannot create a caveated delegation because this WASM delegation boundary cannot preserve every ReCap caveat branch exactly."
+    );
+    /** Stable machine-readable error code for fail-closed caveated delegation. */
+    this.code = "CAVEATED_DELEGATION_UNSUPPORTED";
+    this.name = "CaveatedDelegationUnsupportedError";
+    this.entries = entries.map(cloneEntry);
+  }
+};
 function normalizeSpace(space) {
   if (!space.startsWith("tinycloud:")) {
     return space;
@@ -7917,8 +9269,42 @@ function canonicalizeEntryMatches(requested, granted) {
       return false;
     }
   }
+  if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
+    return false;
+  }
   return true;
 }
+function recapCaveatsEqual(left, right) {
+  return canonicalizeRecapCaveats(left) === canonicalizeRecapCaveats(right);
+}
+function canonicalizeRecapCaveats(caveats) {
+  const canonicalize = (value) => {
+    if (value === null || typeof value === "boolean" || typeof value === "string") {
+      return JSON.stringify(value);
+    }
+    if (typeof value === "number") {
+      if (Number.isFinite(value)) return JSON.stringify(value);
+      throw new Error("ReCap caveats must contain only JSON values.");
+    }
+    if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
+    if (typeof value === "object") {
+      const object = value;
+      const prototype = Object.getPrototypeOf(object);
+      if (prototype !== Object.prototype && prototype !== null) {
+        throw new Error("ReCap caveats must contain only JSON values.");
+      }
+      return `{${Object.keys(object).sort().map(
+        (key) => `${JSON.stringify(key)}:${canonicalize(object[key])}`
+      ).join(",")}}`;
+    }
+    throw new Error("ReCap caveats must contain only JSON values.");
+  };
+  const branches = (caveats ?? []).map(canonicalize).sort();
+  if (branches.length === 0 || branches.length === 1 && branches[0] === "{}") {
+    return "[]";
+  }
+  return `[${branches.join(",")}]`;
+}
 function actionContains(grantedAction, requestedAction) {
   if (grantedAction === "*" || grantedAction === requestedAction) return true;
   if (!grantedAction.endsWith("/*")) return false;
@@ -7940,6 +9326,7 @@ function cloneEntry(entry) {
     ...entry.space !== void 0 ? { space: entry.space } : {},
     path: entry.path,
     actions: [...entry.actions],
+    ...entry.caveats !== void 0 ? { caveats: JSON.parse(JSON.stringify(entry.caveats)) } : {},
     ...entry.skipPrefix !== void 0 ? { skipPrefix: entry.skipPrefix } : {},
     ...entry.expiry !== void 0 ? { expiry: entry.expiry } : {}
   };
@@ -7963,7 +9350,8 @@ function parseRecapCapabilities(parseWasm, siwe) {
       // returned entries match the shape manifests use.
       space: normalizeSpace(entry.space),
       path: entry.path,
-      actions: [...entry.actions]
+      actions: [...entry.actions],
+      ...entry.caveats === void 0 ? {} : { caveats: JSON.parse(JSON.stringify(entry.caveats)) }
     };
   });
   normalized.sort((a, b) => {
@@ -7978,7 +9366,6 @@ function parseRecapCapabilities(parseWasm, siwe) {
 }
 
 // src/delegations/SharingService.ts
-var import_basics2 = require("multiformats/basics");
 var import_ed255192 = require("@noble/curves/ed25519");
 function inferShortServiceFromActionUrns(actions) {
   let short;
@@ -7999,9 +9386,9 @@ function inferShortServiceFromActionUrns(actions) {
 var DEFAULT_READ_ACTIONS = ["tinycloud.kv/get", "tinycloud.kv/metadata"];
 var DEFAULT_EXPIRY_MS = EXPIRY.SHARE_MS;
 var BASE64_PREFIX = "tc1:";
-function createError2(code, message, cause, meta) {
+function createError2(code2, message, cause, meta) {
   return {
-    code,
+    code: code2,
     message,
     service: "delegation",
     cause,
@@ -8009,25 +9396,25 @@ function createError2(code, message, cause, meta) {
   };
 }
 function base64UrlEncode2(data) {
-  let base64;
+  let base642;
   if (typeof btoa !== "undefined") {
-    base64 = btoa(unescape(encodeURIComponent(data)));
+    base642 = btoa(unescape(encodeURIComponent(data)));
   } else if (typeof Buffer !== "undefined") {
-    base64 = Buffer.from(data, "utf-8").toString("base64");
+    base642 = Buffer.from(data, "utf-8").toString("base64");
   } else {
     throw new Error("No base64 encoding available");
   }
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return base642.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function base64UrlDecode2(encoded) {
-  let base64 = encoded.replace(/-/g, "+").replace(/_/g, "/");
-  while (base64.length % 4) {
-    base64 += "=";
+  let base642 = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  while (base642.length % 4) {
+    base642 += "=";
   }
   if (typeof atob !== "undefined") {
-    return decodeURIComponent(escape(atob(base64)));
+    return decodeURIComponent(escape(atob(base642)));
   } else if (typeof Buffer !== "undefined") {
-    return Buffer.from(base64, "base64").toString("utf-8");
+    return Buffer.from(base642, "base64").toString("utf-8");
   } else {
     throw new Error("No base64 decoding available");
   }
@@ -8052,6 +9439,7 @@ var SharingService = class {
     this.pathPrefix = config.pathPrefix ?? "";
     this.sessionExpiry = config.sessionExpiry;
     this.onRootDelegationNeeded = config.onRootDelegationNeeded;
+    this.assertActiveFn = config.assertActive;
   }
   /**
    * Gets the primary host URL.
@@ -8063,6 +9451,7 @@ var SharingService = class {
    * Updates the session (e.g., after re-authentication).
    */
   updateSession(session) {
+    this.assertActiveFn?.();
     this.session = session;
   }
   /**
@@ -8070,6 +9459,7 @@ var SharingService = class {
    * Used to add full capabilities (session, delegationManager, createDelegation, createDelegationWasm) after signIn.
    */
   updateConfig(config) {
+    this.assertActiveFn?.();
     if (config.session !== void 0) {
       this.session = config.session;
     }
@@ -8088,6 +9478,9 @@ var SharingService = class {
     if (config.onRootDelegationNeeded !== void 0) {
       this.onRootDelegationNeeded = config.onRootDelegationNeeded;
     }
+    if (config.assertActive !== void 0) {
+      this.assertActiveFn = config.assertActive;
+    }
   }
   /**
    * Generate a sharing link with an embedded private key.
@@ -8100,6 +9493,8 @@ var SharingService = class {
    * 5. Return link string
    */
   async generate(params) {
+    const activeError = this.retiredGraphError();
+    if (activeError) return { ok: false, error: activeError };
     if (!this.session) {
       return {
         ok: false,
@@ -8147,7 +9542,11 @@ var SharingService = class {
     try {
       const shareKeyName = `share:${Date.now()}:${Math.random().toString(36).substring(2, 10)}`;
       keyId = await this.keyProvider.createSessionKey(shareKeyName);
+      const keyCreationActiveError = this.retiredGraphError();
+      if (keyCreationActiveError) return { ok: false, error: keyCreationActiveError };
       keyDid = await this.keyProvider.getDID(keyId);
+      const keyDidActiveError = this.retiredGraphError();
+      if (keyDidActiveError) return { ok: false, error: keyDidActiveError };
       keyJwk = this.keyProvider.getJWK(keyId);
       if (!keyJwk.d) {
         return {
@@ -8183,6 +9582,8 @@ var SharingService = class {
     );
     if (canSatisfyFromRegistry) {
       const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);
+      const childDelegationActiveError = this.retiredGraphError();
+      if (childDelegationActiveError) return { ok: false, error: childDelegationActiveError };
       const parsed = handleDelegationResult(delegationResult);
       if ("ok" in parsed && parsed.ok === false) {
         return parsed;
@@ -8197,39 +9598,41 @@ var SharingService = class {
           actions,
           requestedExpiry
         });
+        const rootDelegationActiveError = this.retiredGraphError();
+        if (rootDelegationActiveError) return { ok: false, error: rootDelegationActiveError };
         if (rootDelegation) {
           delegation = rootDelegation;
           expiry = requestedExpiry;
         } else {
-          const fallbackResult = await this.handleSessionExtensionFallback(requestedExpiry);
-          expiry = fallbackResult.expiry;
-          const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);
-          const parsed = handleDelegationResult(delegationResult);
-          if ("ok" in parsed && parsed.ok === false) {
-            return parsed;
-          }
-          delegation = parsed;
+          return {
+            ok: false,
+            error: createError2(
+              DelegationErrorCodes.PERMISSION_DENIED,
+              "The active session ReCap does not authorize this sharing delegation."
+            )
+          };
         }
       } catch (err6) {
-        const fallbackResult = await this.handleSessionExtensionFallback(requestedExpiry);
-        expiry = fallbackResult.expiry;
-        const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);
-        const parsed = handleDelegationResult(delegationResult);
-        if ("ok" in parsed && parsed.ok === false) {
-          return parsed;
-        }
-        delegation = parsed;
+        return {
+          ok: false,
+          error: createError2(
+            DelegationErrorCodes.PERMISSION_DENIED,
+            "The active session ReCap does not authorize this sharing delegation.",
+            err6 instanceof Error ? err6 : void 0
+          )
+        };
       }
     } else {
-      const fallbackResult = await this.handleSessionExtensionFallback(requestedExpiry);
-      expiry = fallbackResult.expiry;
-      const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);
-      const parsed = handleDelegationResult(delegationResult);
-      if ("ok" in parsed && parsed.ok === false) {
-        return parsed;
-      }
-      delegation = parsed;
+      return {
+        ok: false,
+        error: createError2(
+          DelegationErrorCodes.PERMISSION_DENIED,
+          "The active session ReCap does not authorize this sharing delegation."
