@tinycloud/sdk-core 3.0.1-beta.0 → 3.1.0-beta.10

package/dist/index.js

@@ -3437,6 +3437,32 @@ import { sha256 as sha2564 } from "@noble/hashes/sha256";
 import { blake3 } from "@noble/hashes/blake3";
 import { ed25519 as ed255193 } from "@noble/curves/ed25519";
 import { z as z2 } from "zod";
+
+// src/http-error.ts
+import { ErrorCodes, serviceError } from "@tinycloud/sdk-services";
+async function httpResponseError(response, context) {
+  let body;
+  try {
+    body = await response.text();
+  } catch {
+    body = response.statusText;
+  }
+  body = body.trim().slice(0, 512);
+  return Object.assign(new Error(`${context}: HTTP ${response.status}${body ? ` - ${body}` : ""}`), {
+    status: response.status
+  });
+}
+async function serviceHttpError(response, code3, context, service) {
+  const failure = await httpResponseError(response, context);
+  return serviceError(
+    response.status === 401 || response.status === 403 ? ErrorCodes.AUTH_UNAUTHORIZED : code3,
+    failure.message,
+    service,
+    { meta: { status: response.status } }
+  );
+}
+
+// src/policy/unified.ts
 var POLICY_V1_SCHEMA = "xyz.tinycloud.policy/policy/v1";
 var POLICY_CAPABILITY_V1_SCHEMA = "xyz.tinycloud.policy/capability/v1";
 var POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA = "xyz.tinycloud.policy/enforcement-delegation/v2";
@@ -3464,7 +3490,7 @@ async function requestPolicyChallengeV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ policyCid: input.policyCid, recipientDid: input.recipientDid, requestedCapabilities: input.requestedCapabilities.map(normalizeUnifiedPolicyCapability) })
   });
-  if (!response.ok) throw new Error(`policy challenge rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy challenge rejected");
   const value = object2(await response.json(), "policy challenge");
   if (typeof value.challengeId !== "string" || typeof value.nonce !== "string" || value.policyCid !== input.policyCid || value.recipientDid !== input.recipientDid)
     throw new Error("policy challenge binding is invalid");
@@ -3527,7 +3553,7 @@ async function getPolicyRootStatusV3(input) {
     redirect: "error",
     headers: { accept: "application/json" }
   });
-  if (!response.ok) throw new Error(`policy root status rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root status rejected");
   const value = object2(await response.json(), "policy root status");
   const checkpoint = object2(value.checkpoint, "policy root checkpoint");
   if (value.rootCid !== input.rootCid || value.state !== "active" && value.state !== "revoked" || value.state !== checkpoint.state || !verifyPolicyRootStatusCheckpointV3({ rootCid: input.rootCid, checkpoint, expectedNodeAudience: input.expectedNodeAudience, now: input.now }))
@@ -3587,9 +3613,12 @@ async function renewPolicyRootStatusV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ rootCid: input.rootCid, renewal: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.ownerDid, value: encodeBase64Url2(signature) } } })
   });
-  if (!response.ok) throw new Error(`policy root renewal rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root renewal rejected");
   return object2(await response.json(), "policy root renewal");
 }
+function rfc3339Seconds(value) {
+  return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(/\.000Z$/, "Z");
+}
 async function revokePolicyRootV3(input) {
   if (input.reason.length === 0) throw new Error("policy root revocation reason is required");
   const unsigned = {
@@ -3598,7 +3627,7 @@ async function revokePolicyRootV3(input) {
     targetRole: input.targetRole,
     ownerDid: input.ownerDid,
     nodeAudience: input.nodeAudience,
-    revokedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    revokedAt: rfc3339Seconds(input.now ?? /* @__PURE__ */ new Date()),
     reason: input.reason,
     issuerDid: input.issuerDid
   };
@@ -3611,7 +3640,7 @@ async function revokePolicyRootV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ revocation: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.issuerDid, value: encodeBase64Url2(signature) } } })
   });
-  if (!response.ok) throw new Error(`policy root revocation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root revocation rejected");
   return object2(await response.json(), "policy root revocation");
 }
 var POLICY_SESSION_FACT_KEYS = [
@@ -3880,7 +3909,7 @@ async function registerPolicyV3(input) {
     }
   );
   if (!bindingResponse.ok) {
-    throw new Error(`policy enforcer binding rejected (${bindingResponse.status})`);
+    throw await httpResponseError(bindingResponse, "policy enforcer binding rejected");
   }
   const binding = exactObject(
     await bindingResponse.json(),
@@ -3946,7 +3975,7 @@ async function registerPolicyV3(input) {
     }
   );
   if (!response.ok) {
-    throw new Error(`policy registration rejected (${response.status})`);
+    throw await httpResponseError(response, "policy registration rejected");
   }
   const receipt = exactObject(
