@tinycloud/sdk-core 3.1.0-beta.3 → 3.1.0-beta.6

package/dist/index.js

@@ -3437,6 +3437,32 @@ import { sha256 as sha2564 } from "@noble/hashes/sha256";
 import { blake3 } from "@noble/hashes/blake3";
 import { ed25519 as ed255193 } from "@noble/curves/ed25519";
 import { z as z2 } from "zod";
+
+// src/http-error.ts
+import { ErrorCodes, serviceError } from "@tinycloud/sdk-services";
+async function httpResponseError(response, context) {
+  let body;
+  try {
+    body = await response.text();
+  } catch {
+    body = response.statusText;
+  }
+  body = body.trim().slice(0, 512);
+  return Object.assign(new Error(`${context}: HTTP ${response.status}${body ? ` - ${body}` : ""}`), {
+    status: response.status
+  });
+}
+async function serviceHttpError(response, code3, context, service) {
+  const failure = await httpResponseError(response, context);
+  return serviceError(
+    response.status === 401 || response.status === 403 ? ErrorCodes.AUTH_UNAUTHORIZED : code3,
+    failure.message,
+    service,
+    { meta: { status: response.status } }
+  );
+}
+
+// src/policy/unified.ts
 var POLICY_V1_SCHEMA = "xyz.tinycloud.policy/policy/v1";
 var POLICY_CAPABILITY_V1_SCHEMA = "xyz.tinycloud.policy/capability/v1";
 var POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA = "xyz.tinycloud.policy/enforcement-delegation/v2";
@@ -3464,7 +3490,7 @@ async function requestPolicyChallengeV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ policyCid: input.policyCid, recipientDid: input.recipientDid, requestedCapabilities: input.requestedCapabilities.map(normalizeUnifiedPolicyCapability) })
   });
-  if (!response.ok) throw new Error(`policy challenge rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy challenge rejected");
   const value = object2(await response.json(), "policy challenge");
   if (typeof value.challengeId !== "string" || typeof value.nonce !== "string" || value.policyCid !== input.policyCid || value.recipientDid !== input.recipientDid)
     throw new Error("policy challenge binding is invalid");
@@ -3527,7 +3553,7 @@ async function getPolicyRootStatusV3(input) {
     redirect: "error",
     headers: { accept: "application/json" }
   });
-  if (!response.ok) throw new Error(`policy root status rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root status rejected");
   const value = object2(await response.json(), "policy root status");
   const checkpoint = object2(value.checkpoint, "policy root checkpoint");
   if (value.rootCid !== input.rootCid || value.state !== "active" && value.state !== "revoked" || value.state !== checkpoint.state || !verifyPolicyRootStatusCheckpointV3({ rootCid: input.rootCid, checkpoint, expectedNodeAudience: input.expectedNodeAudience, now: input.now }))
@@ -3587,7 +3613,7 @@ async function renewPolicyRootStatusV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ rootCid: input.rootCid, renewal: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.ownerDid, value: encodeBase64Url2(signature) } } })
   });
-  if (!response.ok) throw new Error(`policy root renewal rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root renewal rejected");
   return object2(await response.json(), "policy root renewal");
 }
 function rfc3339Seconds(value) {
@@ -3614,7 +3640,7 @@ async function revokePolicyRootV3(input) {
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ revocation: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.issuerDid, value: encodeBase64Url2(signature) } } })
   });
-  if (!response.ok) throw new Error(`policy root revocation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy root revocation rejected");
   return object2(await response.json(), "policy root revocation");
 }
 var POLICY_SESSION_FACT_KEYS = [
@@ -3883,7 +3909,7 @@ async function registerPolicyV3(input) {
     }
   );
   if (!bindingResponse.ok) {
-    throw new Error(`policy enforcer binding rejected (${bindingResponse.status})`);
+    throw await httpResponseError(bindingResponse, "policy enforcer binding rejected");
   }
   const binding = exactObject(
     await bindingResponse.json(),