+        )
+      };
     }
+    const finalActiveError = this.retiredGraphError();
+    if (finalActiveError) return { ok: false, error: finalActiveError };
     const shareData = {
       key: keyJwk,
       keyDid,
@@ -8262,13 +9665,16 @@ var SharingService = class {
    * @internal
    */
   findSuitableKeyForDelegation(path, actions, requestedExpiry) {
-    if (this.sessionExpiry && requestedExpiry <= this.sessionExpiry) {
-      return true;
-    }
     const allKeys = this.registry.getAllKeys();
     for (const key of allKeys) {
       const delegations = this.registry.getDelegationsForKey(key.id);
       for (const delegation of delegations) {
+        if (delegation.spaceId !== this.session?.spaceId) {
+          continue;
+        }
+        if ((delegation.caveats?.length ?? 0) > 0) {
+          continue;
+        }
         if (!this.registry.isDelegationValid(delegation)) {
           continue;
         }
@@ -8294,6 +9700,18 @@ var SharingService = class {
     }
     return false;
   }
+  retiredGraphError() {
+    try {
+      this.assertActiveFn?.();
+      return void 0;
+    } catch (err6) {
+      return createError2(
+        DelegationErrorCodes.NOT_INITIALIZED,
+        "The session service graph has been retired.",
+        err6 instanceof Error ? err6 : void 0
+      );
+    }
+  }
   /**
    * Check if a delegation path matches/covers the requested path.
    * A delegation path covers the request if:
@@ -8316,19 +9734,14 @@ var SharingService = class {
     }
     return false;
   }
-  /**
-   * Handle fallback to session extension when root delegation is not available.
-   * @internal
-   */
-  async handleSessionExtensionFallback(requestedExpiry) {
-    return { expiry: this.sessionExpiry ?? requestedExpiry };
-  }
   /**
    * Create a delegation from the current session to a share key.
    * This is the fallback path when root delegation is not available.
    * @internal
    */
   async createSessionDelegation(delegateDID, path, actions, expiry) {
+    const activeError = this.retiredGraphError();
+    if (activeError) return { ok: false, error: activeError };
     if (!this.session) {
       return {
         ok: false,
@@ -8370,14 +9783,20 @@ var SharingService = class {
           },
           expirationSecs: Math.floor(expiry.getTime() / 1e3)
         });
+        const childSigningActiveError = this.retiredGraphError();
+        if (childSigningActiveError) return { ok: false, error: childSigningActiveError };
         const registerRes = await this.fetchFn(`${this.host}/delegate`, {
           method: "POST",
           headers: {
             Authorization: wasmResult.delegation
           }
         });
+        const registrationActiveError = this.retiredGraphError();
+        if (registrationActiveError) return { ok: false, error: registrationActiveError };
         if (!registerRes.ok) {
           const errorText = await registerRes.text();
+          const registrationTextActiveError = this.retiredGraphError();
+          if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };
           return {
             ok: false,
             error: createError2(
@@ -8427,6 +9846,8 @@ var SharingService = class {
         disableSubDelegation: false
       };
       const delegationResult = this.createDelegationFn ? await this.createDelegationFn(delegationParams) : await this.delegationManager.create(delegationParams);
+      const delegationCreationActiveError = this.retiredGraphError();
+      if (delegationCreationActiveError) return { ok: false, error: delegationCreationActiveError };
       if (!delegationResult.ok) {
         return {
           ok: false,
@@ -8452,12 +9873,14 @@ var SharingService = class {
    *    - Register sub-delegation capabilities
    * 4. Return ShareAccess with pre-configured KV service
    */
-  async receive(link, options = {}) {
+  async receive(link, options2 = {}) {
+    const activeError = this.retiredGraphError();
+    if (activeError) return { ok: false, error: activeError };
     const {
       autoSubdelegate = true,
       useSessionKey = true,
       ingestOptions
-    } = options;
+    } = options2;
     const decodeResult = this.decodeLinkWithValidation(link);
     if (!decodeResult.ok) {
       return decodeResult;
@@ -8543,9 +9966,12 @@ var SharingService = class {
    * be logged or stored insecurely.
    */
   async delegateReceivedShare(link, params) {
+    const activeError = this.retiredGraphError();
+    if (activeError) return { ok: false, error: activeError };
     const decoded = this.decodeLinkWithValidation(link);
     if (!decoded.ok) return decoded;
     const shareData = decoded.data;
+    this.assertDelegationCaveatsPreservable(shareData.delegation);
     const parentExpiry = new Date(shareData.delegation.expiry);
     const now = /* @__PURE__ */ new Date();
     if (parentExpiry <= now) {
@@ -8679,6 +10105,8 @@ var SharingService = class {
         abilities: { [service]: { [path]: actions } },
         expirationSecs: Math.floor(expiry.getTime() / 1e3)
       });
+      const childSigningActiveError = this.retiredGraphError();
+      if (childSigningActiveError) return { ok: false, error: childSigningActiveError };
       const verifiedChild = verifySignedChild(result, {
         delegateDID,
         issuerDID: principalDid(shareData.keyDid),
@@ -8705,6 +10133,8 @@ var SharingService = class {
         redirect: "error"
       };
       const registration = await this.fetchFn(new URL("/delegate", trustedHost).toString(), registrationInit);
+      const registrationActiveError = this.retiredGraphError();
+      if (registrationActiveError) return { ok: false, error: registrationActiveError };
       if (!registration.ok) {
         throw new Error(`node rejected child delegation (${registration.status})`);
       }
@@ -8750,6 +10180,22 @@ var SharingService = class {
       };
     }
   }
+  /**
+   * The child-delegation WASM boundary accepts action-only abilities. Reject
+   * every constrained parent branch before that boundary can broaden it.
+   */
+  assertDelegationCaveatsPreservable(delegation) {
+    if (recapCaveatsEqual(delegation.caveats, void 0)) return;
+    const service = delegation.actions[0]?.split("/", 1)[0] ?? "tinycloud.unknown";
+    const entry = {
+      service,
+      space: delegation.spaceId,
+      path: delegation.path,
+      actions: [...delegation.actions],
+      caveats: delegation.caveats ?? []
+    };
+    throw new CaveatedDelegationUnsupportedError([entry]);
+  }
   /**
    * Encode sharing data into a link string.
    *
@@ -8918,7 +10364,7 @@ function capabilityPathContains(parent, child) {
 function shareKeyMatchesDid(key, didUrl) {
   if (key.kty !== "OKP" || key.crv !== "Ed25519" || typeof key.x !== "string" || typeof key.d !== "string") return false;
   try {
-    const didBytes = import_basics2.bases.base58btc.decode(principalDid(didUrl).slice("did:key:".length));
+    const didBytes = bases.base58btc.decode(principalDid(didUrl).slice("did:key:".length));
     const publicKey = didBytes.length === 34 && didBytes[0] === 237 && didBytes[1] === 1 ? didBytes.slice(2) : null;
     if (!publicKey) return false;
     const jwkBytes = decodeBase64UrlBytes(key.x);
@@ -9030,7 +10476,14 @@ var CapabilityKeyRegistry = class {
   removeKey(keyId) {
     const delegations = this.store.byKey.get(keyId) || [];
     for (const delegation of delegations) {
-      this.store.byCid.delete(delegation.cid);
+      const chains = this.store.byCid.get(delegation.cid);
+      if (!chains) continue;
+      const remaining = chains.filter((chain) => chain.keyId !== keyId);
+      if (remaining.length === 0) {
+        this.store.byCid.delete(delegation.cid);
+      } else {
+        this.store.byCid.set(delegation.cid, remaining);
+      }
     }
     for (const [capKey, entries] of this.store.byCapability) {
       const filtered = entries.filter(
@@ -9120,8 +10573,8 @@ var CapabilityKeyRegistry = class {
    * @param delegation - Delegation to associate with the key
    * @param options - Ingestion options
    */
-  ingestKey(key, delegation, options) {
-    const keyToStore = options?.priority !== void 0 ? { ...key, priority: options.priority } : key;
+  ingestKey(key, delegation, options2) {
+    const keyToStore = options2?.priority !== void 0 ? { ...key, priority: options2.priority } : key;
     this.keys.set(keyToStore.id, keyToStore);
     if (!this.store.byKey.has(keyToStore.id)) {
       this.store.byKey.set(keyToStore.id, []);
@@ -9190,7 +10643,7 @@ var CapabilityKeyRegistry = class {
    */
   revokeDelegation(cid) {
     const stored = this.store.byCid.get(cid);
-    if (!stored) {
+    if (!stored || stored.length === 0) {
       return (0, import_sdk_services6.err)(
         (0, import_sdk_services6.serviceError)(
           CapabilityKeyRegistryErrorCodes.KEY_NOT_FOUND,
@@ -9199,12 +10652,10 @@ var CapabilityKeyRegistry = class {
         )
       );
     }
-    stored.delegation.isRevoked = true;
-    const keyDelegations = this.store.byKey.get(stored.keyId);
-    if (keyDelegations) {
-      const delegation = keyDelegations.find((d) => d.cid === cid);
-      if (delegation) {
-        delegation.isRevoked = true;
+    for (const chain of stored) chain.delegation.isRevoked = true;
+    for (const keyDelegations of this.store.byKey.values()) {
+      for (const delegation of keyDelegations) {
+        if (delegation.cid === cid) delegation.isRevoked = true;
       }
     }
     for (const entries of this.store.byCapability.values()) {
@@ -9251,22 +10702,28 @@ var CapabilityKeyRegistry = class {
    */
   addDelegation(key, delegation) {
     const keyDelegations = this.store.byKey.get(key.id) || [];
-    if (!keyDelegations.some((d) => d.cid === delegation.cid)) {
+    if (!keyDelegations.some((d) => this.sameDelegationScope(d, delegation))) {
       keyDelegations.push(delegation);
       this.store.byKey.set(key.id, keyDelegations);
     }
-    if (!this.store.byCid.has(delegation.cid)) {
-      this.store.byCid.set(delegation.cid, {
+    const chains = this.store.byCid.get(delegation.cid) ?? [];
+    if (!chains.some(
+      (chain) => chain.keyId === key.id && this.sameDelegationScope(chain.delegation, delegation)
+    )) {
+      chains.push({
         delegation,
         parentCid: delegation.parentCid,
         keyId: key.id,
         storedAt: /* @__PURE__ */ new Date()
       });
+      this.store.byCid.set(delegation.cid, chains);
     }
     for (const action of delegation.actions) {
       const capKey = this.makeCapabilityKey(delegation.path, action);
       const entries = this.store.byCapability.get(capKey) || [];
-      const existingEntry = entries.find((e) => e.delegation.cid === delegation.cid);
+      const existingEntry = entries.find(
+        (e) => this.sameDelegationScope(e.delegation, delegation)
+      );
       if (existingEntry) {
         if (!existingEntry.keys.some((k) => k.id === key.id)) {
           existingEntry.keys.push(key);
@@ -9295,6 +10752,9 @@ var CapabilityKeyRegistry = class {
   makeCapabilityKey(resource, action) {
     return `${resource}|${action}`;
   }
+  sameDelegationScope(left, right) {
+    return left.cid === right.cid && left.spaceId === right.spaceId && left.path === right.path && left.actions.length === right.actions.length && left.actions.every((action) => right.actions.includes(action)) && recapCaveatsEqual(left.caveats, right.caveats);
+  }
   /**
    * Find capability entries that match a resource and action.