     await response.json(),
@@ -4349,7 +4378,7 @@ function date(value, label) {
   if (!Number.isFinite(Date.parse(text2))) throw new Error(`${label} is invalid`);
   return text2;
 }
-function rfc3339Seconds(value) {
+function rfc3339Seconds2(value) {
   return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(/\.000Z$/, "Z");
 }
 function validateUnifiedPolicyV2(value, expectedPolicyCid) {
@@ -4514,8 +4543,8 @@ async function buildPolicyCredentialPresentationV4(input) {
     requirementDigest,
     descriptorDigest: input.credential.descriptorDigest,
     requestedCapabilities: Object.freeze(requestedCapabilities),
-    issuedAt: rfc3339Seconds(now),
-    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+    issuedAt: rfc3339Seconds2(now),
+    expiresAt: rfc3339Seconds2(new Date(expiresAtMs))
   }), input.sign);
 }
 async function buildPolicyCredentialPresentationV3(input) {
@@ -4569,8 +4598,8 @@ async function buildPolicyCredentialPresentationV3(input) {
     requirementDigest,
     descriptorDigest: input.credential.descriptorDigest,
     requestedCapabilities: Object.freeze(requestedCapabilities),
-    issuedAt: rfc3339Seconds(now),
-    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+    issuedAt: rfc3339Seconds2(now),
+    expiresAt: rfc3339Seconds2(new Date(expiresAtMs))
   });
   const digest4 = sha2565(
     new TextEncoder().encode(
@@ -4632,7 +4661,7 @@ async function admitPolicyCredentialV3(input) {
     requestedSessionExpiry(input.requestedExpiresAt, policy),
     input.signal
   );
-  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy delegation rejected");
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") {
     throw new Error("policy delegation response is invalid");
@@ -4685,7 +4714,7 @@ async function admitPolicyCredentialV4(input) {
     requestedSessionExpiry(input.requestedExpiresAt, policy),
     input.signal
   );
-  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy delegation rejected");
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") throw new Error("policy delegation response is invalid");
   const session = parsePolicySessionUcan(value.authorization, [
@@ -4704,7 +4733,7 @@ async function admitPolicyCredentialV4(input) {
     signal: input.signal,
     headers: { Authorization: session.authorization }
   });
-  if (!importResponse.ok) throw new Error(`delegation import rejected (${importResponse.status})`);
+  if (!importResponse.ok) throw await httpResponseError(importResponse, "delegation import rejected");
   input.signal?.throwIfAborted();
   return Object.freeze({ challenge, presentation, session, delegationImported: true });
 }
@@ -8160,8 +8189,17 @@ function canonicalizeRecapCaveats(caveats) {
   }
   return `[${branches.join(",")}]`;
 }
+var EXPLICIT_ONLY_ACTIONS = {
+  "tinycloud.kv/sync": true,
+  "tinycloud.kv/retain": true
+};
+function isExplicitOnlyAction(action) {
+  return Object.prototype.hasOwnProperty.call(EXPLICIT_ONLY_ACTIONS, action);
+}
 function actionContains(grantedAction, requestedAction) {
-  if (grantedAction === "*" || grantedAction === requestedAction) return true;
+  if (grantedAction === requestedAction) return true;
+  if (isExplicitOnlyAction(requestedAction)) return false;
+  if (grantedAction === "*") return true;
   if (!grantedAction.endsWith("/*")) return false;
   const service = grantedAction.slice(0, -2);
   return requestedAction === service || requestedAction.startsWith(`${service}/`);
@@ -8225,7 +8263,7 @@ import { ed25519 as ed255197 } from "@noble/curves/ed25519";
 
 // src/delegations/ShareRecipientClient.ts
 import {
-  ErrorCodes,
+  ErrorCodes as ErrorCodes2,
   KVService,
   ServiceContext
 } from "@tinycloud/sdk-services";
@@ -9346,7 +9384,7 @@ async function importPortableDelegation(fetchFn, host, delegation) {
     headers: { Authorization: parsed.delegationHeader.Authorization }
   });
   if (!response.ok)
-    throw new Error(`node rejected delegation import (${response.status})`);
+    throw await httpResponseError(response, "node rejected delegation import");
   const body = await response.json().catch(() => ({}));
   if (body === null || typeof body !== "object" || Array.isArray(body))
     return {};
@@ -9415,7 +9453,7 @@ function redactedCode(error) {
   if (error instanceof ShareConflict) return error.code;
   const code3 = error && typeof error === "object" && "code" in error ? error.code : void 0;
   if (typeof code3 !== "string") return "SHARE_INVALID";
-  if (code3 === ErrorCodes.KV_PRECONDITION_FAILED || code3 === ErrorCodes.KV_CONFLICT || code3 === "412") return "SHARE_CONFLICT";
+  if (code3 === ErrorCodes2.KV_PRECONDITION_FAILED || code3 === ErrorCodes2.KV_CONFLICT || code3 === "412") return "SHARE_CONFLICT";
   if (code3 === "KV_NOT_FOUND" || code3 === "NOT_FOUND" || code3 === "404") return "SHARE_NOT_FOUND";
   if (code3.includes("EXPIRED") || code3 === "expired") return "SHARE_EXPIRED";
   if (code3.includes("REVOK")) return "SHARE_REVOKED";
