@tinycloud/sdk-core 3.0.1-beta.0 → 3.1.0-beta.10

package/dist/index.cjs

@@ -73,13 +73,13 @@ __export(index_exports, {
   ClientSessionSchema: () => ClientSessionSchema,
   CloudLocationResolutionError: () => CloudLocationResolutionError,
   CredentialError: () => CredentialError,
-  DECRYPT_ACTION: () => import_sdk_services8.DECRYPT_ACTION,
-  DECRYPT_FACT_TYPE: () => import_sdk_services8.DECRYPT_FACT_TYPE,
-  DECRYPT_RESULT_TYPE: () => import_sdk_services8.DECRYPT_RESULT_TYPE,
+  DECRYPT_ACTION: () => import_sdk_services9.DECRYPT_ACTION,
+  DECRYPT_FACT_TYPE: () => import_sdk_services9.DECRYPT_FACT_TYPE,
+  DECRYPT_RESULT_TYPE: () => import_sdk_services9.DECRYPT_RESULT_TYPE,
   DEFAULT_DEFAULTS: () => DEFAULT_DEFAULTS,
-  DEFAULT_ENCRYPTION_ALG: () => import_sdk_services8.DEFAULT_ENCRYPTION_ALG,
+  DEFAULT_ENCRYPTION_ALG: () => import_sdk_services9.DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY: () => DEFAULT_EXPIRY,
-  DEFAULT_KEY_VERSION: () => import_sdk_services8.DEFAULT_KEY_VERSION,
+  DEFAULT_KEY_VERSION: () => import_sdk_services9.DEFAULT_KEY_VERSION,
   DEFAULT_KNOWLEDGE_ROOT: () => DEFAULT_KNOWLEDGE_ROOT,
   DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY: () => DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY,
   DEFAULT_LOCAL_NODE_URL: () => DEFAULT_LOCAL_NODE_URL,
@@ -90,36 +90,36 @@ __export(index_exports, {
   DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL: () => DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
   DELIVERY_ADMISSION_DOMAIN: () => DELIVERY_ADMISSION_DOMAIN,
   DUCKDB: () => import_bootstrap4.DUCKDB,
-  DataVaultService: () => import_sdk_services8.DataVaultService,
-  DatabaseHandle: () => import_sdk_services8.DatabaseHandle,
-  DecryptTransportResponseError: () => import_sdk_services8.DecryptTransportResponseError,
+  DataVaultService: () => import_sdk_services9.DataVaultService,
+  DatabaseHandle: () => import_sdk_services9.DatabaseHandle,
+  DecryptTransportResponseError: () => import_sdk_services9.DecryptTransportResponseError,
   DelegationErrorCodes: () => DelegationErrorCodes,
   DelegationManager: () => DelegationManager,
-  DuckDbAction: () => import_sdk_services8.DuckDbAction,
-  DuckDbDatabaseHandle: () => import_sdk_services8.DuckDbDatabaseHandle,
-  DuckDbService: () => import_sdk_services8.DuckDbService,
+  DuckDbAction: () => import_sdk_services9.DuckDbAction,
+  DuckDbDatabaseHandle: () => import_sdk_services9.DuckDbDatabaseHandle,
+  DuckDbService: () => import_sdk_services9.DuckDbService,
   ED25519_JCS_SIGNATURE_SUITE: () => ED25519_JCS_SIGNATURE_SUITE,
   EIP191_JCS_SIGNATURE_SUITE: () => EIP191_JCS_SIGNATURE_SUITE,
   EMAIL_CREDENTIAL_MAX_AGE_SECONDS: () => EMAIL_CREDENTIAL_MAX_AGE_SECONDS,
   EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS: () => EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS,
   ENCRYPTION: () => import_bootstrap4.ENCRYPTION,
   ENCRYPTION_MANIFEST_SPACE: () => ENCRYPTION_MANIFEST_SPACE,
-  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_services8.ENCRYPTION_NETWORK_URN_PREFIX,
+  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_services9.ENCRYPTION_NETWORK_URN_PREFIX,
   ENCRYPTION_PERMISSION_SERVICE: () => ENCRYPTION_PERMISSION_SERVICE,
-  ENCRYPTION_SERVICE: () => import_sdk_services8.ENCRYPTION_SERVICE,
-  ENCRYPTION_SERVICE_SHORT: () => import_sdk_services8.ENCRYPTION_SERVICE_SHORT,
-  ENVELOPE_VERSION: () => import_sdk_services8.ENVELOPE_VERSION,
+  ENCRYPTION_SERVICE: () => import_sdk_services9.ENCRYPTION_SERVICE,
+  ENCRYPTION_SERVICE_SHORT: () => import_sdk_services9.ENCRYPTION_SERVICE_SHORT,
+  ENVELOPE_VERSION: () => import_sdk_services9.ENVELOPE_VERSION,
   EXPIRY: () => EXPIRY,
-  EncryptionService: () => import_sdk_services8.EncryptionService,
+  EncryptionService: () => import_sdk_services9.EncryptionService,
   EnsDataSchema: () => EnsDataSchema,
-  ErrorCodes: () => import_sdk_services8.ErrorCodes,
+  ErrorCodes: () => import_sdk_services9.ErrorCodes,
   HOLDER_BINDING_DOMAIN: () => HOLDER_BINDING_DOMAIN,
   HOLDER_KEY_BINDING_PRESENTATION_SCHEMA: () => HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,
   HOOKS: () => import_bootstrap4.HOOKS,
-  HooksService: () => import_sdk_services8.HooksService,
+  HooksService: () => import_sdk_services9.HooksService,
   IdentityParseError: () => IdentityParseError,
   KV: () => import_bootstrap4.KV,
-  KVService: () => import_sdk_services8.KVService,
+  KVService: () => import_sdk_services9.KVService,
   LAST_V2_CREATE_AT: () => LAST_V2_CREATE_AT,
   LAST_V2_READ_AT: () => LAST_V2_READ_AT,
   LISTEN_SQL_STATEMENT_CATALOG: () => LISTEN_SQL_STATEMENT_CATALOG,
@@ -138,8 +138,8 @@ __export(index_exports, {
   MemorySenderShareRecordStorage: () => MemorySenderShareRecordStorage,
   MemoryShareCache: () => MemoryShareCache,
   NATIVE_PROJECTION_V1_DOMAIN: () => NATIVE_PROJECTION_V1_DOMAIN,
-  NETWORK_NAME_PATTERN: () => import_sdk_services8.NETWORK_NAME_PATTERN,
-  NetworkIdError: () => import_sdk_services8.NetworkIdError,
+  NETWORK_NAME_PATTERN: () => import_sdk_services9.NETWORK_NAME_PATTERN,
+  NetworkIdError: () => import_sdk_services9.NetworkIdError,
   OPENKEY_ACTION_ID_SEPARATOR: () => OPENKEY_ACTION_ID_SEPARATOR,
   OWNER_NODE_BINDING_TIMEOUT_MS: () => OWNER_NODE_BINDING_TIMEOUT_MS,
   OpenKeyManageKeyError: () => OpenKeyManageKeyError,
@@ -166,7 +166,7 @@ __export(index_exports, {
   POLICY_V2_SCHEMA: () => POLICY_V2_SCHEMA,
   PORTABLE_DELEGATION_SCHEMA: () => PORTABLE_DELEGATION_SCHEMA,
   PermissionNotInManifestError: () => PermissionNotInManifestError,
-  PrefixedKVService: () => import_sdk_services8.PrefixedKVService,
+  PrefixedKVService: () => import_sdk_services9.PrefixedKVService,
   ProtocolMismatchError: () => ProtocolMismatchError,
   REQUESTER_ENGINE_RETRY_ATTEMPTS: () => REQUESTER_ENGINE_RETRY_ATTEMPTS,
   REQUESTER_ENGINE_RETRY_MAX_DELAY_MS: () => REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,
@@ -177,17 +177,19 @@ __export(index_exports, {
   ROOT_STATUS_RENEWAL_V1_DOMAIN: () => ROOT_STATUS_RENEWAL_V1_DOMAIN,
   ROOT_STATUS_V1_DOMAIN: () => ROOT_STATUS_V1_DOMAIN,
   SECRETS_SPACE: () => SECRETS_SPACE,
-  SECRET_NAME_RE: () => import_sdk_services8.SECRET_NAME_RE,
+  SECRET_NAME_RE: () => import_sdk_services9.SECRET_NAME_RE,
   SECRET_RECORDS_SCHEMA: () => import_bootstrap4.SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT: () => SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG: () => SERVICE_SHORT_TO_LONG,
   SPACE: () => import_bootstrap4.SPACE,
   SQL: () => import_bootstrap4.SQL,
-  SQLAction: () => import_sdk_services8.SQLAction,
-  SQLService: () => import_sdk_services8.SQLService,
-  SecretsService: () => import_sdk_services8.SecretsService,
+  SQLAction: () => import_sdk_services9.SQLAction,
+  SQLService: () => import_sdk_services9.SQLService,
+  STORAGE_FULL_MESSAGE: () => import_sdk_services9.STORAGE_FULL_MESSAGE,
+  STORAGE_WRITE_TOO_LARGE_MESSAGE: () => import_sdk_services9.STORAGE_WRITE_TOO_LARGE_MESSAGE,
+  SecretsService: () => import_sdk_services9.SecretsService,
   SenderShareStore: () => SenderShareStore,
-  ServiceContext: () => import_sdk_services8.ServiceContext,
+  ServiceContext: () => import_sdk_services9.ServiceContext,
   SessionExpiredError: () => SessionExpiredError,
   ShareAccessError: () => ShareAccessError,
   ShareAddressedDelegationEnvelopeV2Schema: () => ShareAddressedDelegationEnvelopeV2Schema,
@@ -220,14 +222,14 @@ __export(index_exports, {
   TINYCLOUD_PUBLIC_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_PUBLIC_SPACE_MANIFEST,
   TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST: () => import_bootstrap4.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud: () => TinyCloud,
-  TinyCloudDebugLogger: () => import_sdk_services8.TinyCloudDebugLogger,
+  TinyCloudDebugLogger: () => import_sdk_services9.TinyCloudDebugLogger,
   TranscriptRequester: () => TranscriptRequester,
   TranscriptRequesterError: () => TranscriptRequesterError,
   UnsupportedFeatureError: () => UnsupportedFeatureError,
   UnsupportedSignatureSuiteError: () => UnsupportedSignatureSuiteError,
   VAULT_PERMISSION_SERVICE: () => VAULT_PERMISSION_SERVICE,
-  VaultHeaders: () => import_sdk_services8.VaultHeaders,
-  VaultPublicSpaceKVActions: () => import_sdk_services8.VaultPublicSpaceKVActions,
+  VaultHeaders: () => import_sdk_services9.VaultHeaders,
+  VaultPublicSpaceKVActions: () => import_sdk_services9.VaultPublicSpaceKVActions,
   VersionCheckError: () => VersionCheckError,
   actionContains: () => actionContains,
   activateSessionWithHost: () => activateSessionWithHost,
@@ -235,36 +237,37 @@ __export(index_exports, {
   admitPolicyCredentialV3: () => admitPolicyCredentialV3,
   admitPolicyCredentialV4: () => admitPolicyCredentialV4,
   applyPrefix: () => applyPrefix,
+  authorizationVerdictOf: () => import_sdk_services9.authorizationVerdictOf,
   bootstrapEncryptionNetworkId: () => import_bootstrap4.bootstrapEncryptionNetworkId,
   bootstrapSpaceId: () => import_bootstrap4.bootstrapSpaceId,
   bootstrapSteps: () => import_bootstrap4.bootstrapSteps,
-  buildCanonicalDecryptRequest: () => import_sdk_services8.buildCanonicalDecryptRequest,
-  buildDecryptAttenuation: () => import_sdk_services8.buildDecryptAttenuation,
-  buildDecryptFacts: () => import_sdk_services8.buildDecryptFacts,
-  buildDecryptInvocation: () => import_sdk_services8.buildDecryptInvocation,
-  buildNetworkId: () => import_sdk_services8.buildNetworkId,
+  buildCanonicalDecryptRequest: () => import_sdk_services9.buildCanonicalDecryptRequest,
+  buildDecryptAttenuation: () => import_sdk_services9.buildDecryptAttenuation,
+  buildDecryptFacts: () => import_sdk_services9.buildDecryptFacts,
+  buildDecryptInvocation: () => import_sdk_services9.buildDecryptInvocation,
+  buildNetworkId: () => import_sdk_services9.buildNetworkId,
   buildPolicyCredentialPresentationV3: () => buildPolicyCredentialPresentationV3,
   buildPolicyCredentialPresentationV4: () => buildPolicyCredentialPresentationV4,
   buildSpaceUri: () => buildSpaceUri,
   canonicalDigest: () => canonicalDigest,
   canonicalEmailDomain: () => import_share_envelope.canonicalEmailDomain,
-  canonicalHashHex: () => import_sdk_services8.canonicalHashHex,
+  canonicalHashHex: () => import_sdk_services9.canonicalHashHex,
   canonicalLocationPayload: () => canonicalLocationPayload,
   canonicalMailbox: () => import_share_envelope.canonicalMailbox,
   canonicalOwnerSharePolicy: () => canonicalOwnerSharePolicy,
-  canonicalSignedResponse: () => import_sdk_services8.canonicalSignedResponse,
+  canonicalSignedResponse: () => import_sdk_services9.canonicalSignedResponse,
   canonicalizeAddress: () => canonicalizeAddress,
   canonicalizeDid: () => canonicalizeDid,
   canonicalizeDidUrl: () => canonicalizeDidUrl,
-  canonicalizeEncryptionJson: () => import_sdk_services8.canonicalizeEncryptionJson,
+  canonicalizeEncryptionJson: () => import_sdk_services9.canonicalizeEncryptionJson,
   canonicalizeNetworkId: () => canonicalizeNetworkId,
   canonicalizeRecapCaveats: () => canonicalizeRecapCaveats,
-  canonicalizeSecretScope: () => import_sdk_services8.canonicalizeSecretScope,
+  canonicalizeSecretScope: () => import_sdk_services9.canonicalizeSecretScope,