@@ -3949,7 +3975,7 @@ async function registerPolicyV3(input) {
     }
   );
   if (!response.ok) {
-    throw new Error(`policy registration rejected (${response.status})`);
+    throw await httpResponseError(response, "policy registration rejected");
   }
   const receipt = exactObject(
     await response.json(),
@@ -4635,7 +4661,7 @@ async function admitPolicyCredentialV3(input) {
     requestedSessionExpiry(input.requestedExpiresAt, policy),
     input.signal
   );
-  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy delegation rejected");
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") {
     throw new Error("policy delegation response is invalid");
@@ -4688,7 +4714,7 @@ async function admitPolicyCredentialV4(input) {
     requestedSessionExpiry(input.requestedExpiresAt, policy),
     input.signal
   );
-  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  if (!response.ok) throw await httpResponseError(response, "policy delegation rejected");
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") throw new Error("policy delegation response is invalid");
   const session = parsePolicySessionUcan(value.authorization, [
@@ -4707,7 +4733,7 @@ async function admitPolicyCredentialV4(input) {
     signal: input.signal,
     headers: { Authorization: session.authorization }
   });
-  if (!importResponse.ok) throw new Error(`delegation import rejected (${importResponse.status})`);
+  if (!importResponse.ok) throw await httpResponseError(importResponse, "delegation import rejected");
   input.signal?.throwIfAborted();
   return Object.freeze({ challenge, presentation, session, delegationImported: true });
 }
@@ -8228,7 +8254,7 @@ import { ed25519 as ed255197 } from "@noble/curves/ed25519";
 
 // src/delegations/ShareRecipientClient.ts
 import {
-  ErrorCodes,
+  ErrorCodes as ErrorCodes2,
   KVService,
   ServiceContext
 } from "@tinycloud/sdk-services";
@@ -9349,7 +9375,7 @@ async function importPortableDelegation(fetchFn, host, delegation) {
     headers: { Authorization: parsed.delegationHeader.Authorization }
   });
   if (!response.ok)
-    throw new Error(`node rejected delegation import (${response.status})`);
+    throw await httpResponseError(response, "node rejected delegation import");
   const body = await response.json().catch(() => ({}));
   if (body === null || typeof body !== "object" || Array.isArray(body))
     return {};
@@ -9418,7 +9444,7 @@ function redactedCode(error) {
   if (error instanceof ShareConflict) return error.code;
   const code3 = error && typeof error === "object" && "code" in error ? error.code : void 0;
   if (typeof code3 !== "string") return "SHARE_INVALID";
-  if (code3 === ErrorCodes.KV_PRECONDITION_FAILED || code3 === ErrorCodes.KV_CONFLICT || code3 === "412") return "SHARE_CONFLICT";
+  if (code3 === ErrorCodes2.KV_PRECONDITION_FAILED || code3 === ErrorCodes2.KV_CONFLICT || code3 === "412") return "SHARE_CONFLICT";
   if (code3 === "KV_NOT_FOUND" || code3 === "NOT_FOUND" || code3 === "404") return "SHARE_NOT_FOUND";
   if (code3.includes("EXPIRED") || code3 === "expired") return "SHARE_EXPIRED";
   if (code3.includes("REVOK")) return "SHARE_REVOKED";
@@ -9657,7 +9683,7 @@ var ShareRecipientClient = class {
           if (portableDelegation !== void 0 && kv !== void 0) {
             const result2 = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
             if (!result2.ok) {
-              if (result2.error.code === ErrorCodes.KV_PRECONDITION_FAILED || result2.error.code === ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
+              if (result2.error.code === ErrorCodes2.KV_PRECONDITION_FAILED || result2.error.code === ErrorCodes2.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
               throw result2.error;
             }
             return { etag: result2.data.headers.etag };
@@ -9665,7 +9691,7 @@ var ShareRecipientClient = class {
           if (policySession !== void 0) return this.nativeSave(envelope, policySession, resolvedPath, bytes2, input);
           const result = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
           if (!result.ok) {