@@ -9654,7 +9692,7 @@ var ShareRecipientClient = class {
           if (portableDelegation !== void 0 && kv !== void 0) {
             const result2 = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
             if (!result2.ok) {
-              if (result2.error.code === ErrorCodes.KV_PRECONDITION_FAILED || result2.error.code === ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
+              if (result2.error.code === ErrorCodes2.KV_PRECONDITION_FAILED || result2.error.code === ErrorCodes2.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
               throw result2.error;
             }
             return { etag: result2.data.headers.etag };
@@ -9662,7 +9700,7 @@ var ShareRecipientClient = class {
           if (policySession !== void 0) return this.nativeSave(envelope, policySession, resolvedPath, bytes2, input);
           const result = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
           if (!result.ok) {
-            if (result.error.code === ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
+            if (result.error.code === ErrorCodes2.KV_PRECONDITION_FAILED || result.error.code === ErrorCodes2.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
             throw result.error;
           }
           return { etag: result.data.headers.etag };
@@ -10848,7 +10886,9 @@ var SharingService = class {
         if (delegation.allowSubDelegation === false) continue;
         if (!this.pathMatches(delegation.path || "", path)) continue;
         const delegationActions = delegation.actions || [];
-        if (!actions.every((action) => delegationActions.includes(action) || delegationActions.includes("*"))) {
+        if (!actions.every(
+          (action) => delegationActions.some((granted) => actionContains(granted, action))
+        )) {
           continue;
         }
         if ((delegation.caveats?.length ?? 0) > 0) {
@@ -12141,12 +12181,12 @@ import {
   HooksService,
   ok as ok2,
   err as err2,
-  serviceError as serviceError2,
-  ErrorCodes as ErrorCodes2
+  serviceError as serviceError3,
+  ErrorCodes as ErrorCodes3
 } from "@tinycloud/sdk-services";
 
 // src/spaces/SpaceService.ts
-import { ok, err, serviceError } from "@tinycloud/sdk-services";
+import { ok, err, serviceError as serviceError2, authorizationVerdictOf } from "@tinycloud/sdk-services";
 
 // src/spaces/Space.ts
 function unavailableSecretsService() {
@@ -12576,7 +12616,7 @@ var SpaceService = class {
   async list() {
     if (!this.session) {
       return err(
-        serviceError(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+        serviceError2(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     try {
@@ -12584,6 +12624,9 @@ var SpaceService = class {
       const ownedResult = await this.listOwnedSpaces();
       if (ownedResult.ok) {
         spaces.push(...ownedResult.data);
+      } else {
+        const verdict = authorizationVerdictOf(ownedResult.error);
+        if (verdict === "unauthenticated" || verdict === "forbidden") return err(ownedResult.error);
       }
       if (this.capabilityRegistry) {
         const delegatedSpaces = this.discoverDelegatedSpaces();
@@ -12596,7 +12639,7 @@ var SpaceService = class {
       return ok(uniqueSpaces);
     } catch (error) {
       return err(
-        serviceError(
+        serviceError2(
           SpaceErrorCodes.NETWORK_ERROR,
           `Failed to list spaces: ${String(error)}`,
           SERVICE_NAME,
@@ -12616,21 +12659,18 @@ var SpaceService = class {
         headers
       });
       if (!response.ok) {
-        const errorText = await response.text();
-        return err(
-          serviceError(
-            SpaceErrorCodes.NETWORK_ERROR,
-            `Failed to list owned spaces: ${response.status} - ${errorText}`,
-            SERVICE_NAME,
-            { meta: { status: response.status } }
-          )
-        );
+        return err(await serviceHttpError(
+          response,
+          SpaceErrorCodes.NETWORK_ERROR,
+          "Failed to list owned spaces",
+          SERVICE_NAME
+        ));
       }
       const rawData = await response.json();
       const validationResult = validateServerOwnedSpacesResponse(rawData);
       if (!validationResult.ok) {
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NETWORK_ERROR,
             validationResult.error.message,
             SERVICE_NAME,
@@ -12649,7 +12689,7 @@ var SpaceService = class {
       return ok(spaces);
     } catch (error) {
       return err(
-        serviceError(
+        serviceError2(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error listing owned spaces: ${String(error)}`,
           SERVICE_NAME,
@@ -12731,12 +12771,12 @@ var SpaceService = class {
   async create(name2) {
     if (!this.session) {
       return err(
-        serviceError(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+        serviceError2(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     if (!name2 || !/^[a-zA-Z0-9_-]+$/.test(name2)) {
       return err(