   canonicalizeSignedObjectUnsigned: () => canonicalizeSignedObjectUnsigned,
   canonicalizeUnifiedPolicyCapability: () => canonicalizeUnifiedPolicyCapability,
-  checkDecryptInvocationInput: () => import_sdk_services8.checkDecryptInvocationInput,
+  checkDecryptInvocationInput: () => import_sdk_services9.checkDecryptInvocationInput,
   checkNodeInfo: () => checkNodeInfo,
-  clearTinyCloudDebugLogs: () => import_sdk_services8.clearTinyCloudDebugLogs,
+  clearTinyCloudDebugLogs: () => import_sdk_services9.clearTinyCloudDebugLogs,
   compactAttenuationContains: () => compactAttenuationContains,
   composeBootstrapSpaceManifest: () => import_bootstrap4.composeBootstrapSpaceManifest,
   composeManifestRequest: () => composeManifestRequest,
@@ -293,7 +296,7 @@ __export(index_exports, {
   createStorageReceipt: () => createStorageReceipt,
   createStoredCredentialRecord: () => createStoredCredentialRecord,
   createTranscriptRequester: () => createTranscriptRequester,
-  createVaultCrypto: () => import_sdk_services8.createVaultCrypto,
+  createVaultCrypto: () => import_sdk_services9.createVaultCrypto,
   credentialEndpointPath: () => credentialEndpointPath,
   credentialError: () => credentialError,
   credentialIndexKey: () => credentialIndexKey,
@@ -301,37 +304,37 @@ __export(index_exports, {
   credentialRecordKey: () => credentialRecordKey,
   credentialRequirementDigest: () => credentialRequirementDigest,
   decodeBase64Url: () => decodeBase64Url,
-  decryptEnvelopeWithKey: () => import_sdk_services8.decryptEnvelopeWithKey,
+  decryptEnvelopeWithKey: () => import_sdk_services9.decryptEnvelopeWithKey,
   decryptShareBytesAsync: () => decryptShareBytesAsync,
-  defaultRetryPolicy: () => import_sdk_services8.defaultRetryPolicy,
+  defaultRetryPolicy: () => import_sdk_services9.defaultRetryPolicy,
   defaultSignStrategy: () => defaultSignStrategy,
   defaultSpaceCreationHandler: () => defaultSpaceCreationHandler,
   delegatePortablePolicySession: () => delegatePortablePolicySession,
   deriveDelegationCid: () => deriveDelegationCid,
   deriveSignedObjectMaterial: () => deriveSignedObjectMaterial,
-  deriveSignedReceiverKey: () => import_sdk_services8.deriveSignedReceiverKey,
+  deriveSignedReceiverKey: () => import_sdk_services9.deriveSignedReceiverKey,
   descriptorSatisfiesRequirement: () => descriptorSatisfiesRequirement,
   didCacheKey: () => didCacheKey,
   didEquals: () => didEquals,
   diffImmutableSiweFields: () => diffImmutableSiweFields,
-  disableTinyCloudDebug: () => import_sdk_services8.disableTinyCloudDebug,
+  disableTinyCloudDebug: () => import_sdk_services9.disableTinyCloudDebug,
   discoverLocalTinyCloudNode: () => discoverLocalTinyCloudNode,
-  discoverNetwork: () => import_sdk_services8.discoverNetwork,
-  enableTinyCloudDebug: () => import_sdk_services8.enableTinyCloudDebug,
+  discoverNetwork: () => import_sdk_services9.discoverNetwork,
+  enableTinyCloudDebug: () => import_sdk_services9.enableTinyCloudDebug,
   encodeBase64Url: () => encodeBase64Url,
   encodeInlineShareUrl: () => encodeInlineShareUrl,
   encodeShareArtifact: () => encodeShareArtifact,
   encodeShareUrl: () => encodeShareUrl,
   encryptShareBytes: () => encryptShareBytes,
   encryptShareBytesAsync: () => encryptShareBytesAsync,
-  encryptToNetwork: () => import_sdk_services8.encryptToNetwork,
-  encryptionBase64Decode: () => import_sdk_services8.base64Decode,
-  encryptionBase64Encode: () => import_sdk_services8.base64Encode,
-  encryptionError: () => import_sdk_services8.encryptionError,
-  encryptionUtf8Decode: () => import_sdk_services8.utf8Decode,
-  encryptionUtf8Encode: () => import_sdk_services8.utf8Encode,
-  ensureNetworkUsableForDecrypt: () => import_sdk_services8.ensureNetworkUsableForDecrypt,
-  err: () => import_sdk_services8.err,
+  encryptToNetwork: () => import_sdk_services9.encryptToNetwork,
+  encryptionBase64Decode: () => import_sdk_services9.base64Decode,
+  encryptionBase64Encode: () => import_sdk_services9.base64Encode,
+  encryptionError: () => import_sdk_services9.encryptionError,
+  encryptionUtf8Decode: () => import_sdk_services9.utf8Decode,
+  encryptionUtf8Encode: () => import_sdk_services9.utf8Encode,
+  ensureNetworkUsableForDecrypt: () => import_sdk_services9.ensureNetworkUsableForDecrypt,
+  err: () => import_sdk_services9.err,
   expandActionShortNames: () => expandActionShortNames,
   expandPermissionEntries: () => expandPermissionEntries,
   expandPermissionEntry: () => expandPermissionEntry,
@@ -339,24 +342,27 @@ __export(index_exports, {
   extractRecapAttenuations: () => extractRecapAttenuations,
   fetchLocationRecord: () => fetchLocationRecord,
   fetchPeerId: () => fetchPeerId,
-  generateRandomReceiverKey: () => import_sdk_services8.generateRandomReceiverKey,
+  generateRandomReceiverKey: () => import_sdk_services9.generateRandomReceiverKey,
   getPolicyRootStatusV3: () => getPolicyRootStatusV3,
-  getTinyCloudDebugLogs: () => import_sdk_services8.getTinyCloudDebugLogs,
+  getTinyCloudDebugLogs: () => import_sdk_services9.getTinyCloudDebugLogs,
   hasTinyCloudManageKeyScope: () => hasTinyCloudManageKeyScope,
-  hexDecode: () => import_sdk_services8.hexDecode,
-  hexEncode: () => import_sdk_services8.hexEncode,
+  hexDecode: () => import_sdk_services9.hexDecode,
+  hexEncode: () => import_sdk_services9.hexEncode,
   holderBindingCanonicalBytes: () => holderBindingCanonicalBytes,
   holderBindingSigningBytes: () => holderBindingSigningBytes,
+  httpResponseError: () => httpResponseError,
   httpUrlToMultiaddr: () => httpUrlToMultiaddr,
   importPortableDelegation: () => importPortableDelegation,
-  installTinyCloudDebugGlobals: () => import_sdk_services8.installTinyCloudDebugGlobals,
+  installTinyCloudDebugGlobals: () => import_sdk_services9.installTinyCloudDebugGlobals,
   intersectShareCapabilities: () => intersectShareCapabilities,
   isCanonicalEmailDomain: () => import_share_envelope.isCanonicalEmailDomain,
   isCapabilitySubset: () => isCapabilitySubset,
   isDigest: () => isDigest,
   isEvmAddress: () => isEvmAddress,
-  isNetworkId: () => import_sdk_services8.isNetworkId,
+  isExplicitOnlyAction: () => isExplicitOnlyAction,
+  isNetworkId: () => import_sdk_services9.isNetworkId,
   isPlausibleOpenKeyActionId: () => isPlausibleOpenKeyActionId,
+  isStorageFullError: () => import_sdk_services9.isStorageFullError,
   isV2ShareLink: () => isV2ShareLink,
   issuedCredentialEnvelopeFromVerified: () => issuedCredentialEnvelopeFromVerified,
   jcsCanonicalize: () => jcsCanonicalize,
@@ -367,28 +373,29 @@ __export(index_exports, {
   makePublicSpaceId: () => makePublicSpaceId,
   manifestAbilitiesUnion: () => manifestAbilitiesUnion,
   multiaddrToHttpUrl: () => multiaddrToHttpUrl,
-  networkDiscoveryKey: () => import_sdk_services8.networkDiscoveryKey,
+  networkDiscoveryKey: () => import_sdk_services9.networkDiscoveryKey,
   normalizeDefaults: () => normalizeDefaults,
   normalizeJson: () => normalizeJson,
   normalizeShareActions: () => normalizeShareActions,
   normalizeShareRecipientTarget: () => normalizeShareRecipientTarget,
   normalizeShareResource: () => normalizeShareResource,
   normalizeUnifiedPolicyCapability: () => normalizeUnifiedPolicyCapability,
-  ok: () => import_sdk_services8.ok,
-  openWrappedKey: () => import_sdk_services8.openWrappedKey,
+  ok: () => import_sdk_services9.ok,
+  openWrappedKey: () => import_sdk_services9.openWrappedKey,
   parseCanonicalNetworkId: () => parseCanonicalNetworkId,
   parseCanonicalRecapResource: () => parseCanonicalRecapResource,
   parseCanonicalTinyCloudIdentity: () => parseCanonicalTinyCloudIdentity,
   parseCanonicalTinyCloudIdentityClaims: () => parseCanonicalTinyCloudIdentityClaims,
+  parseCapabilityResource: () => import_sdk_services9.parseCapabilityResource,
   parseCompactUcanAuthorization: () => parseCompactUcanAuthorization,
   parseExpiry: () => parseExpiry,
-  parseNetworkId: () => import_sdk_services8.parseNetworkId,
+  parseNetworkId: () => import_sdk_services9.parseNetworkId,
   parseNodeNativePortableDelegation: () => parseNodeNativePortableDelegation,
   parsePkhDid: () => parsePkhDid,
   parsePolicySessionUcan: () => parsePolicySessionUcan,
   parsePortableDelegation: () => parsePortableDelegation,
   parseRecapCapabilities: () => parseRecapCapabilities,
-  parseSecretCatalogKey: () => import_sdk_services8.parseSecretCatalogKey,
+  parseSecretCatalogKey: () => import_sdk_services9.parseSecretCatalogKey,
   parseShareArtifact: () => parseShareArtifact,
   parseShareUrl: () => parseShareUrl,
   parseSpaceUri: () => parseSpaceUri,
@@ -409,8 +416,8 @@ __export(index_exports, {
   resolveCloudLocation: () => resolveCloudLocation,
   resolveManifest: () => resolveManifest,
   resolveManifestKnowledgeRoot: () => resolveManifestKnowledgeRoot,
-  resolveSecretListPrefix: () => import_sdk_services8.resolveSecretListPrefix,
-  resolveSecretPath: () => import_sdk_services8.resolveSecretPath,
+  resolveSecretListPrefix: () => import_sdk_services9.resolveSecretListPrefix,
+  resolveSecretPath: () => import_sdk_services9.resolveSecretPath,
   resolveTinyCloudHosts: () => resolveTinyCloudHosts,
   resourceCapabilitiesToAbilitiesMap: () => resourceCapabilitiesToAbilitiesMap,
   resourceCapabilitiesToSpaceAbilitiesMap: () => resourceCapabilitiesToSpaceAbilitiesMap,
@@ -418,7 +425,7 @@ __export(index_exports, {
   revokePolicyRootV3: () => revokePolicyRootV3,
   serializeJcsJson: () => serialize,
   serializePortableDelegation: () => serializePortableDelegation,
-  serviceError: () => import_sdk_services8.serviceError,
+  serviceError: () => import_sdk_services9.serviceError,
   sha256Base64Url: () => sha256Base64Url,
   shareCapabilityAllows: () => shareCapabilityAllows,
   signCompactPolicyDescendant: () => signCompactPolicyDescendant,
@@ -429,7 +436,7 @@ __export(index_exports, {
   signShareEnvelope: () => signShareEnvelope,
   signedObjectIdFor: () => signedObjectIdFor,
   submitHostDelegation: () => submitHostDelegation,
-  tinyCloudDebugLogger: () => import_sdk_services8.tinyCloudDebugLogger,
+  tinyCloudDebugLogger: () => import_sdk_services9.tinyCloudDebugLogger,
   toSignedObjectError: () => toSignedObjectError,
   unauthorizedRecapCapabilities: () => unauthorizedRecapCapabilities,
   unifiedNativeProjectionHashHex: () => unifiedNativeProjectionHashHex,
@@ -441,7 +448,7 @@ __export(index_exports, {
   validateCredentialFlowDescriptor: () => validateCredentialFlowDescriptor,
   validateCredentialHolderBinding: () => validateCredentialHolderBinding,
   validateCredentialRequirement: () => validateCredentialRequirement,
-  validateEnvelope: () => import_sdk_services8.validateEnvelope,
+  validateEnvelope: () => import_sdk_services9.validateEnvelope,
   validateLocationRecord: () => validateLocationRecord,
   validateLocationRecordPayload: () => validateLocationRecordPayload,
   validateManifest: () => validateManifest,
@@ -460,7 +467,8 @@ __export(index_exports, {
   validatePolicyUnsigned: () => validatePolicyUnsigned,
   validateShareDeliveryAuthorizationV3Bytes: () => validateShareDeliveryAuthorizationV3Bytes,
   validateUnifiedPolicyV2: () => validateUnifiedPolicyV2,
-  verifyDecryptResponse: () => import_sdk_services8.verifyDecryptResponse,