    *
@@ -9316,7 +10776,9 @@ var CapabilityKeyRegistry = class {
           continue;
         }
         if (this.resourceMatchesPattern(resource, entry.resource)) {
-          if (!results.some((r) => r.delegation.cid === entry.delegation.cid)) {
+          if (!results.some(
+            (r) => this.sameDelegationScope(r.delegation, entry.delegation)
+          )) {
             results.push(entry);
           }
         }
@@ -9397,24 +10859,24 @@ function openKeyApprovalReason(body) {
   }
   return "OpenKey explicit approval required";
 }
-function createOpenKeyCallbackSigningStrategy(options) {
+function createOpenKeyCallbackSigningStrategy(options2) {
   return {
     type: "callback",
     openKeyAutoSign: true,
     handler: async (request) => {
-      const fetchImpl = options.fetch ?? globalThis.fetch;
+      const fetchImpl = options2.fetch ?? globalThis.fetch;
       if (!fetchImpl) {
         throw new Error("OpenKey signing strategy requires a fetch implementation");
       }
-      const token = await resolveOpenKeyToken(options.token);
-      const extraHeaders = await resolveOpenKeyHeaders(options.headers);
+      const token = await resolveOpenKeyToken(options2.token);
+      const extraHeaders = await resolveOpenKeyHeaders(options2.headers);
       const body = {
         ...request,
-        ...options.keyId ? { keyId: options.keyId } : {}
+        ...options2.keyId ? { keyId: options2.keyId } : {}
       };
-      const response = await fetchImpl(options.endpoint, {
+      const response = await fetchImpl(options2.endpoint, {
         method: "POST",
-        credentials: options.credentials,
+        credentials: options2.credentials,
         headers: {
           "content-type": "application/json",
           ...token ? { authorization: `Bearer ${token}` } : {},
@@ -9531,12 +10993,1459 @@ async function checkNodeInfo(host, sdkProtocol, fetchFn = globalThis.fetch.bind(
 // src/index.ts
 var import_bootstrap3 = require("@tinycloud/bootstrap");
 
+// ../../node_modules/uint8arrays/dist/src/equals.js
+function equals3(a, b) {
+  if (a === b) {
+    return true;
+  }
+  if (a.byteLength !== b.byteLength) {
+    return false;
+  }
+  for (let i = 0; i < a.byteLength; i++) {
+    if (a[i] !== b[i]) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// ../../node_modules/uint8arrays/dist/src/alloc.node.js
+var import_node_buffer = require("buffer");
+
+// ../../node_modules/uint8arrays/dist/src/util/as-uint8array.node.js
+function asUint8Array(buf) {
+  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+}
+
+// ../../node_modules/uint8arrays/dist/src/alloc.node.js
+function allocUnsafe(size = 0) {
+  return asUint8Array(import_node_buffer.Buffer.allocUnsafe(size));
+}
+
+// ../../node_modules/uint8-varint/dist/src/index.js
+var N12 = Math.pow(2, 7);
+var N22 = Math.pow(2, 14);
+var N32 = Math.pow(2, 21);
+var N42 = Math.pow(2, 28);
+var N52 = Math.pow(2, 35);
+var N62 = Math.pow(2, 42);
+var N72 = Math.pow(2, 49);
+var MSB2 = 128;
+var REST2 = 127;
+function encodingLength2(value) {
+  if (value < N12) {
+    return 1;
+  }
+  if (value < N22) {
+    return 2;
+  }
+  if (value < N32) {
+    return 3;
+  }
+  if (value < N42) {
+    return 4;
+  }
+  if (value < N52) {
+    return 5;
+  }
+  if (value < N62) {
+    return 6;
+  }
+  if (value < N72) {
+    return 7;
+  }
+  if (Number.MAX_SAFE_INTEGER != null && value > Number.MAX_SAFE_INTEGER) {
+    throw new RangeError("Could not encode varint");
+  }
+  return 8;
+}
+function encodeUint8Array(value, buf, offset = 0) {
+  switch (encodingLength2(value)) {
+    case 8: {
+      buf[offset++] = value & 255 | MSB2;
+      value /= 128;
+    }
+    case 7: {
+      buf[offset++] = value & 255 | MSB2;
+      value /= 128;
+    }
+    case 6: {
+      buf[offset++] = value & 255 | MSB2;
+      value /= 128;
+    }
+    case 5: {
+      buf[offset++] = value & 255 | MSB2;
+      value /= 128;
+    }
+    case 4: {
+      buf[offset++] = value & 255 | MSB2;
+      value >>>= 7;
+    }
+    case 3: {
+      buf[offset++] = value & 255 | MSB2;
+      value >>>= 7;
+    }
+    case 2: {
+      buf[offset++] = value & 255 | MSB2;
+      value >>>= 7;
+    }
+    case 1: {
+      buf[offset++] = value & 255;
+      value >>>= 7;
+      break;
+    }
+    default:
+      throw new Error("unreachable");
+  }
+  return buf;
+}
+function decodeUint8Array(buf, offset) {
+  let b = buf[offset];
+  let res = 0;
+  res += b & REST2;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf[offset + 1];
+  res += (b & REST2) << 7;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf[offset + 2];
+  res += (b & REST2) << 14;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf[offset + 3];
+  res += (b & REST2) << 21;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf[offset + 4];
+  res += (b & REST2) * N42;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf[offset + 5];
+  res += (b & REST2) * N52;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf[offset + 6];
+  res += (b & REST2) * N62;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf[offset + 7];
+  res += (b & REST2) * N72;
+  if (b < MSB2) {
+    return res;
+  }
+  throw new RangeError("Could not decode varint");
+}
+function decodeUint8ArrayList(buf, offset) {
+  let b = buf.get(offset);
+  let res = 0;
+  res += b & REST2;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf.get(offset + 1);
+  res += (b & REST2) << 7;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf.get(offset + 2);
+  res += (b & REST2) << 14;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf.get(offset + 3);
+  res += (b & REST2) << 21;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf.get(offset + 4);
+  res += (b & REST2) * N42;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf.get(offset + 5);
+  res += (b & REST2) * N52;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf.get(offset + 6);
+  res += (b & REST2) * N62;
+  if (b < MSB2) {
+    return res;
+  }
+  b = buf.get(offset + 7);
+  res += (b & REST2) * N72;
+  if (b < MSB2) {
+    return res;
+  }
+  throw new RangeError("Could not decode varint");
+}
+function decode6(buf, offset = 0) {
+  if (buf instanceof Uint8Array) {
+    return decodeUint8Array(buf, offset);
+  } else {
+    return decodeUint8ArrayList(buf, offset);
+  }
+}
+
+// ../../node_modules/uint8arrays/dist/src/concat.node.js
+var import_node_buffer2 = require("buffer");
+function concat(arrays, length2) {
+  return asUint8Array(import_node_buffer2.Buffer.concat(arrays, length2));
+}
+
+// ../../node_modules/uint8arrays/dist/src/from-string.node.js
+var import_node_buffer3 = require("buffer");
+
+// ../../node_modules/uint8arrays/dist/src/util/bases.js
+function createCodec(name2, prefix, encode5, decode7) {
+  return {
+    name: name2,
+    prefix,
+    encoder: {
+      name: name2,
+      prefix,
+      encode: encode5
+    },
+    decoder: {
+      decode: decode7
+    }
+  };
+}
+var string = createCodec("utf8", "u", (buf) => {
+  const decoder = new TextDecoder("utf8");
+  return "u" + decoder.decode(buf);
+}, (str) => {
+  const encoder = new TextEncoder();
+  return encoder.encode(str.substring(1));
+});
+var ascii = createCodec("ascii", "a", (buf) => {
+  let string2 = "a";
+  for (let i = 0; i < buf.length; i++) {
+    string2 += String.fromCharCode(buf[i]);
+  }
+  return string2;
+}, (str) => {
+  str = str.substring(1);
+  const buf = allocUnsafe(str.length);
+  for (let i = 0; i < str.length; i++) {
+    buf[i] = str.charCodeAt(i);
+  }
+  return buf;
+});
+var BASES = {
+  utf8: string,
+  "utf-8": string,
+  hex: bases.base16,
+  latin1: ascii,
+  ascii,
+  binary: ascii,
+  ...bases
+};
+var bases_default = BASES;
+
+// ../../node_modules/uint8arrays/dist/src/from-string.node.js
+function fromString2(string2, encoding = "utf8") {
+  const base3 = bases_default[encoding];
+  if (base3 == null) {
+    throw new Error(`Unsupported encoding "${encoding}"`);
+  }
+  if (encoding === "utf8" || encoding === "utf-8") {
+    return asUint8Array(import_node_buffer3.Buffer.from(string2, "utf-8"));
+  }
+  return base3.decoder.decode(`${base3.prefix}${string2}`);
+}
+
+// ../../node_modules/uint8arrays/dist/src/to-string.node.js
+var import_node_buffer4 = require("buffer");