-        serviceError(
+        serviceError2(
           SpaceErrorCodes.INVALID_NAME,
           "Space name must contain only alphanumeric characters, underscores, and hyphens",
           SERVICE_NAME
@@ -12751,30 +12791,26 @@ var SpaceService = class {
         body: JSON.stringify({ name: name2 })
       });
       if (!response.ok) {
-        const errorText = await response.text();
         if (response.status === 409) {
-          return err(
-            serviceError(
-              SpaceErrorCodes.ALREADY_EXISTS,
-              `Space "${name2}" already exists`,
-              SERVICE_NAME
-            )
-          );
+          return err(await serviceHttpError(
+            response,
+            SpaceErrorCodes.ALREADY_EXISTS,
+            `Space "${name2}" already exists`,
+            SERVICE_NAME
+          ));
         }
-        return err(
-          serviceError(
-            SpaceErrorCodes.CREATION_FAILED,
-            `Failed to create space: ${response.status} - ${errorText}`,
-            SERVICE_NAME,
-            { meta: { status: response.status } }
-          )
-        );
+        return err(await serviceHttpError(
+          response,
+          SpaceErrorCodes.CREATION_FAILED,
+          "Failed to create space",
+          SERVICE_NAME
+        ));
       }
       const rawData = await response.json();
       const validationResult = validateServerCreateSpaceResponse(rawData);
       if (!validationResult.ok) {
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.CREATION_FAILED,
             validationResult.error.message,
             SERVICE_NAME,
@@ -12794,7 +12830,7 @@ var SpaceService = class {
       return ok(spaceInfo);
     } catch (error) {
       return err(
-        serviceError(
+        serviceError2(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error creating space: ${String(error)}`,
           SERVICE_NAME,
@@ -12882,7 +12918,7 @@ var SpaceService = class {
     }
     if (!this.session) {
       return err(
-        serviceError(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+        serviceError2(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     try {
@@ -12894,24 +12930,25 @@ var SpaceService = class {
       });
       if (!response.ok) {
         if (response.status === 404) {
-          return err(
-            serviceError(SpaceErrorCodes.NOT_FOUND, `Space not found: ${spaceId}`, SERVICE_NAME)
-          );
-        }
-        const errorText = await response.text();
-        return err(
-          serviceError(
-            SpaceErrorCodes.NETWORK_ERROR,
-            `Failed to get space info: ${response.status} - ${errorText}`,
+          return err(await serviceHttpError(
+            response,
+            SpaceErrorCodes.NOT_FOUND,
+            `Space not found: ${spaceId}`,
             SERVICE_NAME
-          )
-        );
+          ));
+        }
+        return err(await serviceHttpError(
+          response,
+          SpaceErrorCodes.NETWORK_ERROR,
+          "Failed to get space info",
+          SERVICE_NAME
+        ));
       }
       const rawData = await response.json();
       const validationResult = validateServerSpaceInfoResponse(rawData);
       if (!validationResult.ok) {
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NETWORK_ERROR,
             validationResult.error.message,
             SERVICE_NAME,
@@ -12932,7 +12969,7 @@ var SpaceService = class {
       return ok(spaceInfo);
     } catch (error) {
       return err(
-        serviceError(
+        serviceError2(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error getting space info: ${String(error)}`,
           SERVICE_NAME,
@@ -13017,20 +13054,18 @@ var SpaceService = class {
             headers
           });
           if (!response.ok) {
-            const errorText = await response.text();
-            return err(
-              serviceError(
-                SpaceErrorCodes.NETWORK_ERROR,
-                `Failed to list delegations: ${response.status} - ${errorText}`,
-                SERVICE_NAME
-              )
-            );
+            return err(await serviceHttpError(
+              response,
+              SpaceErrorCodes.NETWORK_ERROR,
+              "Failed to list delegations",
+              SERVICE_NAME
+            ));
           }
           const rawData = await response.json();
           const validationResult = validateServerDelegationsResponse(rawData);
           if (!validationResult.ok) {
             return err(
-              serviceError(
+              serviceError2(
                 SpaceErrorCodes.NETWORK_ERROR,
                 validationResult.error.message,
                 SERVICE_NAME,
@@ -13042,7 +13077,7 @@ var SpaceService = class {
           return ok(delegations);
         } catch (error) {
           return err(
-            serviceError(
+            serviceError2(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error listing delegations: ${String(error)}`,
               SERVICE_NAME