+  validatedCapabilityOf: () => import_sdk_services9.validatedCapabilityOf,
+  verifyDecryptResponse: () => import_sdk_services9.verifyDecryptResponse,
   verifyDidKeyEd25519Signature: () => verifyDidKeyEd25519Signature,
   verifyEip191MessageSignature: () => verifyEip191MessageSignature,
   verifyIssuedCredential: () => verifyIssuedCredential,
@@ -3902,6 +3910,32 @@ var import_sha256 = require("@noble/hashes/sha256");
 var import_blake3 = require("@noble/hashes/blake3");
 var import_ed255193 = require("@noble/curves/ed25519");
 var import_zod2 = require("zod");
+
+// src/http-error.ts
+var import_sdk_services = require("@tinycloud/sdk-services");
+async function httpResponseError(response, context) {
+  let body;
+  try {
+    body = await response.text();
+  } catch {
+    body = response.statusText;
+  }
+  body = body.trim().slice(0, 512);
+  return Object.assign(new Error(`${context}: HTTP ${response.status}${body ? ` - ${body}` : ""}`), {
+    status: response.status
+  });
+}
+async function serviceHttpError(response, code3, context, service) {
+  const failure = await httpResponseError(response, context);
+  return (0, import_sdk_services.serviceError)(
+    response.status === 401 || response.status === 403 ? import_sdk_services.ErrorCodes.AUTH_UNAUTHORIZED : code3,
+    failure.message,
+    service,
+    { meta: { status: response.status } }
+  );
+}
+
+// src/policy/unified.ts
 var POLICY_V1_SCHEMA = "xyz.tinycloud.policy/policy/v1";
 var POLICY_CAPABILITY_V1_SCHEMA = "xyz.tinycloud.policy/capability/v1";
 var POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA = "xyz.tinycloud.policy/enforcement-delegation/v2";
@@ -3929,7 +3963,7 @@ async function requestPolicyChallengeV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ policyCid: input.policyCid, recipientDid: input.recipientDid, requestedCapabilities: input.requestedCapabilities.map(normalizeUnifiedPolicyCapability) })
   });
-  if (!response.ok) throw new Error(`policy challenge rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy challenge rejected");
   const value = object2(await response.json(), "policy challenge");
   if (typeof value.challengeId !== "string" || typeof value.nonce !== "string" || value.policyCid !== input.policyCid || value.recipientDid !== input.recipientDid)
     throw new Error("policy challenge binding is invalid");
@@ -3992,7 +4026,7 @@ async function getPolicyRootStatusV3(input) {
     redirect: "error",
     headers: { accept: "application/json" }
   });
-  if (!response.ok) throw new Error(`policy root status rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root status rejected");
   const value = object2(await response.json(), "policy root status");
   const checkpoint = object2(value.checkpoint, "policy root checkpoint");
   if (value.rootCid !== input.rootCid || value.state !== "active" && value.state !== "revoked" || value.state !== checkpoint.state || !verifyPolicyRootStatusCheckpointV3({ rootCid: input.rootCid, checkpoint, expectedNodeAudience: input.expectedNodeAudience, now: input.now }))
@@ -4052,9 +4086,12 @@ async function renewPolicyRootStatusV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ rootCid: input.rootCid, renewal: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.ownerDid, value: encodeBase64Url2(signature) } } })
   });
-  if (!response.ok) throw new Error(`policy root renewal rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root renewal rejected");
   return object2(await response.json(), "policy root renewal");
 }
+function rfc3339Seconds(value) {
+  return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(/\.000Z$/, "Z");
+}
 async function revokePolicyRootV3(input) {
   if (input.reason.length === 0) throw new Error("policy root revocation reason is required");
   const unsigned = {
@@ -4063,7 +4100,7 @@ async function revokePolicyRootV3(input) {
     targetRole: input.targetRole,
     ownerDid: input.ownerDid,
     nodeAudience: input.nodeAudience,
-    revokedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    revokedAt: rfc3339Seconds(input.now ?? /* @__PURE__ */ new Date()),
     reason: input.reason,
     issuerDid: input.issuerDid
   };
@@ -4076,7 +4113,7 @@ async function revokePolicyRootV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ revocation: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.issuerDid, value: encodeBase64Url2(signature) } } })
   });
-  if (!response.ok) throw new Error(`policy root revocation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root revocation rejected");
   return object2(await response.json(), "policy root revocation");
 }
 var POLICY_SESSION_FACT_KEYS = [
@@ -4345,7 +4382,7 @@ async function registerPolicyV3(input) {
     }
   );
   if (!bindingResponse.ok) {
-    throw new Error(`policy enforcer binding rejected (${bindingResponse.status})`);
+    throw await httpResponseError(bindingResponse, "policy enforcer binding rejected");
   }
   const binding = exactObject(
     await bindingResponse.json(),
@@ -4411,7 +4448,7 @@ async function registerPolicyV3(input) {
     }
   );
   if (!response.ok) {
-    throw new Error(`policy registration rejected (${response.status})`);
+    throw await httpResponseError(response, "policy registration rejected");
   }
   const receipt = exactObject(
     await response.json(),
@@ -4814,7 +4851,7 @@ function date(value, label) {
   if (!Number.isFinite(Date.parse(text2))) throw new Error(`${label} is invalid`);
   return text2;
 }
-function rfc3339Seconds(value) {
+function rfc3339Seconds2(value) {
   return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(/\.000Z$/, "Z");
 }
 function validateUnifiedPolicyV2(value, expectedPolicyCid) {
@@ -4979,8 +5016,8 @@ async function buildPolicyCredentialPresentationV4(input) {
     requirementDigest,
     descriptorDigest: input.credential.descriptorDigest,
     requestedCapabilities: Object.freeze(requestedCapabilities),
-    issuedAt: rfc3339Seconds(now),
-    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+    issuedAt: rfc3339Seconds2(now),
+    expiresAt: rfc3339Seconds2(new Date(expiresAtMs))
   }), input.sign);
 }
 async function buildPolicyCredentialPresentationV3(input) {
@@ -5034,8 +5071,8 @@ async function buildPolicyCredentialPresentationV3(input) {
     requirementDigest,
     descriptorDigest: input.credential.descriptorDigest,
     requestedCapabilities: Object.freeze(requestedCapabilities),
-    issuedAt: rfc3339Seconds(now),
-    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+    issuedAt: rfc3339Seconds2(now),
+    expiresAt: rfc3339Seconds2(new Date(expiresAtMs))
   });
   const digest4 = (0, import_sha2562.sha256)(
     new TextEncoder().encode(
@@ -5097,7 +5134,7 @@ async function admitPolicyCredentialV3(input) {
     requestedSessionExpiry(input.requestedExpiresAt, policy),
     input.signal
   );
-  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy delegation rejected");
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") {
     throw new Error("policy delegation response is invalid");
@@ -5150,7 +5187,7 @@ async function admitPolicyCredentialV4(input) {
     requestedSessionExpiry(input.requestedExpiresAt, policy),
     input.signal
   );
-  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy delegation rejected");
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") throw new Error("policy delegation response is invalid");
   const session = parsePolicySessionUcan(value.authorization, [
@@ -5169,7 +5206,7 @@ async function admitPolicyCredentialV4(input) {
     signal: input.signal,
     headers: { Authorization: session.authorization }
   });
-  if (!importResponse.ok) throw new Error(`delegation import rejected (${importResponse.status})`);
+  if (!importResponse.ok) throw await httpResponseError(importResponse, "delegation import rejected");
   input.signal?.throwIfAborted();
   return Object.freeze({ challenge, presentation, session, delegationImported: true });
 }
@@ -7753,7 +7790,7 @@ function validateEncodedShareData(data) {
 // src/manifest.ts
 var import_ms = __toESM(require("ms"), 1);
 var import_bootstrap2 = require("@tinycloud/bootstrap");
-var import_sdk_services = require("@tinycloud/sdk-services");
+var import_sdk_services2 = require("@tinycloud/sdk-services");
 var DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
 var ManifestValidationError = class extends Error {
   constructor(message) {
@@ -8024,13 +8061,13 @@ function validateManifestSecrets(secrets) {
     throw new ManifestValidationError("manifest.secrets must be an object");
   }
   for (const [name2, spec] of Object.entries(secrets)) {
-    if (!import_sdk_services.SECRET_NAME_RE.test(name2)) {
+    if (!import_sdk_services2.SECRET_NAME_RE.test(name2)) {
       throw new ManifestValidationError(
-        `manifest.secrets.${name2} must match ${import_sdk_services.SECRET_NAME_RE.source}`
+        `manifest.secrets.${name2} must match ${import_sdk_services2.SECRET_NAME_RE.source}`
       );
     }
     try {
-      (0, import_sdk_services.resolveSecretPath)(
+      (0, import_sdk_services2.resolveSecretPath)(
         secretNameFromSpec(name2, spec),
         { scope: secretScopeFromSpec(spec) }
       );
@@ -8247,7 +8284,7 @@ function secretEntriesForManifest(secrets) {
   const entries = [];
   for (const [name2, spec] of Object.entries(secrets)) {
     const actions = secretActionsFromSpec(name2, spec);
-    const secretPath = (0, import_sdk_services.resolveSecretPath)(
+    const secretPath = (0, import_sdk_services2.resolveSecretPath)(
       secretNameFromSpec(name2, spec),
       { scope: secretScopeFromSpec(spec) }
     );
@@ -8625,8 +8662,17 @@ function canonicalizeRecapCaveats(caveats) {
   }
   return `[${branches.join(",")}]`;
 }
+var EXPLICIT_ONLY_ACTIONS = {
+  "tinycloud.kv/sync": true,
+  "tinycloud.kv/retain": true
+};
+function isExplicitOnlyAction(action) {
+  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);
+}
 function actionContains(grantedAction, requestedAction) {
-  if (grantedAction === "*" || grantedAction === requestedAction) return true;
+  if (grantedAction === requestedAction) return true;
+  if (isExplicitOnlyAction(requestedAction)) return false;
+  if (grantedAction === "*") return true;
   if (!grantedAction.endsWith("/*")) return false;
   const service = grantedAction.slice(0, -2);
   return requestedAction === service || requestedAction.startsWith(`${service}/`);
@@ -8689,7 +8735,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
 var import_ed255197 = require("@noble/curves/ed25519");
 
 // src/delegations/ShareRecipientClient.ts
-var import_sdk_services2 = require("@tinycloud/sdk-services");
+var import_sdk_services3 = require("@tinycloud/sdk-services");
 var import_ed255196 = require("@noble/curves/ed25519");
 var import_sha2565 = require("@noble/hashes/sha256");
 
@@ -9807,7 +9853,7 @@ async function importPortableDelegation(fetchFn, host, delegation) {
     headers: { Authorization: parsed.delegationHeader.Authorization }
   });
   if (!response.ok)
-    throw new Error(`node rejected delegation import (${response.status})`);
+    throw await httpResponseError(response, "node rejected delegation import");
   const body = await response.json().catch(() => ({}));