-            if (result.error.code === ErrorCodes.KV_PRECONDITION_FAILED || result.error.code === ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
+            if (result.error.code === ErrorCodes2.KV_PRECONDITION_FAILED || result.error.code === ErrorCodes2.KV_CONFLICT) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
             throw result.error;
           }
           return { etag: result.data.headers.etag };
@@ -12144,12 +12170,12 @@ import {
   HooksService,
   ok as ok2,
   err as err2,
-  serviceError as serviceError2,
-  ErrorCodes as ErrorCodes2
+  serviceError as serviceError3,
+  ErrorCodes as ErrorCodes3
 } from "@tinycloud/sdk-services";
 
 // src/spaces/SpaceService.ts
-import { ok, err, serviceError } from "@tinycloud/sdk-services";
+import { ok, err, serviceError as serviceError2, authorizationVerdictOf } from "@tinycloud/sdk-services";
 
 // src/spaces/Space.ts
 function unavailableSecretsService() {
@@ -12579,7 +12605,7 @@ var SpaceService = class {
   async list() {
     if (!this.session) {
       return err(
-        serviceError(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+        serviceError2(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     try {
@@ -12587,6 +12613,9 @@ var SpaceService = class {
       const ownedResult = await this.listOwnedSpaces();
       if (ownedResult.ok) {
         spaces.push(...ownedResult.data);
+      } else {
+        const verdict = authorizationVerdictOf(ownedResult.error);
+        if (verdict === "unauthenticated" || verdict === "forbidden") return err(ownedResult.error);
       }
       if (this.capabilityRegistry) {
         const delegatedSpaces = this.discoverDelegatedSpaces();
@@ -12599,7 +12628,7 @@ var SpaceService = class {
       return ok(uniqueSpaces);
     } catch (error) {
       return err(
-        serviceError(
+        serviceError2(
           SpaceErrorCodes.NETWORK_ERROR,
           `Failed to list spaces: ${String(error)}`,
           SERVICE_NAME,
@@ -12619,21 +12648,18 @@ var SpaceService = class {
         headers
       });
       if (!response.ok) {
-        const errorText = await response.text();
-        return err(
-          serviceError(
-            SpaceErrorCodes.NETWORK_ERROR,
-            `Failed to list owned spaces: ${response.status} - ${errorText}`,
-            SERVICE_NAME,
-            { meta: { status: response.status } }
-          )
-        );
+        return err(await serviceHttpError(
+          response,
+          SpaceErrorCodes.NETWORK_ERROR,
+          "Failed to list owned spaces",
+          SERVICE_NAME
+        ));
       }
       const rawData = await response.json();
       const validationResult = validateServerOwnedSpacesResponse(rawData);
       if (!validationResult.ok) {
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NETWORK_ERROR,
             validationResult.error.message,
             SERVICE_NAME,
@@ -12652,7 +12678,7 @@ var SpaceService = class {
       return ok(spaces);
     } catch (error) {
       return err(
-        serviceError(
+        serviceError2(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error listing owned spaces: ${String(error)}`,
           SERVICE_NAME,
@@ -12734,12 +12760,12 @@ var SpaceService = class {
   async create(name2) {
     if (!this.session) {
       return err(
-        serviceError(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+        serviceError2(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     if (!name2 || !/^[a-zA-Z0-9_-]+$/.test(name2)) {
       return err(
-        serviceError(
+        serviceError2(
           SpaceErrorCodes.INVALID_NAME,
           "Space name must contain only alphanumeric characters, underscores, and hyphens",
           SERVICE_NAME
@@ -12754,30 +12780,26 @@ var SpaceService = class {
         body: JSON.stringify({ name: name2 })
       });
       if (!response.ok) {
-        const errorText = await response.text();
         if (response.status === 409) {
-          return err(
-            serviceError(
-              SpaceErrorCodes.ALREADY_EXISTS,
-              `Space "${name2}" already exists`,
-              SERVICE_NAME