@@ -13072,20 +13107,18 @@ var SpaceService = class {
             headers
           });
           if (!response.ok) {
-            const errorText = await response.text();
-            return err(
-              serviceError(
-                SpaceErrorCodes.NETWORK_ERROR,
-                `Failed to list received delegations: ${response.status} - ${errorText}`,
-                SERVICE_NAME
-              )
-            );
+            return err(await serviceHttpError(
+              response,
+              SpaceErrorCodes.NETWORK_ERROR,
+              "Failed to list received delegations",
+              SERVICE_NAME
+            ));
           }
           const rawData = await response.json();
           const validationResult = validateServerDelegationsResponse(rawData);
           if (!validationResult.ok) {
             return err(
-              serviceError(
+              serviceError2(
                 SpaceErrorCodes.NETWORK_ERROR,
                 validationResult.error.message,
                 SERVICE_NAME,
@@ -13097,7 +13130,7 @@ var SpaceService = class {
           return ok(delegations);
         } catch (error) {
           return err(
-            serviceError(
+            serviceError2(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error listing received delegations: ${String(error)}`,
               SERVICE_NAME
@@ -13110,7 +13143,7 @@ var SpaceService = class {
           return self.createDelegationFn({ ...params, spaceId });
         }
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Delegation creation requires a createDelegation function. This should be provided by the platform SDK (web-sdk or node-sdk).",
             SERVICE_NAME
@@ -13131,19 +13164,17 @@ var SpaceService = class {
             body: JSON.stringify({ cid: cid2, spaceId })
           });
           if (!response.ok) {
-            const errorText = await response.text();
-            return err(
-              serviceError(
-                SpaceErrorCodes.NETWORK_ERROR,
-                `Failed to revoke delegation: ${response.status} - ${errorText}`,
-                SERVICE_NAME
-              )
-            );
+            return err(await serviceHttpError(
+              response,
+              SpaceErrorCodes.NETWORK_ERROR,
+              "Failed to revoke delegation",
+              SERVICE_NAME
+            ));
           }
           return ok(void 0);
         } catch (error) {
           return err(
-            serviceError(
+            serviceError2(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error revoking delegation: ${String(error)}`,
               SERVICE_NAME
@@ -13167,7 +13198,7 @@ var SpaceService = class {
           const result = await self.sharingService.generate(params);
           if (!result.ok) {
             return err(
-              serviceError(
+              serviceError2(
                 SpaceErrorCodes.NETWORK_ERROR,
                 result.error.message || "Failed to generate share link",
                 SERVICE_NAME
@@ -13177,7 +13208,7 @@ var SpaceService = class {
           return ok(result.data);
         }
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NOT_INITIALIZED,
             "SharingService not configured. V2 sharing requires a SharingService instance.",
             SERVICE_NAME
@@ -13186,7 +13217,7 @@ var SpaceService = class {
       },
       async list() {
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Listing share links is not supported in v2. Share links are self-contained tokens that are not tracked on the server.",
             SERVICE_NAME
@@ -13195,7 +13226,7 @@ var SpaceService = class {
       },
       async revoke(token) {
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Revoking share links by token is not supported in v2. To revoke access, revoke the underlying delegation using space.delegations.revoke(cid).",
             SERVICE_NAME
@@ -13532,8 +13563,8 @@ var TinyCloud = class _TinyCloud {
     const chainId = this.chainId();
     if (!address || !chainId) {
       return err2(
-        serviceError2(
-          ErrorCodes2.AUTH_REQUIRED,
+        serviceError3(
+          ErrorCodes3.AUTH_REQUIRED,
           "Must be signed in to ensure public space",
           "public-space"
         )
@@ -13541,8 +13572,8 @@ var TinyCloud = class _TinyCloud {
     }
     if (!this._serviceContext) {
       return err2(
-        serviceError2(
-          ErrorCodes2.AUTH_REQUIRED,
+        serviceError3(
+          ErrorCodes3.AUTH_REQUIRED,
           "Services not initialized. Call initializeServices() or signIn() first.",
           "public-space"
         )
@@ -13553,8 +13584,8 @@ var TinyCloud = class _TinyCloud {
       const session = this._serviceContext.session;
       if (!session) {
         return err2(
-          serviceError2(
-            ErrorCodes2.AUTH_REQUIRED,
+          serviceError3(
+            ErrorCodes3.AUTH_REQUIRED,
             "No active session",
             "public-space"