   if (body === null || typeof body !== "object" || Array.isArray(body))
     return {};
@@ -9876,7 +9922,7 @@ function redactedCode(error) {
   if (error instanceof ShareConflict) return error.code;
   const code3 = error && typeof error === "object" && "code" in error ? error.code : void 0;
   if (typeof code3 !== "string") return "SHARE_INVALID";
-  if (code3 === import_sdk_services2.ErrorCodes.KV_PRECONDITION_FAILED || code3 === import_sdk_services2.ErrorCodes.KV_CONFLICT || code3 === "412") return "SHARE_CONFLICT";
+  if (code3 === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || code3 === import_sdk_services3.ErrorCodes.KV_CONFLICT || code3 === "412") return "SHARE_CONFLICT";
   if (code3 === "KV_NOT_FOUND" || code3 === "NOT_FOUND" || code3 === "404") return "SHARE_NOT_FOUND";
   if (code3.includes("EXPIRED") || code3 === "expired") return "SHARE_EXPIRED";
   if (code3.includes("REVOK")) return "SHARE_REVOKED";
@@ -10115,7 +10161,7 @@ var ShareRecipientClient = class {
           if (portableDelegation !== void 0 && kv !== void 0) {
             const result2 = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
             if (!result2.ok) {
-              if (result2.error.code === import_sdk_services2.ErrorCodes.KV_PRECONDITION_FAILED || result2.error.code === import_sdk_services2.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
+              if (result2.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || result2.error.code === import_sdk_services3.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
               throw result2.error;
             }
             return { etag: result2.data.headers.etag };
@@ -10123,7 +10169,7 @@ var ShareRecipientClient = class {
           if (policySession !== void 0) return this.nativeSave(envelope, policySession, resolvedPath, bytes2, input);
           const result = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
           if (!result.ok) {
-            if (result.error.code === import_sdk_services2.ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === import_sdk_services2.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
+            if (result.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === import_sdk_services3.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
             throw result.error;
           }
           return { etag: result.data.headers.etag };
@@ -10207,8 +10253,8 @@ var ShareRecipientClient = class {
     if (this.options.createKVService !== void 0) {
       return this.options.createKVService({ hosts: [origin2], session, invoke, fetch: this.fetchFn });
     }
-    const context = new import_sdk_services2.ServiceContext({ hosts: [origin2], session, invoke, fetch: this.fetchFn });
-    const service = new import_sdk_services2.KVService({ prefix: "" });
+    const context = new import_sdk_services3.ServiceContext({ hosts: [origin2], session, invoke, fetch: this.fetchFn });
+    const service = new import_sdk_services3.KVService({ prefix: "" });
     context.registerService("kv", service);
     service.initialize(context);
     return service;
@@ -11309,7 +11355,9 @@ var SharingService = class {
         if (delegation.allowSubDelegation === false) continue;
         if (!this.pathMatches(delegation.path || "", path)) continue;
         const delegationActions = delegation.actions || [];
-        if (!actions.every((action) => delegationActions.includes(action) || delegationActions.includes("*"))) {
+        if (!actions.every(
+          (action) => delegationActions.some((granted) => actionContains(granted, action))
+        )) {
           continue;
         }
         if ((delegation.caveats?.length ?? 0) > 0) {
@@ -12467,14 +12515,14 @@ var import_share_sdk = require("@tinycloud/share-sdk");
 var import_share_sdk2 = require("@tinycloud/share-sdk");
 
 // src/networkId.ts
-var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_sdk_services4 = require("@tinycloud/sdk-services");
 function canonicalizeNetworkId(networkId) {
-  const parsed = (0, import_sdk_services3.parseNetworkId)(networkId);
-  return (0, import_sdk_services3.buildNetworkId)(canonicalizeDid(parsed.ownerDid), parsed.name);
+  const parsed = (0, import_sdk_services4.parseNetworkId)(networkId);
+  return (0, import_sdk_services4.buildNetworkId)(canonicalizeDid(parsed.ownerDid), parsed.name);
 }
 function parseCanonicalNetworkId(networkId) {
   const canonical = canonicalizeNetworkId(networkId);
-  return (0, import_sdk_services3.parseNetworkId)(canonical);
+  return (0, import_sdk_services4.parseNetworkId)(canonical);
 }
 
 // src/storage.schema.ts
@@ -12573,10 +12621,10 @@ function validatePersistedSessionData(data) {
 }
 
 // src/TinyCloud.ts
-var import_sdk_services5 = require("@tinycloud/sdk-services");
+var import_sdk_services6 = require("@tinycloud/sdk-services");
 
 // src/spaces/SpaceService.ts
-var import_sdk_services4 = require("@tinycloud/sdk-services");
+var import_sdk_services5 = require("@tinycloud/sdk-services");
 
 // src/spaces/Space.ts
 function unavailableSecretsService() {
@@ -13005,8 +13053,8 @@ var SpaceService = class {
    */
   async list() {
     if (!this.session) {
-      return (0, import_sdk_services4.err)(
-        (0, import_sdk_services4.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+      return (0, import_sdk_services5.err)(
+        (0, import_sdk_services5.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     try {
@@ -13014,6 +13062,9 @@ var SpaceService = class {
       const ownedResult = await this.listOwnedSpaces();
       if (ownedResult.ok) {
         spaces.push(...ownedResult.data);
+      } else {
+        const verdict = (0, import_sdk_services5.authorizationVerdictOf)(ownedResult.error);
+        if (verdict === "unauthenticated" || verdict === "forbidden") return (0, import_sdk_services5.err)(ownedResult.error);
       }
       if (this.capabilityRegistry) {
         const delegatedSpaces = this.discoverDelegatedSpaces();
@@ -13023,10 +13074,10 @@ var SpaceService = class {
       for (const space of uniqueSpaces) {
         this.notifySpaceRegistered(space);
       }
-      return (0, import_sdk_services4.ok)(uniqueSpaces);
+      return (0, import_sdk_services5.ok)(uniqueSpaces);
     } catch (error) {
-      return (0, import_sdk_services4.err)(
-        (0, import_sdk_services4.serviceError)(
+      return (0, import_sdk_services5.err)(
+        (0, import_sdk_services5.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Failed to list spaces: ${String(error)}`,
           SERVICE_NAME,
@@ -13046,21 +13097,18 @@ var SpaceService = class {
         headers
       });
       if (!response.ok) {
-        const errorText = await response.text();
-        return (0, import_sdk_services4.err)(
-          (0, import_sdk_services4.serviceError)(
-            SpaceErrorCodes.NETWORK_ERROR,
-            `Failed to list owned spaces: ${response.status} - ${errorText}`,
-            SERVICE_NAME,
-            { meta: { status: response.status } }
-          )
-        );
+        return (0, import_sdk_services5.err)(await serviceHttpError(
+          response,
+          SpaceErrorCodes.NETWORK_ERROR,
+          "Failed to list owned spaces",
+          SERVICE_NAME
+        ));
       }
       const rawData = await response.json();
       const validationResult = validateServerOwnedSpacesResponse(rawData);
       if (!validationResult.ok) {
-        return (0, import_sdk_services4.err)(
-          (0, import_sdk_services4.serviceError)(
+        return (0, import_sdk_services5.err)(
+          (0, import_sdk_services5.serviceError)(
             SpaceErrorCodes.NETWORK_ERROR,
             validationResult.error.message,
             SERVICE_NAME,
@@ -13076,10 +13124,10 @@ var SpaceService = class {
         permissions: ["*"]
         // Full permissions for owned spaces
       }));
-      return (0, import_sdk_services4.ok)(spaces);
+      return (0, import_sdk_services5.ok)(spaces);
     } catch (error) {
-      return (0, import_sdk_services4.err)(
-        (0, import_sdk_services4.serviceError)(
+      return (0, import_sdk_services5.err)(
+        (0, import_sdk_services5.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error listing owned spaces: ${String(error)}`,
           SERVICE_NAME,
@@ -13160,13 +13208,13 @@ var SpaceService = class {
    */
   async create(name2) {
     if (!this.session) {
-      return (0, import_sdk_services4.err)(
-        (0, import_sdk_services4.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+      return (0, import_sdk_services5.err)(
+        (0, import_sdk_services5.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     if (!name2 || !/^[a-zA-Z0-9_-]+$/.test(name2)) {
-      return (0, import_sdk_services4.err)(
-        (0, import_sdk_services4.serviceError)(
+      return (0, import_sdk_services5.err)(
+        (0, import_sdk_services5.serviceError)(
           SpaceErrorCodes.INVALID_NAME,
           "Space name must contain only alphanumeric characters, underscores, and hyphens",
           SERVICE_NAME
@@ -13181,30 +13229,26 @@ var SpaceService = class {
         body: JSON.stringify({ name: name2 })
       });
       if (!response.ok) {
-        const errorText = await response.text();
         if (response.status === 409) {
-          return (0, import_sdk_services4.err)(
-            (0, import_sdk_services4.serviceError)(
-              SpaceErrorCodes.ALREADY_EXISTS,
-              `Space "${name2}" already exists`,
-              SERVICE_NAME
-            )
-          );
+          return (0, import_sdk_services5.err)(await serviceHttpError(
+            response,
+            SpaceErrorCodes.ALREADY_EXISTS,
+            `Space "${name2}" already exists`,
+            SERVICE_NAME
+          ));
         }
-        return (0, import_sdk_services4.err)(
-          (0, import_sdk_services4.serviceError)(
-            SpaceErrorCodes.CREATION_FAILED,
-            `Failed to create space: ${response.status} - ${errorText}`,
-            SERVICE_NAME,
-            { meta: { status: response.status } }
-          )
-        );
+        return (0, import_sdk_services5.err)(await serviceHttpError(
+          response,
+          SpaceErrorCodes.CREATION_FAILED,
+          "Failed to create space",
+          SERVICE_NAME
+        ));
       }
       const rawData = await response.json();
       const validationResult = validateServerCreateSpaceResponse(rawData);
       if (!validationResult.ok) {
-        return (0, import_sdk_services4.err)(
-          (0, import_sdk_services4.serviceError)(
+        return (0, import_sdk_services5.err)(
+          (0, import_sdk_services5.serviceError)(
             SpaceErrorCodes.CREATION_FAILED,
             validationResult.error.message,
             SERVICE_NAME,
@@ -13221,10 +13265,10 @@ var SpaceService = class {
       };
       this.infoCache.set(spaceInfo.id, { info: spaceInfo, cachedAt: Date.now() });
       this.notifySpaceRegistered(spaceInfo);
-      return (0, import_sdk_services4.ok)(spaceInfo);
+      return (0, import_sdk_services5.ok)(spaceInfo);
     } catch (error) {
-      return (0, import_sdk_services4.err)(
-        (0, import_sdk_services4.serviceError)(
+      return (0, import_sdk_services5.err)(