+function toString2(array, encoding = "utf8") {
+  const base3 = bases_default[encoding];
+  if (base3 == null) {
+    throw new Error(`Unsupported encoding "${encoding}"`);
+  }
+  if (encoding === "utf8" || encoding === "utf-8") {
+    return import_node_buffer4.Buffer.from(array.buffer, array.byteOffset, array.byteLength).toString("utf8");
+  }
+  return base3.encoder.encode(array).substring(1);
+}
+
+// ../../node_modules/@multiformats/multiaddr/dist/src/errors.js
+var InvalidMultiaddrError = class extends Error {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "name", "InvalidMultiaddrError");
+  }
+};
+__publicField(InvalidMultiaddrError, "name", "InvalidMultiaddrError");
+var ValidationError = class extends Error {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "name", "ValidationError");
+  }
+};
+__publicField(ValidationError, "name", "ValidationError");
+var InvalidParametersError = class extends Error {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "name", "InvalidParametersError");
+  }
+};
+__publicField(InvalidParametersError, "name", "InvalidParametersError");
+var UnknownProtocolError = class extends Error {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "name", "UnknownProtocolError");
+  }
+};
+__publicField(UnknownProtocolError, "name", "UnknownProtocolError");
+
+// ../../node_modules/@chainsafe/is-ip/lib/is-ip.node.js
+var import_node_net = require("net");
+
+// ../../node_modules/@multiformats/multiaddr/dist/src/constants.js
+var CODE_IP4 = 4;
+var CODE_TCP = 6;
+var CODE_UDP = 273;
+var CODE_DCCP = 33;
+var CODE_IP6 = 41;
+var CODE_IP6ZONE = 42;
+var CODE_IPCIDR = 43;
+var CODE_DNS = 53;
+var CODE_DNS4 = 54;
+var CODE_DNS6 = 55;
+var CODE_DNSADDR = 56;
+var CODE_SCTP = 132;
+var CODE_UDT = 301;
+var CODE_UTP = 302;
+var CODE_UNIX = 400;
+var CODE_P2P = 421;
+var CODE_ONION = 444;
+var CODE_ONION3 = 445;
+var CODE_GARLIC64 = 446;
+var CODE_GARLIC32 = 447;
+var CODE_TLS = 448;
+var CODE_SNI = 449;
+var CODE_NOISE = 454;
+var CODE_QUIC = 460;
+var CODE_QUIC_V1 = 461;
+var CODE_WEBTRANSPORT = 465;
+var CODE_CERTHASH = 466;
+var CODE_HTTP = 480;
+var CODE_HTTP_PATH = 481;
+var CODE_HTTPS = 443;
+var CODE_WS = 477;
+var CODE_WSS = 478;
+var CODE_P2P_WEBSOCKET_STAR = 479;
+var CODE_P2P_STARDUST = 277;
+var CODE_P2P_WEBRTC_STAR = 275;
+var CODE_P2P_WEBRTC_DIRECT = 276;
+var CODE_WEBRTC_DIRECT = 280;
+var CODE_WEBRTC = 281;
+var CODE_P2P_CIRCUIT = 290;
+var CODE_MEMORY = 777;
+
+// ../../node_modules/@multiformats/multiaddr/dist/src/utils.js
+function bytesToString(base3) {
+  return (buf) => {
+    return toString2(buf, base3);
+  };
+}
+function stringToBytes(base3) {
+  return (buf) => {
+    return fromString2(buf, base3);
+  };
+}
+function bytes2port(buf) {
+  const view = new DataView(buf.buffer);
+  return view.getUint16(buf.byteOffset).toString();
+}
+function port2bytes(port) {
+  const buf = new ArrayBuffer(2);
+  const view = new DataView(buf);
+  view.setUint16(0, typeof port === "string" ? parseInt(port) : port);
+  return new Uint8Array(buf);
+}
+function onion2bytes(str) {
+  const addr = str.split(":");
+  if (addr.length !== 2) {
+    throw new Error(`failed to parse onion addr: ["'${addr.join('", "')}'"]' does not contain a port number`);
+  }
+  if (addr[0].length !== 16) {
+    throw new Error(`failed to parse onion addr: ${addr[0]} not a Tor onion address.`);
+  }
+  const buf = fromString2(addr[0], "base32");
+  const port = parseInt(addr[1], 10);
+  if (port < 1 || port > 65536) {
+    throw new Error("Port number is not in range(1, 65536)");
+  }
+  const portBuf = port2bytes(port);
+  return concat([buf, portBuf], buf.length + portBuf.length);
+}
+function onion32bytes(str) {
+  const addr = str.split(":");
+  if (addr.length !== 2) {
+    throw new Error(`failed to parse onion addr: ["'${addr.join('", "')}'"]' does not contain a port number`);
+  }
+  if (addr[0].length !== 56) {
+    throw new Error(`failed to parse onion addr: ${addr[0]} not a Tor onion3 address.`);
+  }
+  const buf = base32.decode(`b${addr[0]}`);
+  const port = parseInt(addr[1], 10);
+  if (port < 1 || port > 65536) {
+    throw new Error("Port number is not in range(1, 65536)");
+  }
+  const portBuf = port2bytes(port);
+  return concat([buf, portBuf], buf.length + portBuf.length);
+}
+function bytes2onion(buf) {
+  const addrBytes = buf.subarray(0, buf.length - 2);
+  const portBytes = buf.subarray(buf.length - 2);
+  const addr = toString2(addrBytes, "base32");
+  const port = bytes2port(portBytes);
+  return `${addr}:${port}`;
+}
+var ip4ToBytes = function(ip) {
+  ip = ip.toString().trim();
+  const bytes = new Uint8Array(4);
+  ip.split(/\./g).forEach((byte, index) => {
+    const value = parseInt(byte, 10);
+    if (isNaN(value) || value < 0 || value > 255) {
+      throw new InvalidMultiaddrError("Invalid byte value in IP address");
+    }
+    bytes[index] = value;
+  });
+  return bytes;
+};
+var ip6ToBytes = function(ip) {
+  let offset = 0;
+  ip = ip.toString().trim();
+  const sections = ip.split(":", 8);
+  let i;
+  for (i = 0; i < sections.length; i++) {
+    const isv4 = (0, import_node_net.isIPv4)(sections[i]);
+    let v4Buffer;
+    if (isv4) {
+      v4Buffer = ip4ToBytes(sections[i]);
+      sections[i] = toString2(v4Buffer.subarray(0, 2), "base16");
+    }
+    if (v4Buffer != null && ++i < 8) {
+      sections.splice(i, 0, toString2(v4Buffer.subarray(2, 4), "base16"));
+    }
+  }
+  if (sections[0] === "") {
+    while (sections.length < 8) {
+      sections.unshift("0");
+    }
+  } else if (sections[sections.length - 1] === "") {
+    while (sections.length < 8) {
+      sections.push("0");
+    }
+  } else if (sections.length < 8) {
+    for (i = 0; i < sections.length && sections[i] !== ""; i++) {
+    }
+    const argv = [i, 1];
+    for (i = 9 - sections.length; i > 0; i--) {
+      argv.push("0");
+    }
+    sections.splice.apply(sections, argv);
+  }
+  const bytes = new Uint8Array(offset + 16);
+  for (i = 0; i < sections.length; i++) {
+    if (sections[i] === "") {
+      sections[i] = "0";
+    }
+    const word2 = parseInt(sections[i], 16);
+    if (isNaN(word2) || word2 < 0 || word2 > 65535) {
+      throw new InvalidMultiaddrError("Invalid byte value in IP address");
+    }
+    bytes[offset++] = word2 >> 8 & 255;
+    bytes[offset++] = word2 & 255;
+  }
+  return bytes;
+};
+var ip4ToString = function(buf) {
+  if (buf.byteLength !== 4) {
+    throw new InvalidMultiaddrError("IPv4 address was incorrect length");
+  }
+  const result = [];
+  for (let i = 0; i < buf.byteLength; i++) {
+    result.push(buf[i]);
+  }
+  return result.join(".");
+};
+var ip6ToString = function(buf) {
+  if (buf.byteLength !== 16) {
+    throw new InvalidMultiaddrError("IPv6 address was incorrect length");
+  }
+  const result = [];
+  for (let i = 0; i < buf.byteLength; i += 2) {
+    const byte1 = buf[i];
+    const byte2 = buf[i + 1];
+    const tuple = `${byte1.toString(16).padStart(2, "0")}${byte2.toString(16).padStart(2, "0")}`;
+    result.push(tuple);
+  }
+  const ip = result.join(":");
+  try {
+    const url = new URL(`http://[${ip}]`);
+    return url.hostname.substring(1, url.hostname.length - 1);
+  } catch {
+    throw new InvalidMultiaddrError(`Invalid IPv6 address "${ip}"`);
+  }
+};
+function ip6StringToValue(str) {
+  try {
+    const url = new URL(`http://[${str}]`);
+    return url.hostname.substring(1, url.hostname.length - 1);
+  } catch {
+    throw new InvalidMultiaddrError(`Invalid IPv6 address "${str}"`);
+  }
+}
+var decoders = Object.values(bases).map((c) => c.decoder);
+var anybaseDecoder = (function() {
+  let acc = decoders[0].or(decoders[1]);
+  decoders.slice(2).forEach((d) => acc = acc.or(d));
+  return acc;
+})();
+function mb2bytes(mbstr) {
+  return anybaseDecoder.decode(mbstr);
+}
+function bytes2mb(base3) {
+  return (buf) => {
+    return base3.encoder.encode(buf);
+  };
+}
+
+// ../../node_modules/@multiformats/multiaddr/dist/src/validation.js
+function integer(value) {
+  const int = parseInt(value);
+  if (int.toString() !== value) {
+    throw new ValidationError("Value must be an integer");
+  }
+}
+function positive(value) {
+  if (value < 0) {
+    throw new ValidationError("Value must be a positive integer, or zero");
+  }
+}
+function maxValue(max) {
+  return (value) => {