           )
@@ -13592,29 +13623,25 @@ var TinyCloud = class _TinyCloud {
           if (createResponse.status === 409) {
             return ok2(void 0);
           }
-          const errorText2 = await createResponse.text();
-          return err2(
-            serviceError2(
-              ErrorCodes2.NETWORK_ERROR,
-              `Failed to create public space: ${createResponse.status} - ${errorText2}`,
-              "public-space"
-            )
-          );
+          return err2(await serviceHttpError(
+            createResponse,
+            ErrorCodes3.NETWORK_ERROR,
+            "Failed to create public space",
+            "public-space"
+          ));
         }
         return ok2(void 0);
       }
-      const errorText = await response.text();
-      return err2(
-        serviceError2(
-          ErrorCodes2.NETWORK_ERROR,
-          `Failed to check public space: ${response.status} - ${errorText}`,
-          "public-space"
-        )
-      );
+      return err2(await serviceHttpError(
+        response,
+        ErrorCodes3.NETWORK_ERROR,
+        "Failed to check public space",
+        "public-space"
+      ));
     } catch (error) {
       return err2(
-        serviceError2(
-          ErrorCodes2.NETWORK_ERROR,
+        serviceError3(
+          ErrorCodes3.NETWORK_ERROR,
           `Network error ensuring public space: ${String(error)}`,
           "public-space",
           { cause: error instanceof Error ? error : void 0 }
@@ -13681,23 +13708,19 @@ var TinyCloud = class _TinyCloud {
       const response = await doFetch(url, { method: "GET" });
       if (!response.ok) {
         if (response.status === 404) {
-          return err2(
-            serviceError2(
-              ErrorCodes2.NOT_FOUND,
-              `Key not found: ${key} in space ${spaceId}`,
-              "public-space"
-            )
-          );
+          return err2(await serviceHttpError(
+            response,
+            ErrorCodes3.NOT_FOUND,
+            `Key not found: ${key} in space ${spaceId}`,
+            "public-space"
+          ));
         }
-        const errorText = await response.text();
-        return err2(
-          serviceError2(
-            ErrorCodes2.NETWORK_ERROR,
-            `Failed to read public space: ${response.status} - ${errorText}`,
-            "public-space",
-            { meta: { status: response.status } }
-          )
-        );
+        return err2(await serviceHttpError(
+          response,
+          ErrorCodes3.NETWORK_ERROR,
+          "Failed to read public space",
+          "public-space"
+        ));
       }
       const contentType = response.headers.get("content-type");
       let data;
@@ -13714,8 +13737,8 @@ var TinyCloud = class _TinyCloud {
       return ok2(data);
     } catch (error) {
       return err2(
-        serviceError2(
-          ErrorCodes2.NETWORK_ERROR,
+        serviceError3(
+          ErrorCodes3.NETWORK_ERROR,
           `Network error reading public space: ${String(error)}`,
           "public-space",
           { cause: error instanceof Error ? error : void 0 }
@@ -13744,8 +13767,9 @@ var TinyCloud = class _TinyCloud {
 import {
   err as err3,
   ok as ok3,
-  serviceError as serviceError3,
-  ErrorCodes as ErrorCodes3
+  serviceError as serviceError4,
+  ErrorCodes as ErrorCodes4,
+  isStorageFullError
 } from "@tinycloud/sdk-services";
 import { ACCOUNT_INDEX_SCHEMA } from "@tinycloud/bootstrap";
 var SERVICE_NAME2 = "account";
@@ -13759,10 +13783,10 @@ var AccountService = class {
      * Per-account-space memo for {@link ensureAccountIndex}.
      *
      * Applying the index migration is a no-op once the schema exists, but the
-     * SQL service still spends two round trips discovering that (create the
-     * migrations table, then read the applied-migration rows). Account bootstrap
-     * touches the index eight times, so without a memo that is ~14 wasted
-     * requests on the cold sign-in path. The in-flight dedupe inside SQLService
+     * SQL service still spends a round trip discovering that (reading the
+     * applied-migration rows). Account bootstrap touches the index eight times,
+     * so without a memo that is ~7 wasted requests on the cold sign-in path.
+     * The in-flight dedupe inside SQLService
      * never helps here: the node SDK builds a fresh SQLService per
      * `getAccountDb()` call, so its lock map is always empty.
      *
@@ -13809,7 +13833,7 @@ var AccountService = class {
         const request = composeManifestRequest(manifests);
         if (request.registryRecords.length === 0) {
           return err3(
-            serviceError3(
+            serviceError4(
               "INVALID_MANIFEST",
               "Manifest did not produce an account application registry record",
               SERVICE_NAME2
@@ -13860,11 +13884,12 @@ var AccountService = class {
           const indexed = await this.index.spaces.list();
           if (indexed.ok && indexed.data.length > 0) return indexed;