+        (0, import_sdk_services5.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error creating space: ${String(error)}`,
           SERVICE_NAME,
@@ -13294,10 +13338,10 @@ var SpaceService = class {
     const spaceId = this.resolveSpaceId(nameOrUri);
     const cached = this.infoCache.get(spaceId);
     if (cached && Date.now() - cached.cachedAt < this.cacheTTL) {
-      return (0, import_sdk_services4.ok)(true);
+      return (0, import_sdk_services5.ok)(true);
     }
     const infoResult = await this.getSpaceInfo(spaceId);
-    return (0, import_sdk_services4.ok)(infoResult.ok);
+    return (0, import_sdk_services5.ok)(infoResult.ok);
   }
   // ===========================================================================
   // Space Info
@@ -13308,11 +13352,11 @@ var SpaceService = class {
   async getSpaceInfo(spaceId) {
     const cached = this.infoCache.get(spaceId);
     if (cached && Date.now() - cached.cachedAt < this.cacheTTL) {
-      return (0, import_sdk_services4.ok)(cached.info);
+      return (0, import_sdk_services5.ok)(cached.info);
     }
     if (!this.session) {
-      return (0, import_sdk_services4.err)(
-        (0, import_sdk_services4.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+      return (0, import_sdk_services5.err)(
+        (0, import_sdk_services5.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     try {
@@ -13324,24 +13368,25 @@ var SpaceService = class {
       });
       if (!response.ok) {
         if (response.status === 404) {
-          return (0, import_sdk_services4.err)(
-            (0, import_sdk_services4.serviceError)(SpaceErrorCodes.NOT_FOUND, `Space not found: ${spaceId}`, SERVICE_NAME)
-          );
-        }
-        const errorText = await response.text();
-        return (0, import_sdk_services4.err)(
-          (0, import_sdk_services4.serviceError)(
-            SpaceErrorCodes.NETWORK_ERROR,
-            `Failed to get space info: ${response.status} - ${errorText}`,
+          return (0, import_sdk_services5.err)(await serviceHttpError(
+            response,
+            SpaceErrorCodes.NOT_FOUND,
+            `Space not found: ${spaceId}`,
             SERVICE_NAME
-          )
-        );
+          ));
+        }
+        return (0, import_sdk_services5.err)(await serviceHttpError(
+          response,
+          SpaceErrorCodes.NETWORK_ERROR,
+          "Failed to get space info",
+          SERVICE_NAME
+        ));
       }
       const rawData = await response.json();
       const validationResult = validateServerSpaceInfoResponse(rawData);
       if (!validationResult.ok) {
-        return (0, import_sdk_services4.err)(
-          (0, import_sdk_services4.serviceError)(
+        return (0, import_sdk_services5.err)(
+          (0, import_sdk_services5.serviceError)(
             SpaceErrorCodes.NETWORK_ERROR,
             validationResult.error.message,
             SERVICE_NAME,
@@ -13359,10 +13404,10 @@ var SpaceService = class {
         expiresAt: data.expiresAt ? new Date(data.expiresAt) : void 0
       };
       this.infoCache.set(spaceId, { info: spaceInfo, cachedAt: Date.now() });
-      return (0, import_sdk_services4.ok)(spaceInfo);
+      return (0, import_sdk_services5.ok)(spaceInfo);
     } catch (error) {
-      return (0, import_sdk_services4.err)(
-        (0, import_sdk_services4.serviceError)(
+      return (0, import_sdk_services5.err)(
+        (0, import_sdk_services5.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error getting space info: ${String(error)}`,
           SERVICE_NAME,
@@ -13447,20 +13492,18 @@ var SpaceService = class {
             headers
           });
           if (!response.ok) {
-            const errorText = await response.text();
-            return (0, import_sdk_services4.err)(
-              (0, import_sdk_services4.serviceError)(
-                SpaceErrorCodes.NETWORK_ERROR,
-                `Failed to list delegations: ${response.status} - ${errorText}`,
-                SERVICE_NAME
-              )
-            );
+            return (0, import_sdk_services5.err)(await serviceHttpError(
+              response,
+              SpaceErrorCodes.NETWORK_ERROR,
+              "Failed to list delegations",
+              SERVICE_NAME
+            ));
           }
           const rawData = await response.json();
           const validationResult = validateServerDelegationsResponse(rawData);
           if (!validationResult.ok) {
-            return (0, import_sdk_services4.err)(
-              (0, import_sdk_services4.serviceError)(
+            return (0, import_sdk_services5.err)(
+              (0, import_sdk_services5.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 validationResult.error.message,
                 SERVICE_NAME,
@@ -13469,10 +13512,10 @@ var SpaceService = class {
             );
           }
           const delegations = transformServerDelegations(validationResult.data, spaceId);
-          return (0, import_sdk_services4.ok)(delegations);
+          return (0, import_sdk_services5.ok)(delegations);
         } catch (error) {
-          return (0, import_sdk_services4.err)(
-            (0, import_sdk_services4.serviceError)(
+          return (0, import_sdk_services5.err)(
+            (0, import_sdk_services5.serviceError)(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error listing delegations: ${String(error)}`,
               SERVICE_NAME
@@ -13502,20 +13545,18 @@ var SpaceService = class {
             headers
           });
           if (!response.ok) {
-            const errorText = await response.text();
-            return (0, import_sdk_services4.err)(
-              (0, import_sdk_services4.serviceError)(
-                SpaceErrorCodes.NETWORK_ERROR,
-                `Failed to list received delegations: ${response.status} - ${errorText}`,
-                SERVICE_NAME
-              )
-            );
+            return (0, import_sdk_services5.err)(await serviceHttpError(
+              response,
+              SpaceErrorCodes.NETWORK_ERROR,
+              "Failed to list received delegations",
+              SERVICE_NAME
+            ));
           }
           const rawData = await response.json();
           const validationResult = validateServerDelegationsResponse(rawData);
           if (!validationResult.ok) {
-            return (0, import_sdk_services4.err)(
-              (0, import_sdk_services4.serviceError)(
+            return (0, import_sdk_services5.err)(
+              (0, import_sdk_services5.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 validationResult.error.message,
                 SERVICE_NAME,
@@ -13524,10 +13565,10 @@ var SpaceService = class {
             );
           }
           const delegations = transformServerDelegations(validationResult.data, spaceId);
-          return (0, import_sdk_services4.ok)(delegations);
+          return (0, import_sdk_services5.ok)(delegations);
         } catch (error) {
-          return (0, import_sdk_services4.err)(
-            (0, import_sdk_services4.serviceError)(
+          return (0, import_sdk_services5.err)(
+            (0, import_sdk_services5.serviceError)(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error listing received delegations: ${String(error)}`,
               SERVICE_NAME
@@ -13539,8 +13580,8 @@ var SpaceService = class {
         if (self.createDelegationFn) {
           return self.createDelegationFn({ ...params, spaceId });
         }
-        return (0, import_sdk_services4.err)(
-          (0, import_sdk_services4.serviceError)(
+        return (0, import_sdk_services5.err)(
+          (0, import_sdk_services5.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Delegation creation requires a createDelegation function. This should be provided by the platform SDK (web-sdk or node-sdk).",
             SERVICE_NAME
@@ -13561,19 +13602,17 @@ var SpaceService = class {
             body: JSON.stringify({ cid: cid2, spaceId })
           });
           if (!response.ok) {
-            const errorText = await response.text();
-            return (0, import_sdk_services4.err)(
-              (0, import_sdk_services4.serviceError)(
-                SpaceErrorCodes.NETWORK_ERROR,
-                `Failed to revoke delegation: ${response.status} - ${errorText}`,
-                SERVICE_NAME
-              )
-            );
+            return (0, import_sdk_services5.err)(await serviceHttpError(
+              response,
+              SpaceErrorCodes.NETWORK_ERROR,
+              "Failed to revoke delegation",
+              SERVICE_NAME
+            ));
           }
-          return (0, import_sdk_services4.ok)(void 0);
+          return (0, import_sdk_services5.ok)(void 0);
         } catch (error) {
-          return (0, import_sdk_services4.err)(
-            (0, import_sdk_services4.serviceError)(
+          return (0, import_sdk_services5.err)(
+            (0, import_sdk_services5.serviceError)(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error revoking delegation: ${String(error)}`,
               SERVICE_NAME
@@ -13596,18 +13635,18 @@ var SpaceService = class {
         if (self.sharingService) {
           const result = await self.sharingService.generate(params);
           if (!result.ok) {
-            return (0, import_sdk_services4.err)(
-              (0, import_sdk_services4.serviceError)(
+            return (0, import_sdk_services5.err)(
+              (0, import_sdk_services5.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 result.error.message || "Failed to generate share link",
                 SERVICE_NAME
               )
             );
           }
-          return (0, import_sdk_services4.ok)(result.data);
+          return (0, import_sdk_services5.ok)(result.data);
         }
-        return (0, import_sdk_services4.err)(
-          (0, import_sdk_services4.serviceError)(
+        return (0, import_sdk_services5.err)(
+          (0, import_sdk_services5.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "SharingService not configured. V2 sharing requires a SharingService instance.",
             SERVICE_NAME
@@ -13615,8 +13654,8 @@ var SpaceService = class {
         );
       },
       async list() {
-        return (0, import_sdk_services4.err)(
-          (0, import_sdk_services4.serviceError)(
+        return (0, import_sdk_services5.err)(
+          (0, import_sdk_services5.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Listing share links is not supported in v2. Share links are self-contained tokens that are not tracked on the server.",
             SERVICE_NAME
@@ -13624,8 +13663,8 @@ var SpaceService = class {
         );
       },
       async revoke(token) {
-        return (0, import_sdk_services4.err)(
-          (0, import_sdk_services4.serviceError)(
+        return (0, import_sdk_services5.err)(
+          (0, import_sdk_services5.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Revoking share links by token is not supported in v2. To revoke access, revoke the underlying delegation using space.delegations.revoke(cid).",
             SERVICE_NAME
@@ -13685,7 +13724,7 @@ var TinyCloud = class _TinyCloud {
         "hosts are required to initialize services. Provide them via config.hosts or initializeServices()."