+    if (value > max) {
+      throw new ValidationError(`Value must be smaller than or equal to ${max}`);
+    }
+  };
+}
+function validate(...funcs) {
+  return (value) => {
+    for (const fn of funcs) {
+      fn(value);
+    }
+  };
+}
+var validatePort = validate(integer, positive, maxValue(65535));
+
+// ../../node_modules/@multiformats/multiaddr/dist/src/registry.js
+var V = -1;
+var Registry = class {
+  constructor() {
+    __publicField(this, "protocolsByCode", /* @__PURE__ */ new Map());
+    __publicField(this, "protocolsByName", /* @__PURE__ */ new Map());
+  }
+  getProtocol(key) {
+    let codec;
+    if (typeof key === "string") {
+      codec = this.protocolsByName.get(key);
+    } else {
+      codec = this.protocolsByCode.get(key);
+    }
+    if (codec == null) {
+      throw new UnknownProtocolError(`Protocol ${key} was unknown`);
+    }
+    return codec;
+  }
+  addProtocol(codec) {
+    this.protocolsByCode.set(codec.code, codec);
+    this.protocolsByName.set(codec.name, codec);
+    codec.aliases?.forEach((alias) => {
+      this.protocolsByName.set(alias, codec);
+    });
+  }
+  removeProtocol(code2) {
+    const codec = this.protocolsByCode.get(code2);
+    if (codec == null) {
+      return;
+    }
+    this.protocolsByCode.delete(codec.code);
+    this.protocolsByName.delete(codec.name);
+    codec.aliases?.forEach((alias) => {
+      this.protocolsByName.delete(alias);
+    });
+  }
+};
+var registry = new Registry();
+var codecs = [{
+  code: CODE_IP4,
+  name: "ip4",
+  size: 32,
+  valueToBytes: ip4ToBytes,
+  bytesToValue: ip4ToString,
+  validate: (value) => {
+    if (!(0, import_node_net.isIPv4)(value)) {
+      throw new ValidationError(`Invalid IPv4 address "${value}"`);
+    }
+  }
+}, {
+  code: CODE_TCP,
+  name: "tcp",
+  size: 16,
+  valueToBytes: port2bytes,
+  bytesToValue: bytes2port,
+  validate: validatePort
+}, {
+  code: CODE_UDP,
+  name: "udp",
+  size: 16,
+  valueToBytes: port2bytes,
+  bytesToValue: bytes2port,
+  validate: validatePort
+}, {
+  code: CODE_DCCP,
+  name: "dccp",
+  size: 16,
+  valueToBytes: port2bytes,
+  bytesToValue: bytes2port,
+  validate: validatePort
+}, {
+  code: CODE_IP6,
+  name: "ip6",
+  size: 128,
+  valueToBytes: ip6ToBytes,
+  bytesToValue: ip6ToString,
+  stringToValue: ip6StringToValue,
+  validate: (value) => {
+    if (!(0, import_node_net.isIPv6)(value)) {
+      throw new ValidationError(`Invalid IPv6 address "${value}"`);
+    }
+  }
+}, {
+  code: CODE_IP6ZONE,
+  name: "ip6zone",
+  size: V
+}, {
+  code: CODE_IPCIDR,
+  name: "ipcidr",
+  size: 8,
+  bytesToValue: bytesToString("base10"),
+  valueToBytes: stringToBytes("base10")
+}, {
+  code: CODE_DNS,
+  name: "dns",
+  size: V
+}, {
+  code: CODE_DNS4,
+  name: "dns4",
+  size: V
+}, {
+  code: CODE_DNS6,
+  name: "dns6",
+  size: V
+}, {
+  code: CODE_DNSADDR,
+  name: "dnsaddr",
+  size: V
+}, {
+  code: CODE_SCTP,
+  name: "sctp",
+  size: 16,
+  valueToBytes: port2bytes,
+  bytesToValue: bytes2port,
+  validate: validatePort
+}, {
+  code: CODE_UDT,
+  name: "udt"
+}, {
+  code: CODE_UTP,
+  name: "utp"
+}, {
+  code: CODE_UNIX,
+  name: "unix",
+  size: V,
+  stringToValue: (str) => decodeURIComponent(str),
+  valueToString: (val) => encodeURIComponent(val)
+}, {
+  code: CODE_P2P,
+  name: "p2p",
+  aliases: ["ipfs"],
+  size: V,
+  bytesToValue: bytesToString("base58btc"),
+  valueToBytes: (val) => {
+    if (val.startsWith("Q") || val.startsWith("1")) {
+      return stringToBytes("base58btc")(val);
+    }
+    return CID.parse(val).multihash.bytes;
+  }
+}, {
+  code: CODE_ONION,
+  name: "onion",
+  size: 96,
+  bytesToValue: bytes2onion,
+  valueToBytes: onion2bytes
+}, {
+  code: CODE_ONION3,
+  name: "onion3",
+  size: 296,
+  bytesToValue: bytes2onion,
+  valueToBytes: onion32bytes
+}, {
+  code: CODE_GARLIC64,
+  name: "garlic64",
+  size: V
+}, {
+  code: CODE_GARLIC32,
+  name: "garlic32",
+  size: V
+}, {
+  code: CODE_TLS,
+  name: "tls"
+}, {
+  code: CODE_SNI,
+  name: "sni",
+  size: V
+}, {
+  code: CODE_NOISE,
+  name: "noise"
+}, {
+  code: CODE_QUIC,
+  name: "quic"
+}, {
+  code: CODE_QUIC_V1,
+  name: "quic-v1"
+}, {
+  code: CODE_WEBTRANSPORT,
+  name: "webtransport"
+}, {
+  code: CODE_CERTHASH,
+  name: "certhash",
+  size: V,
+  bytesToValue: bytes2mb(base64url),
+  valueToBytes: mb2bytes
+}, {
+  code: CODE_HTTP,
+  name: "http"
+}, {
+  code: CODE_HTTP_PATH,
+  name: "http-path",
+  size: V,
+  stringToValue: (str) => `/${decodeURIComponent(str)}`,
+  valueToString: (val) => encodeURIComponent(val.substring(1))
+}, {
+  code: CODE_HTTPS,
+  name: "https"
+}, {
+  code: CODE_WS,
+  name: "ws"
+}, {
+  code: CODE_WSS,
+  name: "wss"
+}, {
+  code: CODE_P2P_WEBSOCKET_STAR,
+  name: "p2p-websocket-star"
+}, {
+  code: CODE_P2P_STARDUST,
+  name: "p2p-stardust"
+}, {
+  code: CODE_P2P_WEBRTC_STAR,
+  name: "p2p-webrtc-star"
+}, {
+  code: CODE_P2P_WEBRTC_DIRECT,
+  name: "p2p-webrtc-direct"
+}, {
+  code: CODE_WEBRTC_DIRECT,
+  name: "webrtc-direct"
+}, {
+  code: CODE_WEBRTC,
+  name: "webrtc"
+}, {
+  code: CODE_P2P_CIRCUIT,
+  name: "p2p-circuit"
+}, {
+  code: CODE_MEMORY,
+  name: "memory",
+  size: V
+}];
+codecs.forEach((codec) => {
+  registry.addProtocol(codec);
+});
+
+// ../../node_modules/@multiformats/multiaddr/dist/src/components.js
+function bytesToComponents(bytes) {
+  const components = [];
+  let i = 0;
+  while (i < bytes.length) {
+    const code2 = decode6(bytes, i);
+    const codec = registry.getProtocol(code2);
+    const codeLength = encodingLength2(code2);
+    const size = sizeForAddr(codec, bytes, i + codeLength);
+    let sizeLength = 0;
+    if (size > 0 && codec.size === V) {
+      sizeLength = encodingLength2(size);
+    }
+    const componentLength = codeLength + sizeLength + size;
+    const component = {
+      code: code2,
+      name: codec.name,
+      bytes: bytes.subarray(i, i + componentLength)
+    };
+    if (size > 0) {
+      const valueOffset = i + codeLength + sizeLength;
+      const valueBytes = bytes.subarray(valueOffset, valueOffset + size);
+      component.value = codec.bytesToValue?.(valueBytes) ?? toString2(valueBytes);
+    }
+    components.push(component);
+    i += componentLength;
+  }
+  return components;
+}
+function componentsToBytes(components) {
+  let length2 = 0;
+  const bytes = [];
+  for (const component of components) {
+    if (component.bytes == null) {
+      const codec = registry.getProtocol(component.code);
+      const codecLength = encodingLength2(component.code);
+      let valueBytes;
+      let valueLength = 0;
+      let valueLengthLength = 0;
+      if (component.value != null) {
+        valueBytes = codec.valueToBytes?.(component.value) ?? fromString2(component.value);
+        valueLength = valueBytes.byteLength;
+        if (codec.size === V) {
+          valueLengthLength = encodingLength2(valueLength);
+        }
+      }
+      const bytes2 = new Uint8Array(codecLength + valueLengthLength + valueLength);
+      let offset = 0;
+      encodeUint8Array(component.code, bytes2, offset);
+      offset += codecLength;
+      if (valueBytes != null) {
+        if (codec.size === V) {
+          encodeUint8Array(valueLength, bytes2, offset);
+          offset += valueLengthLength;
+        }
+        bytes2.set(valueBytes, offset);
+      }
+      component.bytes = bytes2;
+    }
+    bytes.push(component.bytes);
+    length2 += component.bytes.byteLength;
+  }
+  return concat(bytes, length2);
+}
+function stringToComponents(string2) {
+  if (string2.charAt(0) !== "/") {
+    throw new InvalidMultiaddrError('String multiaddr must start with "/"');
+  }
+  const components = [];
+  let collecting = "protocol";
+  let value = "";
+  let protocol = "";
+  for (let i = 1; i < string2.length; i++) {
+    const char = string2.charAt(i);
+    if (char !== "/") {
+      if (collecting === "protocol") {
+        protocol += string2.charAt(i);
+      } else {
+        value += string2.charAt(i);
+      }
+    }
+    const ended = i === string2.length - 1;
+    if (char === "/" || ended) {
+      const codec = registry.getProtocol(protocol);
+      if (collecting === "protocol") {
+        if (codec.size == null || codec.size === 0) {
+          components.push({