-            )
-          );
+          return err(await serviceHttpError(
+            response,
+            SpaceErrorCodes.ALREADY_EXISTS,
+            `Space "${name2}" already exists`,
+            SERVICE_NAME
+          ));
         }
-        return err(
-          serviceError(
-            SpaceErrorCodes.CREATION_FAILED,
-            `Failed to create space: ${response.status} - ${errorText}`,
-            SERVICE_NAME,
-            { meta: { status: response.status } }
-          )
-        );
+        return err(await serviceHttpError(
+          response,
+          SpaceErrorCodes.CREATION_FAILED,
+          "Failed to create space",
+          SERVICE_NAME
+        ));
       }
       const rawData = await response.json();
       const validationResult = validateServerCreateSpaceResponse(rawData);
       if (!validationResult.ok) {
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.CREATION_FAILED,
             validationResult.error.message,
             SERVICE_NAME,
@@ -12797,7 +12819,7 @@ var SpaceService = class {
       return ok(spaceInfo);
     } catch (error) {
       return err(
-        serviceError(
+        serviceError2(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error creating space: ${String(error)}`,
           SERVICE_NAME,
@@ -12885,7 +12907,7 @@ var SpaceService = class {
     }
     if (!this.session) {
       return err(
-        serviceError(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+        serviceError2(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     try {
@@ -12897,24 +12919,25 @@ var SpaceService = class {
       });
       if (!response.ok) {
         if (response.status === 404) {
-          return err(
-            serviceError(SpaceErrorCodes.NOT_FOUND, `Space not found: ${spaceId}`, SERVICE_NAME)
-          );
-        }
-        const errorText = await response.text();
-        return err(
-          serviceError(
-            SpaceErrorCodes.NETWORK_ERROR,
-            `Failed to get space info: ${response.status} - ${errorText}`,
+          return err(await serviceHttpError(
+            response,
+            SpaceErrorCodes.NOT_FOUND,
+            `Space not found: ${spaceId}`,
             SERVICE_NAME
-          )
-        );
+          ));
+        }
+        return err(await serviceHttpError(
+          response,
+          SpaceErrorCodes.NETWORK_ERROR,
+          "Failed to get space info",
+          SERVICE_NAME
+        ));
       }
       const rawData = await response.json();
       const validationResult = validateServerSpaceInfoResponse(rawData);
       if (!validationResult.ok) {
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NETWORK_ERROR,
             validationResult.error.message,
             SERVICE_NAME,
@@ -12935,7 +12958,7 @@ var SpaceService = class {
       return ok(spaceInfo);
     } catch (error) {
       return err(
-        serviceError(
+        serviceError2(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error getting space info: ${String(error)}`,
           SERVICE_NAME,
@@ -13020,20 +13043,18 @@ var SpaceService = class {
             headers
           });
           if (!response.ok) {
-            const errorText = await response.text();
-            return err(
-              serviceError(
-                SpaceErrorCodes.NETWORK_ERROR,
-                `Failed to list delegations: ${response.status} - ${errorText}`,
-                SERVICE_NAME
-              )
-            );
+            return err(await serviceHttpError(
+              response,
+              SpaceErrorCodes.NETWORK_ERROR,
+              "Failed to list delegations",
+              SERVICE_NAME
+            ));
           }
           const rawData = await response.json();
           const validationResult = validateServerDelegationsResponse(rawData);
           if (!validationResult.ok) {
             return err(
-              serviceError(
+              serviceError2(
                 SpaceErrorCodes.NETWORK_ERROR,
                 validationResult.error.message,
                 SERVICE_NAME,
@@ -13045,7 +13066,7 @@ var SpaceService = class {