           if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
-          const canonical = await this.spaces.syncAccessible();
-          if (canonical.ok && options2.refreshIndex !== false) {
-            await this.replaceSpacesIndexQuietly(canonical.data);
+          const canonical = await this.syncAccessibleSpaces({ tolerateStorageFull: true });
+          if (!canonical.ok) return canonical;
+          if (canonical.data.allRegistered && options2.refreshIndex !== false) {
+            await this.replaceSpacesIndexQuietly(canonical.data.spaces);
           }
-          return canonical;
+          return ok3(canonical.data.spaces);
         }
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
@@ -13937,7 +13962,7 @@ var AccountService = class {
         }
         if (reconcileFailures.length > 0) {
           return err3(
-            serviceError3(
+            serviceError4(
               "KV_BATCH_RECONCILE_FAILED",
               `KV batch write for ${items.length} space(s) failed ambiguously (${batchResult.error.message}) and per-space reconciliation also failed for: ${reconcileFailures.join("; ")}`,
               SERVICE_NAME2,
@@ -13952,15 +13977,8 @@ var AccountService = class {
         return ok3({ spaces: registered, recoveredFromBatchError: batchResult.error });
       },
       syncAccessible: async () => {
-        const listed = await this.config.getSpaces().list();
-        if (!listed.ok) return accountErr(listed.error);
-        const registered = [];
-        for (const space of listed.data) {
-          const result = await this.spaces.register(space);
-          if (!result.ok) return result;
-          registered.push(result.data);
-        }
-        return ok3(registered);
+        const synced = await this.syncAccessibleSpaces({ tolerateStorageFull: false });
+        return synced.ok ? ok3(synced.data.spaces) : synced;
       },
       remove: async (spaceId) => {
         const kvResult = this.accountKV();
@@ -13975,7 +13993,7 @@ var AccountService = class {
       query: async (options2 = {}) => {
         const manager = this.config.getDelegationManager?.();
         if (!manager) {
-          return err3(serviceError3(
+          return err3(serviceError4(
             "NOT_INITIALIZED",
             "Delegation history requires an authenticated delegation manager",
             SERVICE_NAME2
@@ -14026,7 +14044,7 @@ var AccountService = class {
           return revoked2.ok ? ok3(revoked2.data) : accountErr(revoked2.error);
         }
         if (typeof input === "string") {
-          return err3(serviceError3(
+          return err3(serviceError4(
             "NOT_INITIALIZED",
             "CID-only revocation requires an authenticated delegation manager",
             SERVICE_NAME2
@@ -14232,7 +14250,7 @@ var AccountService = class {
     const accountSpaceId = this.config.getAccountSpaceId();
     if (!accountSpaceId) {
       return err3(
-        serviceError3(
+        serviceError4(
           "ACCOUNT_SPACE_UNAVAILABLE",
           "Account space is unavailable. Sign in with a wallet-backed profile first.",
           SERVICE_NAME2
@@ -14245,7 +14263,7 @@ var AccountService = class {
     const db = this.config.getAccountDb?.();
     if (!db) {
       return err3(
-        serviceError3(
+        serviceError4(
           "ACCOUNT_INDEX_UNAVAILABLE",
           "Account index database is unavailable. Sign in with a wallet-backed profile first.",
           SERVICE_NAME2
@@ -14392,13 +14410,41 @@ var AccountService = class {
     if (!deleted.ok) return accountErr(deleted.error);
     return ok3(void 0);
   }
+  /**
+   * Register every space the session can reach and return them. With
+   * `tolerateStorageFull`, a full account space stops the registration
+   * writes but not the listing: the remaining spaces are returned as they
+   * would have been registered, and `allRegistered` is false.
+   */
+  async syncAccessibleSpaces(options2) {
+    const listed = await this.config.getSpaces().list();
+    if (!listed.ok) return accountErr(listed.error);
+    const spaces = [];
+    let allRegistered = true;
+    for (const space of listed.data) {
+      if (allRegistered) {
+        const result = await this.spaces.register(space);
+        if (result.ok) {
+          spaces.push(result.data);
+          continue;
+        }
+        if (!options2.tolerateStorageFull || !isStorageFullError(result.error)) {
+          return result;
+        }
+        allRegistered = false;
+      }
+      const record2 = spaceRecordFromInput(space);
+      spaces.push(spaceFromRecord(spaceKey(record2.space_id), record2));
+    }
+    return ok3({ spaces, allRegistered });
+  }
   async resolveSpace(space) {
     const listed = await this.config.getSpaces().list();
     if (!listed.ok) return accountErr(listed.error);
     const found = listed.data.find((candidate) => candidate.id === space || candidate.name === space);
     if (!found) {
       return err3(