+            code: codec.code,
+            name: codec.name
+          });
+          value = "";
+          protocol = "";
+          collecting = "protocol";
+          continue;
+        } else if (ended) {
+          throw new InvalidMultiaddrError(`Component ${protocol} was missing value`);
+        }
+        collecting = "value";
+      } else if (collecting === "value") {
+        const component = {
+          code: codec.code,
+          name: codec.name
+        };
+        if (codec.size != null && codec.size !== 0) {
+          if (value === "") {
+            throw new InvalidMultiaddrError(`Component ${protocol} was missing value`);
+          }
+          component.value = codec.stringToValue?.(value) ?? value;
+        }
+        components.push(component);
+        value = "";
+        protocol = "";
+        collecting = "protocol";
+      }
+    }
+  }
+  if (protocol !== "" && value !== "") {
+    throw new InvalidMultiaddrError("Incomplete multiaddr");
+  }
+  return components;
+}
+function componentsToString(components) {
+  return `/${components.flatMap((component) => {
+    if (component.value == null) {
+      return component.name;
+    }
+    const codec = registry.getProtocol(component.code);
+    if (codec == null) {
+      throw new InvalidMultiaddrError(`Unknown protocol code ${component.code}`);
+    }
+    return [
+      component.name,
+      codec.valueToString?.(component.value) ?? component.value
+    ];
+  }).join("/")}`;
+}
+function sizeForAddr(codec, bytes, offset) {
+  if (codec.size == null || codec.size === 0) {
+    return 0;
+  }
+  if (codec.size > 0) {
+    return codec.size / 8;
+  }
+  return decode6(bytes, offset);
+}
+
+// ../../node_modules/@multiformats/multiaddr/dist/src/multiaddr.js
+var inspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+var symbol = /* @__PURE__ */ Symbol.for("@multiformats/multiaddr");
+function toComponents(addr) {
+  if (addr == null) {
+    addr = "/";
+  }
+  if (isMultiaddr(addr)) {
+    return addr.getComponents();
+  }
+  if (addr instanceof Uint8Array) {
+    return bytesToComponents(addr);
+  }
+  if (typeof addr === "string") {
+    addr = addr.replace(/\/(\/)+/, "/").replace(/(\/)+$/, "");
+    if (addr === "") {
+      addr = "/";
+    }
+    return stringToComponents(addr);
+  }
+  if (Array.isArray(addr)) {
+    return addr;
+  }
+  throw new InvalidMultiaddrError("Must be a string, Uint8Array, Component[], or another Multiaddr");
+}
+var _a2, _components, _string, _bytes;
+var _Multiaddr = class _Multiaddr {
+  constructor(addr = "/", options2 = {}) {
+    __publicField(this, _a2, true);
+    __privateAdd(this, _components);
+    // cache string representation
+    __privateAdd(this, _string);
+    // cache byte representation
+    __privateAdd(this, _bytes);
+    __privateSet(this, _components, toComponents(addr));
+    if (options2.validate !== false) {
+      validate2(this);
+    }
+  }
+  get bytes() {
+    if (__privateGet(this, _bytes) == null) {
+      __privateSet(this, _bytes, componentsToBytes(__privateGet(this, _components)));
+    }
+    return __privateGet(this, _bytes);
+  }
+  toString() {
+    if (__privateGet(this, _string) == null) {
+      __privateSet(this, _string, componentsToString(__privateGet(this, _components)));
+    }
+    return __privateGet(this, _string);
+  }
+  toJSON() {
+    return this.toString();
+  }
+  getComponents() {
+    return [
+      ...__privateGet(this, _components).map((c) => ({ ...c }))
+    ];
+  }
+  encapsulate(addr) {
+    const ma = new _Multiaddr(addr);
+    return new _Multiaddr([
+      ...__privateGet(this, _components),
+      ...ma.getComponents()
+    ], {
+      validate: false
+    });
+  }
+  decapsulate(addr) {
+    const addrString = addr.toString();
+    const s = this.toString();
+    const i = s.lastIndexOf(addrString);
+    if (i < 0) {
+      throw new InvalidParametersError(`Address ${this.toString()} does not contain subaddress: ${addrString}`);
+    }
+    return new _Multiaddr(s.slice(0, i), {
+      validate: false
+    });
+  }
+  decapsulateCode(code2) {
+    let index;
+    for (let i = __privateGet(this, _components).length - 1; i > -1; i--) {
+      if (__privateGet(this, _components)[i].code === code2) {
+        index = i;
+        break;
+      }
+    }
+    return new _Multiaddr(__privateGet(this, _components).slice(0, index), {
+      validate: false
+    });
+  }
+  equals(addr) {
+    return equals3(this.bytes, addr.bytes);
+  }
+  /**
+   * Returns Multiaddr as a human-readable string
+   * https://nodejs.org/api/util.html#utilinspectcustom
+   *
+   * @example
+   * ```js
+   * import { multiaddr } from '@multiformats/multiaddr'
+   *
+   * console.info(multiaddr('/ip4/127.0.0.1/tcp/4001'))
+   * // 'Multiaddr(/ip4/127.0.0.1/tcp/4001)'
+   * ```
+   */
+  [(_a2 = symbol, inspect)]() {
+    return `Multiaddr(${this.toString()})`;
+  }
+};
+_components = new WeakMap();
+_string = new WeakMap();
+_bytes = new WeakMap();
+var Multiaddr = _Multiaddr;
+function validate2(addr) {
+  addr.getComponents().forEach((component) => {
+    const codec = registry.getProtocol(component.code);
+    if (component.value == null) {
+      return;
+    }
+    codec.validate?.(component.value);
+  });
+}
+
+// ../../node_modules/@multiformats/multiaddr/dist/src/index.js
+function isMultiaddr(value) {
+  return Boolean(value?.[symbol]);
+}
+function multiaddr(addr) {
+  return new Multiaddr(addr);
+}
+
+// ../../node_modules/@multiformats/multiaddr-to-uri/dist/src/index.js
+var ASSUME_HTTP_CODES = [
+  CODE_TCP,
+  CODE_DNS,
+  CODE_DNSADDR,
+  CODE_DNS4,
+  CODE_DNS6
+];
+function extractSNI(ma) {
+  return extractTuple("sni", ma)?.value;
+}
+function extractPort(ma) {
+  const port = extractTuple("tcp", ma)?.value;
+  if (port == null) {
+    return "";
+  }
+  return `:${port}`;
+}
+function extractTuple(name2, ma) {
+  return ma.find((component) => component.name === name2);
+}
+function hasTLS(ma) {
+  return ma.some(({ code: code2 }) => code2 === CODE_TLS);
+}
+function interpretNext(head, rest) {
+  const interpreter = interpreters[head.name];
+  if (interpreter == null) {
+    throw new Error(`Can't interpret protocol ${head.name}`);
+  }
+  const restVal = interpreter(head, rest);
+  if (head.code === CODE_IP6) {
+    return `[${restVal}]`;
+  }
+  return restVal;
+}
+var interpreters = {
+  ip4: (head, rest) => head.value,
+  ip6: (head, rest) => {
+    if (rest.length === 0) {
+      return head.value;
+    }
+    return `[${head.value}]`;
+  },
+  tcp: (head, rest) => {
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    return `tcp://${interpretNext(tail, rest)}:${head.value}`;
+  },
+  udp: (head, rest) => {
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    return `udp://${interpretNext(tail, rest)}:${head.value}`;
+  },
+  dnsaddr: (head, rest) => head.value,
+  dns4: (head, rest) => head.value,
+  dns6: (head, rest) => head.value,
+  dns: (head, rest) => head.value,
+  ipfs: (head, rest) => {
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    return `${interpretNext(tail, rest)}`;
+  },
+  p2p: (head, rest) => {
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    return `${interpretNext(tail, rest)}`;
+  },
+  http: (head, rest) => {
+    const maHasTLS = hasTLS(rest);
+    const sni = extractSNI(rest);
+    const port = extractPort(rest);
+    if (maHasTLS && sni != null) {
+      return `https://${sni}${port}`;
+    }
+    const protocol = maHasTLS ? "https://" : "http://";
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    let baseVal = interpretNext(tail, rest);
+    baseVal = baseVal?.replace("tcp://", "");
+    return `${protocol}${baseVal}`;
+  },
+  "http-path": (head, rest) => {
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    const baseVal = interpretNext(tail, rest);
+    const decodedValue = decodeURIComponent(head.value ?? "");
+    return `${baseVal}${decodedValue}`;
+  },
+  tls: (head, rest) => {
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    return interpretNext(tail, rest);
+  },
+  sni: (head, rest) => {
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    return interpretNext(tail, rest);
+  },
+  https: (head, rest) => {
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    let baseVal = interpretNext(tail, rest);