           return ok(delegations);
         } catch (error) {
           return err(
-            serviceError(
+            serviceError2(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error listing delegations: ${String(error)}`,
               SERVICE_NAME
@@ -13075,20 +13096,18 @@ var SpaceService = class {
             headers
           });
           if (!response.ok) {
-            const errorText = await response.text();
-            return err(
-              serviceError(
-                SpaceErrorCodes.NETWORK_ERROR,
-                `Failed to list received delegations: ${response.status} - ${errorText}`,
-                SERVICE_NAME
-              )
-            );
+            return err(await serviceHttpError(
+              response,
+              SpaceErrorCodes.NETWORK_ERROR,
+              "Failed to list received delegations",
+              SERVICE_NAME
+            ));
           }
           const rawData = await response.json();
           const validationResult = validateServerDelegationsResponse(rawData);
           if (!validationResult.ok) {
             return err(
-              serviceError(
+              serviceError2(
                 SpaceErrorCodes.NETWORK_ERROR,
                 validationResult.error.message,
                 SERVICE_NAME,
@@ -13100,7 +13119,7 @@ var SpaceService = class {
           return ok(delegations);
         } catch (error) {
           return err(
-            serviceError(
+            serviceError2(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error listing received delegations: ${String(error)}`,
               SERVICE_NAME
@@ -13113,7 +13132,7 @@ var SpaceService = class {
           return self.createDelegationFn({ ...params, spaceId });
         }
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Delegation creation requires a createDelegation function. This should be provided by the platform SDK (web-sdk or node-sdk).",
             SERVICE_NAME
@@ -13134,19 +13153,17 @@ var SpaceService = class {
             body: JSON.stringify({ cid: cid2, spaceId })
           });
           if (!response.ok) {
-            const errorText = await response.text();
-            return err(
-              serviceError(
-                SpaceErrorCodes.NETWORK_ERROR,
-                `Failed to revoke delegation: ${response.status} - ${errorText}`,
-                SERVICE_NAME
-              )
-            );
+            return err(await serviceHttpError(
+              response,
+              SpaceErrorCodes.NETWORK_ERROR,
+              "Failed to revoke delegation",
+              SERVICE_NAME
+            ));
           }
           return ok(void 0);
         } catch (error) {
           return err(
-            serviceError(
+            serviceError2(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error revoking delegation: ${String(error)}`,
               SERVICE_NAME
@@ -13170,7 +13187,7 @@ var SpaceService = class {
           const result = await self.sharingService.generate(params);
           if (!result.ok) {
             return err(
-              serviceError(
+              serviceError2(
                 SpaceErrorCodes.NETWORK_ERROR,
                 result.error.message || "Failed to generate share link",
                 SERVICE_NAME
@@ -13180,7 +13197,7 @@ var SpaceService = class {
           return ok(result.data);
         }
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NOT_INITIALIZED,
             "SharingService not configured. V2 sharing requires a SharingService instance.",
             SERVICE_NAME
@@ -13189,7 +13206,7 @@ var SpaceService = class {
       },
       async list() {
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Listing share links is not supported in v2. Share links are self-contained tokens that are not tracked on the server.",
             SERVICE_NAME
@@ -13198,7 +13215,7 @@ var SpaceService = class {
       },
       async revoke(token) {
         return err(
-          serviceError(