       );
     }
-    this._serviceContext = new import_sdk_services5.ServiceContext({
+    this._serviceContext = new import_sdk_services6.ServiceContext({
       invoke: effectiveInvoke,
       invokeAny: this.config.invokeAny,
       fetch: fetchFn ?? this.config.fetch ?? globalThis.fetch.bind(globalThis),
@@ -13694,10 +13733,10 @@ var TinyCloud = class _TinyCloud {
       telemetry: this.config.telemetry
     });
     const serviceConstructors = {
-      kv: import_sdk_services5.KVService,
-      sql: import_sdk_services5.SQLService,
-      duckdb: import_sdk_services5.DuckDbService,
-      hooks: import_sdk_services5.HooksService,
+      kv: import_sdk_services6.KVService,
+      sql: import_sdk_services6.SQLService,
+      duckdb: import_sdk_services6.DuckDbService,
+      hooks: import_sdk_services6.HooksService,
       ...this.config.services
     };
     for (const [name2, ServiceClass] of Object.entries(serviceConstructors)) {
@@ -13961,18 +14000,18 @@ var TinyCloud = class _TinyCloud {
     const address = this.address();
     const chainId = this.chainId();
     if (!address || !chainId) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(
-          import_sdk_services5.ErrorCodes.AUTH_REQUIRED,
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(
+          import_sdk_services6.ErrorCodes.AUTH_REQUIRED,
           "Must be signed in to ensure public space",
           "public-space"
         )
       );
     }
     if (!this._serviceContext) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(
-          import_sdk_services5.ErrorCodes.AUTH_REQUIRED,
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(
+          import_sdk_services6.ErrorCodes.AUTH_REQUIRED,
           "Services not initialized. Call initializeServices() or signIn() first.",
           "public-space"
         )
@@ -13982,9 +14021,9 @@ var TinyCloud = class _TinyCloud {
     try {
       const session = this._serviceContext.session;
       if (!session) {
-        return (0, import_sdk_services5.err)(
-          (0, import_sdk_services5.serviceError)(
-            import_sdk_services5.ErrorCodes.AUTH_REQUIRED,
+        return (0, import_sdk_services6.err)(
+          (0, import_sdk_services6.serviceError)(
+            import_sdk_services6.ErrorCodes.AUTH_REQUIRED,
             "No active session",
             "public-space"
           )
@@ -14001,7 +14040,7 @@ var TinyCloud = class _TinyCloud {
         { method: "POST", headers, body: JSON.stringify({ spaceId }) }
       );
       if (response.ok) {
-        return (0, import_sdk_services5.ok)(void 0);
+        return (0, import_sdk_services6.ok)(void 0);
       }
       if (response.status === 404) {
         const createHeaders = this._serviceContext.invoke(
@@ -14020,31 +14059,27 @@ var TinyCloud = class _TinyCloud {
         );
         if (!createResponse.ok) {
           if (createResponse.status === 409) {
-            return (0, import_sdk_services5.ok)(void 0);
+            return (0, import_sdk_services6.ok)(void 0);
           }
-          const errorText2 = await createResponse.text();
-          return (0, import_sdk_services5.err)(
-            (0, import_sdk_services5.serviceError)(
-              import_sdk_services5.ErrorCodes.NETWORK_ERROR,
-              `Failed to create public space: ${createResponse.status} - ${errorText2}`,
-              "public-space"
-            )
-          );
+          return (0, import_sdk_services6.err)(await serviceHttpError(
+            createResponse,
+            import_sdk_services6.ErrorCodes.NETWORK_ERROR,
+            "Failed to create public space",
+            "public-space"
+          ));
         }
-        return (0, import_sdk_services5.ok)(void 0);
+        return (0, import_sdk_services6.ok)(void 0);
       }
-      const errorText = await response.text();
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(
-          import_sdk_services5.ErrorCodes.NETWORK_ERROR,
-          `Failed to check public space: ${response.status} - ${errorText}`,
-          "public-space"
-        )
-      );
+      return (0, import_sdk_services6.err)(await serviceHttpError(
+        response,
+        import_sdk_services6.ErrorCodes.NETWORK_ERROR,
+        "Failed to check public space",
+        "public-space"
+      ));
     } catch (error) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(
-          import_sdk_services5.ErrorCodes.NETWORK_ERROR,
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(
+          import_sdk_services6.ErrorCodes.NETWORK_ERROR,
           `Network error ensuring public space: ${String(error)}`,
           "public-space",
           { cause: error instanceof Error ? error : void 0 }
@@ -14077,8 +14112,8 @@ var TinyCloud = class _TinyCloud {
     if (!session) {
       throw new Error("No active session. Sign in first.");
     }
-    const publicKV = new import_sdk_services5.KVService({ prefix: "" });
-    const publicContext = new import_sdk_services5.ServiceContext({
+    const publicKV = new import_sdk_services6.KVService({ prefix: "" });
+    const publicContext = new import_sdk_services6.ServiceContext({
       invoke: this._serviceContext.invoke,
       fetch: this._serviceContext.fetch,
       hosts: this._serviceContext.hosts,
@@ -14111,23 +14146,19 @@ var TinyCloud = class _TinyCloud {
       const response = await doFetch(url, { method: "GET" });
       if (!response.ok) {
         if (response.status === 404) {
-          return (0, import_sdk_services5.err)(
-            (0, import_sdk_services5.serviceError)(
-              import_sdk_services5.ErrorCodes.NOT_FOUND,
-              `Key not found: ${key} in space ${spaceId}`,
-              "public-space"
-            )
-          );
+          return (0, import_sdk_services6.err)(await serviceHttpError(
+            response,
+            import_sdk_services6.ErrorCodes.NOT_FOUND,
+            `Key not found: ${key} in space ${spaceId}`,
+            "public-space"
+          ));
         }
-        const errorText = await response.text();
-        return (0, import_sdk_services5.err)(
-          (0, import_sdk_services5.serviceError)(
-            import_sdk_services5.ErrorCodes.NETWORK_ERROR,
-            `Failed to read public space: ${response.status} - ${errorText}`,
-            "public-space",
-            { meta: { status: response.status } }
-          )
-        );
+        return (0, import_sdk_services6.err)(await serviceHttpError(
+          response,
+          import_sdk_services6.ErrorCodes.NETWORK_ERROR,
+          "Failed to read public space",
+          "public-space"
+        ));
       }
       const contentType = response.headers.get("content-type");
       let data;
@@ -14141,11 +14172,11 @@ var TinyCloud = class _TinyCloud {
           data = text2;
         }
       }
-      return (0, import_sdk_services5.ok)(data);
+      return (0, import_sdk_services6.ok)(data);
     } catch (error) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(
-          import_sdk_services5.ErrorCodes.NETWORK_ERROR,
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(
+          import_sdk_services6.ErrorCodes.NETWORK_ERROR,
           `Network error reading public space: ${String(error)}`,
           "public-space",
           { cause: error instanceof Error ? error : void 0 }
@@ -14171,7 +14202,7 @@ var TinyCloud = class _TinyCloud {
 };
 
 // src/account/AccountService.ts
-var import_sdk_services6 = require("@tinycloud/sdk-services");
+var import_sdk_services7 = require("@tinycloud/sdk-services");
 var import_bootstrap3 = require("@tinycloud/bootstrap");
 var SERVICE_NAME2 = "account";
 var ACCOUNT_INDEX_DB = "account";
@@ -14184,10 +14215,10 @@ var AccountService = class {
      * Per-account-space memo for {@link ensureAccountIndex}.
      *
      * Applying the index migration is a no-op once the schema exists, but the
-     * SQL service still spends two round trips discovering that (create the
-     * migrations table, then read the applied-migration rows). Account bootstrap
-     * touches the index eight times, so without a memo that is ~14 wasted
-     * requests on the cold sign-in path. The in-flight dedupe inside SQLService
+     * SQL service still spends a round trip discovering that (reading the
+     * applied-migration rows). Account bootstrap touches the index eight times,
+     * so without a memo that is ~7 wasted requests on the cold sign-in path.
+     * The in-flight dedupe inside SQLService
      * never helps here: the node SDK builds a fresh SQLService per
      * `getAccountDb()` call, so its lock map is always empty.