+    baseVal = baseVal?.replace("tcp://", "");
+    return `https://${baseVal}`;
+  },
+  ws: (head, rest) => {
+    const maHasTLS = hasTLS(rest);
+    const sni = extractSNI(rest);
+    const port = extractPort(rest);
+    if (maHasTLS && sni != null) {
+      return `wss://${sni}${port}`;
+    }
+    const protocol = maHasTLS ? "wss://" : "ws://";
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    let baseVal = interpretNext(tail, rest);
+    baseVal = baseVal?.replace("tcp://", "");
+    return `${protocol}${baseVal}`;
+  },
+  wss: (head, rest) => {
+    const tail = rest.pop();
+    if (tail == null) {
+      throw new Error("Unexpected end of multiaddr");
+    }
+    let baseVal = interpretNext(tail, rest);
+    baseVal = baseVal?.replace("tcp://", "");
+    return `wss://${baseVal}`;
+  }
+};
+function multiaddrToUri(input, opts) {
+  const ma = multiaddr(input);
+  const components = ma.getComponents();
+  const head = components.pop();
+  if (head == null) {
+    throw new Error("Unexpected end of multiaddr");
+  }
+  const interpreter = interpreters[head.name];
+  if (interpreter == null) {
+    throw new Error(`No interpreter found for ${head.name}`);
+  }
+  let uri = interpreter(head, components) ?? "";
+  if (opts?.assumeHttp !== false && ASSUME_HTTP_CODES.includes(head.code)) {
+    uri = uri.replace(/^.*:\/\//, "");
+    if (head.value === "443") {
+      uri = `https://${uri}`;
+    } else {
+      uri = `http://${uri}`;
+    }
+  }
+  if (uri.startsWith("http://") || uri.startsWith("https://") || uri.startsWith("ws://") || uri.startsWith("wss://")) {
+    uri = new URL(uri).toString();
+    if (uri.endsWith("/")) {
+      uri = uri.substring(0, uri.length - 1);
+    }
+  }
+  return uri;
+}
+
+// ../../node_modules/ip-regex/index.js
+var word = "[a-fA-F\\d:]";
+var boundry = (options2) => options2 && options2.includeBoundaries ? `(?:(?<=\\s|^)(?=${word})|(?<=${word})(?=\\s|$))` : "";
+var v4 = "(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]\\d|\\d)(?:\\.(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]\\d|\\d)){3}";
+var v6segment = "[a-fA-F\\d]{1,4}";
+var v6 = `
+(?:
+(?:${v6segment}:){7}(?:${v6segment}|:)|                                    // 1:2:3:4:5:6:7::  1:2:3:4:5:6:7:8
+(?:${v6segment}:){6}(?:${v4}|:${v6segment}|:)|                             // 1:2:3:4:5:6::    1:2:3:4:5:6::8   1:2:3:4:5:6::8  1:2:3:4:5:6::1.2.3.4
+(?:${v6segment}:){5}(?::${v4}|(?::${v6segment}){1,2}|:)|                   // 1:2:3:4:5::      1:2:3:4:5::7:8   1:2:3:4:5::8    1:2:3:4:5::7:1.2.3.4
+(?:${v6segment}:){4}(?:(?::${v6segment}){0,1}:${v4}|(?::${v6segment}){1,3}|:)| // 1:2:3:4::        1:2:3:4::6:7:8   1:2:3:4::8      1:2:3:4::6:7:1.2.3.4
+(?:${v6segment}:){3}(?:(?::${v6segment}){0,2}:${v4}|(?::${v6segment}){1,4}|:)| // 1:2:3::          1:2:3::5:6:7:8   1:2:3::8        1:2:3::5:6:7:1.2.3.4
+(?:${v6segment}:){2}(?:(?::${v6segment}){0,3}:${v4}|(?::${v6segment}){1,5}|:)| // 1:2::            1:2::4:5:6:7:8   1:2::8          1:2::4:5:6:7:1.2.3.4
+(?:${v6segment}:){1}(?:(?::${v6segment}){0,4}:${v4}|(?::${v6segment}){1,6}|:)| // 1::              1::3:4:5:6:7:8   1::8            1::3:4:5:6:7:1.2.3.4
+(?::(?:(?::${v6segment}){0,5}:${v4}|(?::${v6segment}){1,7}|:))             // ::2:3:4:5:6:7:8  ::2:3:4:5:6:7:8  ::8             ::1.2.3.4
+)(?:%[0-9a-zA-Z]{1,})?                                             // %eth0            %1
+`.replace(/\s*\/\/.*$/gm, "").replace(/\n/g, "").trim();
+var v46Exact = new RegExp(`(?:^${v4}$)|(?:^${v6}$)`);
+var v4exact = new RegExp(`^${v4}$`);
+var v6exact = new RegExp(`^${v6}$`);
+var ipRegex = (options2) => options2 && options2.exact ? v46Exact : new RegExp(`(?:${boundry(options2)}${v4}${boundry(options2)})|(?:${boundry(options2)}${v6}${boundry(options2)})`, "g");
+ipRegex.v4 = (options2) => options2 && options2.exact ? v4exact : new RegExp(`${boundry(options2)}${v4}${boundry(options2)}`, "g");
+ipRegex.v6 = (options2) => options2 && options2.exact ? v6exact : new RegExp(`${boundry(options2)}${v6}${boundry(options2)}`, "g");
+var ip_regex_default = ipRegex;
+
+// ../../node_modules/function-timeout/index.js
+var import_node_vm = __toESM(require("vm"), 1);
+function functionTimeout(function_, { timeout } = {}) {
+  const script = new import_node_vm.default.Script("returnValue = function_()");
+  const wrappedFunction = (...arguments_) => {
+    const context = {
+      function_: () => function_(...arguments_)
+    };
+    script.runInNewContext(context, { timeout });
+    return context.returnValue;
+  };
+  Object.defineProperty(wrappedFunction, "name", {
+    value: `functionTimeout(${function_.name || "<anonymous>"})`,
+    configurable: true
+  });
+  return wrappedFunction;
+}
+function isTimeoutError(error) {
+  return error?.code === "ERR_SCRIPT_EXECUTION_TIMEOUT";
+}
+
+// ../../node_modules/clone-regexp/node_modules/is-regexp/index.js
+var { toString: toString3 } = Object.prototype;
+function isRegexp(value) {
+  return toString3.call(value) === "[object RegExp]";
+}
+
+// ../../node_modules/clone-regexp/index.js
+var flagMap = {
+  global: "g",
+  ignoreCase: "i",
+  multiline: "m",
+  dotAll: "s",
+  sticky: "y",
+  unicode: "u"
+};
+function clonedRegexp(regexp, options2 = {}) {
+  if (!isRegexp(regexp)) {
+    throw new TypeError("Expected a RegExp instance");
+  }
+  const flags = Object.keys(flagMap).map((flag) => (typeof options2[flag] === "boolean" ? options2[flag] : regexp[flag]) ? flagMap[flag] : "").join("");
+  const clonedRegexp2 = new RegExp(options2.source || regexp.source, flags);
+  clonedRegexp2.lastIndex = typeof options2.lastIndex === "number" ? options2.lastIndex : regexp.lastIndex;
+  return clonedRegexp2;
+}
+
+// ../../node_modules/super-regex/index.js
+function isMatch(regex, string2, { timeout } = {}) {
+  try {
+    return functionTimeout(() => clonedRegexp(regex).test(string2), { timeout })();
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      return false;
+    }
+    throw error;
+  }
+}
+
+// ../../node_modules/is-ip/index.js
+var maxIPv4Length = 15;
+var maxIPv6Length = 45;
+var options = {
+  timeout: 400
+};
+function isIPv62(string2) {
+  if (string2.length > maxIPv6Length) {
+    return false;
+  }
+  return isMatch(ip_regex_default.v6({ exact: true }), string2, options);
+}
+function isIPv42(string2) {
+  if (string2.length > maxIPv4Length) {
+    return false;
+  }
+  return isMatch(ip_regex_default.v4({ exact: true }), string2, options);
+}
+
+// ../../node_modules/@multiformats/uri-to-multiaddr/dist/src/index.js
+var portFor = {
+  http: "80",
+  https: "443",
+  ws: "80",
+  wss: "443"
+};
+var BROWSER_SCHEMES = ["http", "https", "ws", "wss"];
+function uriToMultiaddr(uriStr, opts) {
+  opts = opts ?? {};
+  const defaultDnsType = opts.defaultDnsType ?? "dns";
+  const { scheme, hostname, port, path } = parseUri(uriStr);
+  const parts = [
+    tupleForHostname(hostname, defaultDnsType),
+    tupleForPort(port, scheme),
+    tupleForScheme(scheme)
+  ];
+  if (path != null) {
+    parts.push(tupleForPath(path));
+  }
+  const multiaddrStr = "/" + parts.filter((x) => Boolean(x)).reduce((a, b) => a.concat(b), []).join("/");
+  return multiaddr(multiaddrStr);
+}
+function parseUri(uriStr) {
+  const [scheme] = uriStr.split(":");
+  if (!BROWSER_SCHEMES.includes(scheme)) {
+    uriStr = "http" + uriStr.substring(scheme.length);
+  }
+  let { protocol, hostname, port, pathname, search } = new URL(uriStr);
+  if (port == null || port === "") {
+    const protocolPort = portForProtocol(scheme);
+    if (protocolPort != null) {
+      port = protocolPort;
+    }
+    if (protocolPort == null && protocol === "http:") {
+      port = "80";
+    }
+  }
+  let path;
+  if (pathname != null && pathname !== "" && pathname !== "/") {
+    if (pathname.startsWith("/")) {
+      pathname = pathname.substring(1);
+    }
+    path = pathname;
+  }
+  if (search != null && search !== "") {
+    path = path ?? "";
+    path += search;
+  }
+  return { scheme, hostname, port, path };
+}
+function tupleForHostname(hostname, defaultDnsType) {
+  if (hostname == null || hostname === "") {
+    return void 0;
+  }
+  if (isIPv42(hostname)) {
+    return ["ip4", hostname];
+  }
+  if (isIPv62(hostname)) {
+    return ["ip6", hostname];
+  }