+          serviceError2(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Revoking share links by token is not supported in v2. To revoke access, revoke the underlying delegation using space.delegations.revoke(cid).",
             SERVICE_NAME
@@ -13535,8 +13552,8 @@ var TinyCloud = class _TinyCloud {
     const chainId = this.chainId();
     if (!address || !chainId) {
       return err2(
-        serviceError2(
-          ErrorCodes2.AUTH_REQUIRED,
+        serviceError3(
+          ErrorCodes3.AUTH_REQUIRED,
           "Must be signed in to ensure public space",
           "public-space"
         )
@@ -13544,8 +13561,8 @@ var TinyCloud = class _TinyCloud {
     }
     if (!this._serviceContext) {
       return err2(
-        serviceError2(
-          ErrorCodes2.AUTH_REQUIRED,
+        serviceError3(
+          ErrorCodes3.AUTH_REQUIRED,
           "Services not initialized. Call initializeServices() or signIn() first.",
           "public-space"
         )
@@ -13556,8 +13573,8 @@ var TinyCloud = class _TinyCloud {
       const session = this._serviceContext.session;
       if (!session) {
         return err2(
-          serviceError2(
-            ErrorCodes2.AUTH_REQUIRED,
+          serviceError3(
+            ErrorCodes3.AUTH_REQUIRED,
             "No active session",
             "public-space"
           )
@@ -13595,29 +13612,25 @@ var TinyCloud = class _TinyCloud {
           if (createResponse.status === 409) {
             return ok2(void 0);
           }
-          const errorText2 = await createResponse.text();
-          return err2(
-            serviceError2(
-              ErrorCodes2.NETWORK_ERROR,
-              `Failed to create public space: ${createResponse.status} - ${errorText2}`,
-              "public-space"
-            )
-          );
+          return err2(await serviceHttpError(
+            createResponse,
+            ErrorCodes3.NETWORK_ERROR,
+            "Failed to create public space",
+            "public-space"
+          ));
         }
         return ok2(void 0);
       }
-      const errorText = await response.text();
-      return err2(
-        serviceError2(
-          ErrorCodes2.NETWORK_ERROR,
-          `Failed to check public space: ${response.status} - ${errorText}`,
-          "public-space"
-        )
-      );
+      return err2(await serviceHttpError(
+        response,
+        ErrorCodes3.NETWORK_ERROR,
+        "Failed to check public space",
+        "public-space"
+      ));
     } catch (error) {
       return err2(
-        serviceError2(
-          ErrorCodes2.NETWORK_ERROR,
+        serviceError3(
+          ErrorCodes3.NETWORK_ERROR,
           `Network error ensuring public space: ${String(error)}`,
           "public-space",
           { cause: error instanceof Error ? error : void 0 }
@@ -13684,23 +13697,19 @@ var TinyCloud = class _TinyCloud {
       const response = await doFetch(url, { method: "GET" });
       if (!response.ok) {
         if (response.status === 404) {
-          return err2(
-            serviceError2(
-              ErrorCodes2.NOT_FOUND,
-              `Key not found: ${key} in space ${spaceId}`,
-              "public-space"
-            )
-          );
+          return err2(await serviceHttpError(
+            response,
+            ErrorCodes3.NOT_FOUND,
+            `Key not found: ${key} in space ${spaceId}`,
+            "public-space"
+          ));
         }
-        const errorText = await response.text();
-        return err2(
-          serviceError2(
-            ErrorCodes2.NETWORK_ERROR,
-            `Failed to read public space: ${response.status} - ${errorText}`,
-            "public-space",
-            { meta: { status: response.status } }
-          )
-        );
+        return err2(await serviceHttpError(
+          response,
+          ErrorCodes3.NETWORK_ERROR,
+          "Failed to read public space",
+          "public-space"
+        ));
       }
       const contentType = response.headers.get("content-type");
       let data;
@@ -13717,8 +13726,8 @@ var TinyCloud = class _TinyCloud {
       return ok2(data);
     } catch (error) {
       return err2(
-        serviceError2(
-          ErrorCodes2.NETWORK_ERROR,
+        serviceError3(