-        serviceError3("SPACE_NOT_FOUND", `No account space found for ${JSON.stringify(space)}`, SERVICE_NAME2)
+        serviceError4("SPACE_NOT_FOUND", `No account space found for ${JSON.stringify(space)}`, SERVICE_NAME2)
       );
     }
     return ok3(found);
@@ -14699,17 +14745,17 @@ function mapDelegation(delegation, space, direction) {
   };
 }
 function accountErr(error) {
-  return err3(serviceError3(error.code, error.message, SERVICE_NAME2, { cause: error.cause, meta: error.meta }));
+  return err3(serviceError4(error.code, error.message, SERVICE_NAME2, { cause: error.cause, meta: error.meta }));
 }
 function isMissingIndexError(error) {
   return /no such table:/i.test(error.message);
 }
 var AMBIGUOUS_WRITE_STATUSES = /* @__PURE__ */ new Set([500, 502, 503, 504, 520, 522, 524]);
 function isAmbiguousBatchFailure(error) {
-  if (error.code === ErrorCodes3.NETWORK_ERROR || error.code === ErrorCodes3.TIMEOUT) {
+  if (error.code === ErrorCodes4.NETWORK_ERROR || error.code === ErrorCodes4.TIMEOUT) {
     return error.meta?.requestMayHaveDispatched === true;
   }
-  if (error.code === ErrorCodes3.KV_WRITE_FAILED) {
+  if (error.code === ErrorCodes4.KV_WRITE_FAILED) {
     const status = error.meta?.status;
     return typeof status === "number" && AMBIGUOUS_WRITE_STATUSES.has(status);
   }
@@ -14729,8 +14775,14 @@ import {
   PrefixedKVService,
   ok as ok5,
   err as err5,
-  serviceError as serviceError5,
-  ErrorCodes as ErrorCodes4,
+  serviceError as serviceError6,
+  ErrorCodes as ErrorCodes5,
+  authorizationVerdictOf as authorizationVerdictOf2,
+  validatedCapabilityOf,
+  parseCapabilityResource,
+  isStorageFullError as isStorageFullError2,
+  STORAGE_FULL_MESSAGE,
+  STORAGE_WRITE_TOO_LARGE_MESSAGE,
   TinyCloudDebugLogger,
   tinyCloudDebugLogger,
   enableTinyCloudDebug,
@@ -14806,7 +14858,9 @@ async function fetchPeerId(host, spaceId) {
   );
   if (!res.ok) {
     const error = await res.text().catch(() => res.statusText);
-    throw new Error(`Failed to get peer ID: ${res.status} - ${error}`);
+    throw Object.assign(new Error(`Failed to get peer ID: ${res.status} - ${error}`), {
+      status: res.status
+    });
   }
   return res.text();
 }
@@ -14896,7 +14950,7 @@ async function postSessionActivation(host, delegationHeader) {
 }
 
 // src/authorization/CapabilityKeyRegistry.ts
-import { ok as ok4, err as err4, serviceError as serviceError4 } from "@tinycloud/sdk-services";
+import { ok as ok4, err as err4, serviceError as serviceError5 } from "@tinycloud/sdk-services";
 var SERVICE_NAME3 = "capability-key-registry";
 var CapabilityKeyRegistryErrorCodes = {
   /** Key not found in registry */
@@ -15122,7 +15176,7 @@ var CapabilityKeyRegistry = class {
     const stored = this.store.byCid.get(cid2);
     if (!stored || stored.length === 0) {
       return err4(
-        serviceError4(
+        serviceError5(
           CapabilityKeyRegistryErrorCodes.KEY_NOT_FOUND,
           `Delegation not found: ${cid2}`,
           SERVICE_NAME3
@@ -18554,7 +18608,7 @@ export {
   EXPIRY,
   EncryptionService,
   EnsDataSchema,
-  ErrorCodes4 as ErrorCodes,
+  ErrorCodes5 as ErrorCodes,
   HOLDER_BINDING_DOMAIN,
   HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,
   HOOKS,
@@ -18627,6 +18681,8 @@ export {
   SQL,
   SQLAction,
   SQLService2 as SQLService,
+  STORAGE_FULL_MESSAGE,
+  STORAGE_WRITE_TOO_LARGE_MESSAGE,
   SecretsService,
   SenderShareStore,
   ServiceContext3 as ServiceContext,
@@ -18677,6 +18733,7 @@ export {
   admitPolicyCredentialV3,
   admitPolicyCredentialV4,
   applyPrefix,
+  authorizationVerdictOf2 as authorizationVerdictOf,
   bootstrapEncryptionNetworkId,
   bootstrapSpaceId,
   bootstrapSteps,
@@ -18789,6 +18846,7 @@ export {
   hexEncode,
   holderBindingCanonicalBytes,
   holderBindingSigningBytes,
+  httpResponseError,
   httpUrlToMultiaddr,
   importPortableDelegation,
   installTinyCloudDebugGlobals,
@@ -18797,8 +18855,10 @@ export {
   isCapabilitySubset,
   isDigest,
   isEvmAddress,
+  isExplicitOnlyAction,
   isNetworkId,
   isPlausibleOpenKeyActionId,
+  isStorageFullError2 as isStorageFullError,
   isV2ShareLink,
   issuedCredentialEnvelopeFromVerified,
   jcsCanonicalize,
@@ -18822,6 +18882,7 @@ export {
   parseCanonicalRecapResource,
   parseCanonicalTinyCloudIdentity,
   parseCanonicalTinyCloudIdentityClaims,
+  parseCapabilityResource,
   parseCompactUcanAuthorization,
   parseExpiry,
   parseNetworkId2 as parseNetworkId,
@@ -18860,7 +18921,7 @@ export {
   revokePolicyRootV3,
   serialize as serializeJcsJson,
   serializePortableDelegation,
-  serviceError5 as serviceError,
+  serviceError6 as serviceError,
   sha256Base64Url,
   shareCapabilityAllows,
   signCompactPolicyDescendant,
@@ -18902,6 +18963,7 @@ export {
   validatePolicyUnsigned,
   validateShareDeliveryAuthorizationV3Bytes,
   validateUnifiedPolicyV2,
+  validatedCapabilityOf,
   verifyDecryptResponse,
   verifyDidKeyEd25519Signature,
   verifyEip191MessageSignature,