+  if (hostname[0] === "[") {
+    const trimmed = hostname.substring(1, hostname.length - 1);
+    if (isIPv62(trimmed)) {
+      return ["ip6", trimmed];
+    }
+  }
+  return [defaultDnsType, hostname];
+}
+function tupleForPort(port, scheme) {
+  if (port == null || port === "") {
+    return void 0;
+  }
+  if (scheme === "udp") {
+    return ["udp", port];
+  }
+  return ["tcp", port];
+}
+function tupleForScheme(scheme) {
+  if (scheme.match(/^tcp$|^udp$/) != null) {
+    return void 0;
+  }
+  if (scheme === "https") {
+    return ["/tls/http"];
+  }
+  if (scheme === "wss") {
+    return ["/tls/ws"];
+  }
+  return [scheme];
+}
+function tupleForPath(path) {
+  if (path == null || path === "") {
+    return void 0;
+  }
+  return ["http-path", encodeURIComponent(path)];
+}
+function portForProtocol(protocol) {
+  if (protocol == null || protocol === "" || portFor[protocol] == null) {
+    return void 0;
+  }
+  return portFor[protocol];
+}
+
 // src/location.ts
-var import_multiaddr = require("@multiformats/multiaddr");
-var import_multiaddr_to_uri = require("@multiformats/multiaddr-to-uri");
-var import_uri_to_multiaddr = require("@multiformats/uri-to-multiaddr");
 var import_ed255193 = require("@noble/curves/ed25519");
-var import_basics3 = require("multiformats/basics");
 var import_viem5 = require("viem");
 var DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 var DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
@@ -9643,14 +12552,14 @@ async function fetchLocationRecord(registryUrl, subject, fetchFn = globalThis.fe
   }
   return validateLocationRecord(body.record);
 }
-async function resolveCloudLocation(subject, options = {}) {
+async function resolveCloudLocation(subject, options2 = {}) {
   validateSubject(subject);
-  const verifyRecords = options.verifyRecords ?? true;
+  const verifyRecords = options2.verifyRecords ?? true;
   const attempts = await Promise.all([
-    resolveExplicit(subject, options.explicitMultiaddrs),
-    resolveBlockchain(subject, options.blockchain, verifyRecords),
-    resolveCentralized(subject, options, verifyRecords),
-    resolveFallback(subject, options.fallbackMultiaddrs)
+    resolveExplicit(subject, options2.explicitMultiaddrs),
+    resolveBlockchain(subject, options2.blockchain, verifyRecords),
+    resolveCentralized(subject, options2, verifyRecords),
+    resolveFallback(subject, options2.fallbackMultiaddrs)
   ]);
   const winner = attempts.find((attempt) => attempt.candidate)?.candidate;
   if (!winner) {
@@ -9665,16 +12574,16 @@ async function resolveCloudLocation(subject, options = {}) {
     resolvedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function resolveTinyCloudHosts(subject, options = {}) {
+async function resolveTinyCloudHosts(subject, options2 = {}) {
   const location = await resolveCloudLocation(subject, {
-    explicitMultiaddrs: hostsToMultiaddrs(options.explicitHosts),
-    blockchain: options.blockchain,
-    centralizedRegistryUrl: options.registryUrl === null ? void 0 : options.registryUrl ?? DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
+    explicitMultiaddrs: hostsToMultiaddrs(options2.explicitHosts),
+    blockchain: options2.blockchain,
+    centralizedRegistryUrl: options2.registryUrl === null ? void 0 : options2.registryUrl ?? DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
     fallbackMultiaddrs: hostsToMultiaddrs(
-      options.fallbackHosts === null ? void 0 : options.fallbackHosts ?? [DEFAULT_TINYCLOUD_FALLBACK_HOST]
+      options2.fallbackHosts === null ? void 0 : options2.fallbackHosts ?? [DEFAULT_TINYCLOUD_FALLBACK_HOST]
     ),
-    fetch: options.fetch,
-    verifyRecords: options.verifyRecords
+    fetch: options2.fetch,
+    verifyRecords: options2.verifyRecords
   });
   return {
     hosts: location.multiaddrs.map((addr) => multiaddrToHttpUrl(addr)),
@@ -9682,7 +12591,7 @@ async function resolveTinyCloudHosts(subject, options = {}) {
   };
 }
 function multiaddrToHttpUrl(input) {
-  const uri = (0, import_multiaddr_to_uri.multiaddrToUri)((0, import_multiaddr.multiaddr)(input));
+  const uri = multiaddrToUri(multiaddr(input));
   if (!uri.startsWith("http://") && !uri.startsWith("https://")) {
     throw new LocationRecordValidationError(
       `multiaddr does not resolve to http/https: ${input}`
@@ -9695,7 +12604,7 @@ function httpUrlToMultiaddr(input) {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
     throw new LocationRecordValidationError("URL must use http or https");
   }
-  return (0, import_uri_to_multiaddr.uriToMultiaddr)(url.toString()).toString();
+  return uriToMultiaddr(url.toString()).toString();
 }
 function hostsToMultiaddrs(hosts) {
   if (hosts === void 0 || hosts.length === 0) {
@@ -9726,15 +12635,15 @@ async function resolveBlockchain(subject, resolver, verifyRecords) {
     );
   });
 }
-async function resolveCentralized(subject, options, verifyRecords) {
+async function resolveCentralized(subject, options2, verifyRecords) {
   return resolveAttempt("centralized", async () => {
-    if (!options.centralizedRegistryUrl) {
+    if (!options2.centralizedRegistryUrl) {
       return null;
     }
     const record = await fetchLocationRecord(
-      options.centralizedRegistryUrl,
+      options2.centralizedRegistryUrl,
       subject,
-      options.fetch
+      options2.fetch
     );
     return toCandidate(subject, "centralized", record, verifyRecords);
   });
@@ -9827,7 +12736,7 @@ function validateMultiaddrs(input) {
       );
     }
     try {
-      (0, import_multiaddr.multiaddr)(addr);
+      multiaddr(addr);
     } catch {
       throw new LocationRecordValidationError(`invalid multiaddr: ${addr}`);
     }
@@ -9874,7 +12783,7 @@ function ed25519PublicKeyFromDidKey2(did) {
       "did:key must use base58btc multibase"
     );
   }
-  const bytes = import_basics3.bases.base58btc.decode(identifier);
+  const bytes = bases.base58btc.decode(identifier);
   if (bytes.length === 34 && bytes[0] === 237 && bytes[1] === 1) {
     return bytes.slice(2);
   }
@@ -9886,31 +12795,31 @@ function ed25519PublicKeyFromDidKey2(did) {
   );
 }
 function base64UrlEncode3(bytes) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+  const alphabet2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
   for (let i = 0; i < bytes.length; i += 3) {
     const a = bytes[i];
     const b = bytes[i + 1];
     const c = bytes[i + 2];
     const triplet = a << 16 | (b ?? 0) << 8 | (c ?? 0);
-    output += alphabet[triplet >> 18 & 63];
-    output += alphabet[triplet >> 12 & 63];
+    output += alphabet2[triplet >> 18 & 63];
+    output += alphabet2[triplet >> 12 & 63];
     if (i + 1 < bytes.length) {
-      output += alphabet[triplet >> 6 & 63];
+      output += alphabet2[triplet >> 6 & 63];
     }
     if (i + 2 < bytes.length) {
-      output += alphabet[triplet & 63];
+      output += alphabet2[triplet & 63];
     }
   }
   return output;
 }
 function decodeBase64Url(value) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+  const alphabet2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   const bytes = [];
   let buffer = 0;
   let bits = 0;
   for (const char of value) {
-    const index = alphabet.indexOf(char);
+    const index = alphabet2.indexOf(char);
     if (index < 0) {
       throw new LocationRecordValidationError(
         "did:key signature must be base64url"
@@ -9946,6 +12855,7 @@ function decodeBase64Url(value) {
   CAPABILITY_REGISTRY,
   CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
+  CaveatedDelegationUnsupportedError,
   ClientSessionSchema,
   CloudLocationResolutionError,
   DECRYPT_ACTION,
@@ -9964,6 +12874,7 @@ function decodeBase64Url(value) {
   DUCKDB,
   DataVaultService,
   DatabaseHandle,
+  DecryptTransportResponseError,
   DelegationErrorCodes,
   DelegationManager,
   DuckDbAction,
@@ -10071,6 +12982,7 @@ function decodeBase64Url(value) {
   canonicalizeDidUrl,
   canonicalizeEncryptionJson,
   canonicalizeNetworkId,
+  canonicalizeRecapCaveats,
   canonicalizeSecretScope,
   canonicalizeSignedObjectUnsigned,
   checkDecryptInvocationInput,
@@ -10144,6 +13056,7 @@ function decodeBase64Url(value) {
   pkhDid,
   principalDid,
   principalDidEquals,
+  recapCaveatsEqual,
   resolveCloudLocation,
   resolveManifest,
   resolveManifestKnowledgeRoot,