      *
@@ -14219,7 +14250,7 @@ var AccountService = class {
           applications.push(applicationFromRecord(key, loaded.data.data));
         }
         applications.sort((a, b) => a.appId.localeCompare(b.appId));
-        return (0, import_sdk_services6.ok)(applications);
+        return (0, import_sdk_services7.ok)(applications);
       },
       get: async (appId) => {
         const kvResult = this.accountKV();
@@ -14227,14 +14258,14 @@ var AccountService = class {
         const key = applicationKey(appId);
         const loaded = await kvResult.data.get(key);
         if (!loaded.ok) return accountErr(loaded.error);
-        return (0, import_sdk_services6.ok)(applicationFromRecord(key, loaded.data.data));
+        return (0, import_sdk_services7.ok)(applicationFromRecord(key, loaded.data.data));
       },
       register: async (manifest, options2 = {}) => {
         const manifests = Array.isArray(manifest) ? manifest : [manifest];
         const request = composeManifestRequest(manifests);
         if (request.registryRecords.length === 0) {
-          return (0, import_sdk_services6.err)(
-            (0, import_sdk_services6.serviceError)(
+          return (0, import_sdk_services7.err)(
+            (0, import_sdk_services7.serviceError)(
               "INVALID_MANIFEST",
               "Manifest did not produce an account application registry record",
               SERVICE_NAME2
@@ -14268,7 +14299,7 @@ var AccountService = class {
           registered = applicationFromRecord(record2.key, stored);
           await this.upsertApplicationIndexQuietly(registered);
         }
-        return (0, import_sdk_services6.ok)(registered);
+        return (0, import_sdk_services7.ok)(registered);
       },
       remove: async (appId) => {
         const kvResult = this.accountKV();
@@ -14276,7 +14307,7 @@ var AccountService = class {
         const removed = await kvResult.data.delete(applicationKey(appId));
         if (!removed.ok) return accountErr(removed.error);
         await this.deleteApplicationIndexQuietly(appId);
-        return (0, import_sdk_services6.ok)(void 0);
+        return (0, import_sdk_services7.ok)(void 0);
       }
     };
     this.spaces = {
@@ -14285,11 +14316,12 @@ var AccountService = class {
           const indexed = await this.index.spaces.list();
           if (indexed.ok && indexed.data.length > 0) return indexed;
           if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
-          const canonical = await this.spaces.syncAccessible();
-          if (canonical.ok && options2.refreshIndex !== false) {
-            await this.replaceSpacesIndexQuietly(canonical.data);
+          const canonical = await this.syncAccessibleSpaces({ tolerateStorageFull: true });
+          if (!canonical.ok) return canonical;
+          if (canonical.data.allRegistered && options2.refreshIndex !== false) {
+            await this.replaceSpacesIndexQuietly(canonical.data.spaces);
           }
-          return canonical;
+          return (0, import_sdk_services7.ok)(canonical.data.spaces);
         }
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
@@ -14302,14 +14334,14 @@ var AccountService = class {
           spaces.push(spaceFromRecord(key, loaded.data.data));
         }
         spaces.sort((a, b) => a.name.localeCompare(b.name) || a.spaceId.localeCompare(b.spaceId));
-        return (0, import_sdk_services6.ok)(spaces);
+        return (0, import_sdk_services7.ok)(spaces);
       },
       get: async (spaceId) => {
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
         const loaded = await kvResult.data.get(spaceKey(spaceId));
         if (!loaded.ok) return accountErr(loaded.error);
-        return (0, import_sdk_services6.ok)(spaceFromRecord(spaceKey(spaceId), loaded.data.data));
+        return (0, import_sdk_services7.ok)(spaceFromRecord(spaceKey(spaceId), loaded.data.data));
       },
       register: async (space) => {
         await this.config.ensureAccountSpaceHosted?.();
@@ -14320,7 +14352,7 @@ var AccountService = class {
         if (!written.ok) return accountErr(written.error);
         const registered = spaceFromRecord(spaceKey(stored.space_id), stored);
         await this.upsertSpaceIndexQuietly(registered);
-        return (0, import_sdk_services6.ok)(registered);
+        return (0, import_sdk_services7.ok)(registered);
       },
       /**
        * Register multiple spaces in one KV batch write + one multi-row index
@@ -14333,7 +14365,7 @@ var AccountService = class {
        * leave the first attempt's blocks orphaned.
        */
       registerBatch: async (spaces) => {
-        if (spaces.length === 0) return (0, import_sdk_services6.ok)({ spaces: [] });
+        if (spaces.length === 0) return (0, import_sdk_services7.ok)({ spaces: [] });
         await this.config.ensureAccountSpaceHosted?.();
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
@@ -14348,7 +14380,7 @@ var AccountService = class {
         const batchResult = await kvResult.data.batchPut(items);
         if (batchResult.ok) {
           await this.upsertSpacesIndexQuietly(registered);
-          return (0, import_sdk_services6.ok)({ spaces: registered });
+          return (0, import_sdk_services7.ok)({ spaces: registered });
         }
         if (!isAmbiguousBatchFailure(batchResult.error)) {
           return accountErr(batchResult.error);
@@ -14361,8 +14393,8 @@ var AccountService = class {
           }
         }
         if (reconcileFailures.length > 0) {
-          return (0, import_sdk_services6.err)(
-            (0, import_sdk_services6.serviceError)(
+          return (0, import_sdk_services7.err)(
+            (0, import_sdk_services7.serviceError)(
               "KV_BATCH_RECONCILE_FAILED",
               `KV batch write for ${items.length} space(s) failed ambiguously (${batchResult.error.message}) and per-space reconciliation also failed for: ${reconcileFailures.join("; ")}`,
               SERVICE_NAME2,
@@ -14374,18 +14406,11 @@ var AccountService = class {
           `[AccountService] KV batch write for ${items.length} space(s) returned an ambiguous error and was reconciled via per-space fallback. Original error: ${batchResult.error.message}`
         );
         await this.upsertSpacesIndexQuietly(registered);
-        return (0, import_sdk_services6.ok)({ spaces: registered, recoveredFromBatchError: batchResult.error });
+        return (0, import_sdk_services7.ok)({ spaces: registered, recoveredFromBatchError: batchResult.error });
       },
       syncAccessible: async () => {
-        const listed = await this.config.getSpaces().list();
-        if (!listed.ok) return accountErr(listed.error);
-        const registered = [];
-        for (const space of listed.data) {
-          const result = await this.spaces.register(space);
-          if (!result.ok) return result;
-          registered.push(result.data);
-        }
-        return (0, import_sdk_services6.ok)(registered);
+        const synced = await this.syncAccessibleSpaces({ tolerateStorageFull: false });
+        return synced.ok ? (0, import_sdk_services7.ok)(synced.data.spaces) : synced;
       },
       remove: async (spaceId) => {
         const kvResult = this.accountKV();
@@ -14393,21 +14418,21 @@ var AccountService = class {
         const removed = await kvResult.data.delete(spaceKey(spaceId));
         if (!removed.ok) return accountErr(removed.error);
         await this.deleteSpaceIndexQuietly(spaceId);
-        return (0, import_sdk_services6.ok)(void 0);
+        return (0, import_sdk_services7.ok)(void 0);
       }
     };
     this.delegations = {
       query: async (options2 = {}) => {
         const manager = this.config.getDelegationManager?.();
         if (!manager) {
-          return (0, import_sdk_services6.err)((0, import_sdk_services6.serviceError)(
+          return (0, import_sdk_services7.err)((0, import_sdk_services7.serviceError)(
             "NOT_INITIALIZED",
             "Delegation history requires an authenticated delegation manager",
             SERVICE_NAME2
           ));
         }
         const queried = await manager.query(options2);
-        return queried.ok ? (0, import_sdk_services6.ok)(queried.data) : accountErr(queried.error);
+        return queried.ok ? (0, import_sdk_services7.ok)(queried.data) : accountErr(queried.error);
       },
       list: async (options2 = {}) => {
         if (options2.preferIndex) {
@@ -14441,17 +14466,17 @@ var AccountService = class {
           }
         }
         delegations.sort((a, b) => a.spaceId.localeCompare(b.spaceId) || a.cid.localeCompare(b.cid));
-        return (0, import_sdk_services6.ok)(delegations);
+        return (0, import_sdk_services7.ok)(delegations);
       },
       revoke: async (input) => {
         const cid2 = typeof input === "string" ? input : input.cid;
         const manager = this.config.getDelegationManager?.();
         if (manager) {
           const revoked2 = await manager.revoke(cid2);
-          return revoked2.ok ? (0, import_sdk_services6.ok)(revoked2.data) : accountErr(revoked2.error);
+          return revoked2.ok ? (0, import_sdk_services7.ok)(revoked2.data) : accountErr(revoked2.error);
         }
         if (typeof input === "string") {
-          return (0, import_sdk_services6.err)((0, import_sdk_services6.serviceError)(
+          return (0, import_sdk_services7.err)((0, import_sdk_services7.serviceError)(
             "NOT_INITIALIZED",
             "CID-only revocation requires an authenticated delegation manager",
             SERVICE_NAME2
@@ -14461,7 +14486,7 @@ var AccountService = class {
         if (!space.ok) return space;
         const revoked = await this.config.getSpaces().get(space.data.id).delegations.revoke(cid2);
         if (!revoked.ok) return accountErr(revoked.error);
-        return (0, import_sdk_services6.ok)(void 0);
+        return (0, import_sdk_services7.ok)(void 0);
       }
     };
     this.index = {
@@ -14470,7 +14495,7 @@ var AccountService = class {
         if (!dbResult.ok) return dbResult;
         const schema = await this.ensureAccountIndex(dbResult.data);
         if (!schema.ok) return schema;
-        return (0, import_sdk_services6.ok)({ database: ACCOUNT_INDEX_DB });
+        return (0, import_sdk_services7.ok)({ database: ACCOUNT_INDEX_DB });
       },
       rebuild: async () => {
         const dbResult = this.accountDb();
@@ -14552,7 +14577,7 @@ var AccountService = class {
         ];
         const rebuilt = await dbResult.data.batch(statements);
         if (!rebuilt.ok) return accountErr(rebuilt.error);
-        return (0, import_sdk_services6.ok)({
+        return (0, import_sdk_services7.ok)({
           database: ACCOUNT_INDEX_DB,
           applications: applications.data.length,
           spaces: spaces.data.length,
@@ -14568,7 +14593,7 @@ var AccountService = class {
             "SELECT applications.app_id, name, description, updated_at, manifest_json, application_state.manifest_hash FROM applications LEFT JOIN application_state ON applications.app_id = application_state.app_id ORDER BY applications.app_id"
           );
           if (!queried.ok) return accountErr(queried.error);
-          return (0, import_sdk_services6.ok)(queried.data.rows.map(indexedApplicationFromRow));
+          return (0, import_sdk_services7.ok)(queried.data.rows.map(indexedApplicationFromRow));
         }
       },
       spaces: {
@@ -14579,7 +14604,7 @@ var AccountService = class {
             "SELECT space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at FROM spaces ORDER BY name, space_id"
           );
           if (!queried.ok) return accountErr(queried.error);
-          return (0, import_sdk_services6.ok)(queried.data.rows.map(indexedSpaceFromRow));
+          return (0, import_sdk_services7.ok)(queried.data.rows.map(indexedSpaceFromRow));
         }
       },
       delegations: {
@@ -14601,7 +14626,7 @@ var AccountService = class {
             params
           );
           if (!queried.ok) return accountErr(queried.error);
-          return (0, import_sdk_services6.ok)(queried.data.rows.map(indexedDelegationFromRow));
+          return (0, import_sdk_services7.ok)(queried.data.rows.map(indexedDelegationFromRow));
         }
       },
       query: async (sql, params) => {
@@ -14609,7 +14634,7 @@ var AccountService = class {
         if (!dbResult.ok) return dbResult;
         const queried = await dbResult.data.query(sql, params);
         if (!queried.ok) return accountErr(queried.error);
-        return (0, import_sdk_services6.ok)(queried.data);
+        return (0, import_sdk_services7.ok)(queried.data);
       },
       status: async () => {
         const dbResult = this.accountDb();
@@ -14619,11 +14644,11 @@ var AccountService = class {
         );
         if (!queried.ok) {
           if (isMissingIndexError(queried.error)) {
-            return (0, import_sdk_services6.ok)({ database: ACCOUNT_INDEX_DB, state: "missing", sources: [] });
+            return (0, import_sdk_services7.ok)({ database: ACCOUNT_INDEX_DB, state: "missing", sources: [] });
           }
           return accountErr(queried.error);
         }
-        return (0, import_sdk_services6.ok)({
+        return (0, import_sdk_services7.ok)({
           database: ACCOUNT_INDEX_DB,
           state: "ready",
           sources: queried.data.rows.map(([source, syncedAt, count]) => ({
@@ -14642,7 +14667,7 @@ var AccountService = class {
     if (!delegations.ok) return delegations;
     const spaces = await this.spaces.list();
     if (!spaces.ok) return spaces;
-    return (0, import_sdk_services6.ok)({
+    return (0, import_sdk_services7.ok)({
       did: this.config.getDid(),
       host: this.config.getHost(),
       primarySpaceId: this.config.getPrimarySpaceId(),
@@ -14656,28 +14681,28 @@ var AccountService = class {
   accountKV() {
     const accountSpaceId = this.config.getAccountSpaceId();
     if (!accountSpaceId) {
-      return (0, import_sdk_services6.err)(
-        (0, import_sdk_services6.serviceError)(
+      return (0, import_sdk_services7.err)(
+        (0, import_sdk_services7.serviceError)(
           "ACCOUNT_SPACE_UNAVAILABLE",
           "Account space is unavailable. Sign in with a wallet-backed profile first.",
           SERVICE_NAME2
         )
       );
     }
-    return (0, import_sdk_services6.ok)(this.config.getSpaces().get(accountSpaceId).kv);
+    return (0, import_sdk_services7.ok)(this.config.getSpaces().get(accountSpaceId).kv);
   }
   accountDb() {
     const db = this.config.getAccountDb?.();
     if (!db) {
-      return (0, import_sdk_services6.err)(
-        (0, import_sdk_services6.serviceError)(
+      return (0, import_sdk_services7.err)(
+        (0, import_sdk_services7.serviceError)(
           "ACCOUNT_INDEX_UNAVAILABLE",
           "Account index database is unavailable. Sign in with a wallet-backed profile first.",
           SERVICE_NAME2
         )
       );
     }
-    return (0, import_sdk_services6.ok)(db);
+    return (0, import_sdk_services7.ok)(db);
   }
   async indexHasApplicationHash(appId, manifestHash) {
     const dbResult = this.accountDb();
@@ -14695,7 +14720,7 @@ var AccountService = class {
   }
   async upsertApplicationIndex(app) {
     const dbResult = this.accountDb();
-    if (!dbResult.ok) return (0, import_sdk_services6.ok)(void 0);
+    if (!dbResult.ok) return (0, import_sdk_services7.ok)(void 0);
     const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return schema;
     const updatedAt = app.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -14717,14 +14742,14 @@ var AccountService = class {
       }
     ]);
     if (!written.ok) return accountErr(written.error);
-    return (0, import_sdk_services6.ok)(void 0);
+    return (0, import_sdk_services7.ok)(void 0);
   }
   async deleteApplicationIndexQuietly(appId) {
     await ignoreIndexFailure(() => this.deleteApplicationIndex(appId));
   }
   async deleteApplicationIndex(appId) {
     const dbResult = this.accountDb();
-    if (!dbResult.ok) return (0, import_sdk_services6.ok)(void 0);
+    if (!dbResult.ok) return (0, import_sdk_services7.ok)(void 0);
     const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
@@ -14732,14 +14757,14 @@ var AccountService = class {
       { sql: "DELETE FROM application_state WHERE app_id = ?", params: [appId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
-    return (0, import_sdk_services6.ok)(void 0);
+    return (0, import_sdk_services7.ok)(void 0);
   }
   async upsertSpaceIndexQuietly(space) {
     await ignoreIndexFailure(() => this.upsertSpaceIndex(space));
   }
   async upsertSpaceIndex(space) {
     const dbResult = this.accountDb();
-    if (!dbResult.ok) return (0, import_sdk_services6.ok)(void 0);
+    if (!dbResult.ok) return (0, import_sdk_services7.ok)(void 0);
     const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return schema;
     const updatedAt = space.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -14760,7 +14785,7 @@ var AccountService = class {
       }
     ]);
     if (!written.ok) return accountErr(written.error);
-    return (0, import_sdk_services6.ok)(void 0);
+    return (0, import_sdk_services7.ok)(void 0);
   }
   async upsertSpacesIndexQuietly(spaces) {
     await ignoreIndexFailure(() => this.upsertSpacesIndex(spaces));
@@ -14774,9 +14799,9 @@ var AccountService = class {
    * atomically: all rows or none.
    */
   async upsertSpacesIndex(spaces) {
-    if (spaces.length === 0) return (0, import_sdk_services6.ok)(void 0);
+    if (spaces.length === 0) return (0, import_sdk_services7.ok)(void 0);
     const dbResult = this.accountDb();
-    if (!dbResult.ok) return (0, import_sdk_services6.ok)(void 0);
+    if (!dbResult.ok) return (0, import_sdk_services7.ok)(void 0);
     const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return schema;
     const placeholders = spaces.map(() => "(?, ?, ?, ?, ?, ?, ?, ?, ?)").join(", ");
@@ -14801,32 +14826,60 @@ var AccountService = class {
       }
     ]);
     if (!written.ok) return accountErr(written.error);
-    return (0, import_sdk_services6.ok)(void 0);
+    return (0, import_sdk_services7.ok)(void 0);
   }
   async deleteSpaceIndexQuietly(spaceId) {
     await ignoreIndexFailure(() => this.deleteSpaceIndex(spaceId));
   }
   async deleteSpaceIndex(spaceId) {
     const dbResult = this.accountDb();
-    if (!dbResult.ok) return (0, import_sdk_services6.ok)(void 0);
+    if (!dbResult.ok) return (0, import_sdk_services7.ok)(void 0);
     const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
       { sql: "DELETE FROM spaces WHERE space_id = ?", params: [spaceId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
-    return (0, import_sdk_services6.ok)(void 0);
+    return (0, import_sdk_services7.ok)(void 0);
+  }
+  /**
+   * Register every space the session can reach and return them. With
+   * `tolerateStorageFull`, a full account space stops the registration
+   * writes but not the listing: the remaining spaces are returned as they
+   * would have been registered, and `allRegistered` is false.
+   */
+  async syncAccessibleSpaces(options2) {
+    const listed = await this.config.getSpaces().list();
+    if (!listed.ok) return accountErr(listed.error);
+    const spaces = [];
+    let allRegistered = true;
+    for (const space of listed.data) {
+      if (allRegistered) {
+        const result = await this.spaces.register(space);
+        if (result.ok) {
+          spaces.push(result.data);
+          continue;
+        }
+        if (!options2.tolerateStorageFull || !(0, import_sdk_services7.isStorageFullError)(result.error)) {
+          return result;
+        }
+        allRegistered = false;
+      }
+      const record2 = spaceRecordFromInput(space);
+      spaces.push(spaceFromRecord(spaceKey(record2.space_id), record2));
+    }
+    return (0, import_sdk_services7.ok)({ spaces, allRegistered });
   }
   async resolveSpace(space) {
     const listed = await this.config.getSpaces().list();
     if (!listed.ok) return accountErr(listed.error);
     const found = listed.data.find((candidate) => candidate.id === space || candidate.name === space);
     if (!found) {
-      return (0, import_sdk_services6.err)(
-        (0, import_sdk_services6.serviceError)("SPACE_NOT_FOUND", `No account space found for ${JSON.stringify(space)}`, SERVICE_NAME2)
+      return (0, import_sdk_services7.err)(
+        (0, import_sdk_services7.serviceError)("SPACE_NOT_FOUND", `No account space found for ${JSON.stringify(space)}`, SERVICE_NAME2)
       );
     }
-    return (0, import_sdk_services6.ok)(found);
+    return (0, import_sdk_services7.ok)(found);
   }
   async replaceApplicationsIndexQuietly(applications) {
     await ignoreIndexFailure(async () => {
@@ -14968,7 +15021,7 @@ var AccountService = class {
       ]
     });
     if (!migrated.ok) return accountErr(migrated.error);
-    return (0, import_sdk_services6.ok)(void 0);
+    return (0, import_sdk_services7.ok)(void 0);
   }
 };
 function applicationKey(appId) {
@@ -15124,17 +15177,17 @@ function mapDelegation(delegation, space, direction) {
   };
 }
 function accountErr(error) {
-  return (0, import_sdk_services6.err)((0, import_sdk_services6.serviceError)(error.code, error.message, SERVICE_NAME2, { cause: error.cause, meta: error.meta }));
+  return (0, import_sdk_services7.err)((0, import_sdk_services7.serviceError)(error.code, error.message, SERVICE_NAME2, { cause: error.cause, meta: error.meta }));
 }
 function isMissingIndexError(error) {
   return /no such table:/i.test(error.message);
 }
 var AMBIGUOUS_WRITE_STATUSES = /* @__PURE__ */ new Set([500, 502, 503, 504, 520, 522, 524]);
 function isAmbiguousBatchFailure(error) {
-  if (error.code === import_sdk_services6.ErrorCodes.NETWORK_ERROR || error.code === import_sdk_services6.ErrorCodes.TIMEOUT) {
+  if (error.code === import_sdk_services7.ErrorCodes.NETWORK_ERROR || error.code === import_sdk_services7.ErrorCodes.TIMEOUT) {
     return error.meta?.requestMayHaveDispatched === true;
   }
-  if (error.code === import_sdk_services6.ErrorCodes.KV_WRITE_FAILED) {
+  if (error.code === import_sdk_services7.ErrorCodes.KV_WRITE_FAILED) {
     const status = error.meta?.status;
     return typeof status === "number" && AMBIGUOUS_WRITE_STATUSES.has(status);
   }
@@ -15148,7 +15201,7 @@ async function ignoreIndexFailure(task) {
 }
 
 // src/index.ts
-var import_sdk_services8 = require("@tinycloud/sdk-services");
+var import_sdk_services9 = require("@tinycloud/sdk-services");
 
 // src/space.ts
 async function fetchPeerId(host, spaceId) {
@@ -15157,7 +15210,9 @@ async function fetchPeerId(host, spaceId) {
   );
   if (!res.ok) {
     const error = await res.text().catch(() => res.statusText);
-    throw new Error(`Failed to get peer ID: ${res.status} - ${error}`);
+    throw Object.assign(new Error(`Failed to get peer ID: ${res.status} - ${error}`), {
+      status: res.status
+    });
   }
   return res.text();
 }
@@ -15247,7 +15302,7 @@ async function postSessionActivation(host, delegationHeader) {
 }
 
 // src/authorization/CapabilityKeyRegistry.ts
-var import_sdk_services7 = require("@tinycloud/sdk-services");
+var import_sdk_services8 = require("@tinycloud/sdk-services");
 var SERVICE_NAME3 = "capability-key-registry";
 var CapabilityKeyRegistryErrorCodes = {
   /** Key not found in registry */
@@ -15472,8 +15527,8 @@ var CapabilityKeyRegistry = class {
   revokeDelegation(cid2) {
     const stored = this.store.byCid.get(cid2);
     if (!stored || stored.length === 0) {
-      return (0, import_sdk_services7.err)(
-        (0, import_sdk_services7.serviceError)(
+      return (0, import_sdk_services8.err)(
+        (0, import_sdk_services8.serviceError)(
           CapabilityKeyRegistryErrorCodes.KEY_NOT_FOUND,
           `Delegation not found: ${cid2}`,
           SERVICE_NAME3
@@ -15493,7 +15548,7 @@ var CapabilityKeyRegistry = class {
         }
       }
     }
-    return (0, import_sdk_services7.ok)(void 0);
+    return (0, import_sdk_services8.ok)(void 0);
   }
   // ===========================================================================
   // Search