+          ErrorCodes3.NETWORK_ERROR,
           `Network error reading public space: ${String(error)}`,
           "public-space",
           { cause: error instanceof Error ? error : void 0 }
@@ -13747,8 +13756,8 @@ var TinyCloud = class _TinyCloud {
 import {
   err as err3,
   ok as ok3,
-  serviceError as serviceError3,
-  ErrorCodes as ErrorCodes3,
+  serviceError as serviceError4,
+  ErrorCodes as ErrorCodes4,
   isStorageFullError
 } from "@tinycloud/sdk-services";
 import { ACCOUNT_INDEX_SCHEMA } from "@tinycloud/bootstrap";
@@ -13813,7 +13822,7 @@ var AccountService = class {
         const request = composeManifestRequest(manifests);
         if (request.registryRecords.length === 0) {
           return err3(
-            serviceError3(
+            serviceError4(
               "INVALID_MANIFEST",
               "Manifest did not produce an account application registry record",
               SERVICE_NAME2
@@ -13942,7 +13951,7 @@ var AccountService = class {
         }
         if (reconcileFailures.length > 0) {
           return err3(
-            serviceError3(
+            serviceError4(
               "KV_BATCH_RECONCILE_FAILED",
               `KV batch write for ${items.length} space(s) failed ambiguously (${batchResult.error.message}) and per-space reconciliation also failed for: ${reconcileFailures.join("; ")}`,
               SERVICE_NAME2,
@@ -13973,7 +13982,7 @@ var AccountService = class {
       query: async (options2 = {}) => {
         const manager = this.config.getDelegationManager?.();
         if (!manager) {
-          return err3(serviceError3(
+          return err3(serviceError4(
             "NOT_INITIALIZED",
             "Delegation history requires an authenticated delegation manager",
             SERVICE_NAME2
@@ -14024,7 +14033,7 @@ var AccountService = class {
           return revoked2.ok ? ok3(revoked2.data) : accountErr(revoked2.error);
         }
         if (typeof input === "string") {
-          return err3(serviceError3(
+          return err3(serviceError4(
             "NOT_INITIALIZED",
             "CID-only revocation requires an authenticated delegation manager",
             SERVICE_NAME2
@@ -14230,7 +14239,7 @@ var AccountService = class {
     const accountSpaceId = this.config.getAccountSpaceId();
     if (!accountSpaceId) {
       return err3(
-        serviceError3(
+        serviceError4(
           "ACCOUNT_SPACE_UNAVAILABLE",
           "Account space is unavailable. Sign in with a wallet-backed profile first.",
           SERVICE_NAME2
@@ -14243,7 +14252,7 @@ var AccountService = class {
     const db = this.config.getAccountDb?.();
     if (!db) {
       return err3(
-        serviceError3(
+        serviceError4(
           "ACCOUNT_INDEX_UNAVAILABLE",
           "Account index database is unavailable. Sign in with a wallet-backed profile first.",
           SERVICE_NAME2
@@ -14424,7 +14433,7 @@ var AccountService = class {
     const found = listed.data.find((candidate) => candidate.id === space || candidate.name === space);
     if (!found) {
       return err3(
-        serviceError3("SPACE_NOT_FOUND", `No account space found for ${JSON.stringify(space)}`, SERVICE_NAME2)
+        serviceError4("SPACE_NOT_FOUND", `No account space found for ${JSON.stringify(space)}`, SERVICE_NAME2)
       );
     }
     return ok3(found);
@@ -14725,17 +14734,17 @@ function mapDelegation(delegation, space, direction) {
   };
 }
 function accountErr(error) {
-  return err3(serviceError3(error.code, error.message, SERVICE_NAME2, { cause: error.cause, meta: error.meta }));
+  return err3(serviceError4(error.code, error.message, SERVICE_NAME2, { cause: error.cause, meta: error.meta }));
 }
 function isMissingIndexError(error) {
   return /no such table:/i.test(error.message);
 }
 var AMBIGUOUS_WRITE_STATUSES = /* @__PURE__ */ new Set([500, 502, 503, 504, 520, 522, 524]);
 function isAmbiguousBatchFailure(error) {
-  if (error.code === ErrorCodes3.NETWORK_ERROR || error.code === ErrorCodes3.TIMEOUT) {
+  if (error.code === ErrorCodes4.NETWORK_ERROR || error.code === ErrorCodes4.TIMEOUT) {
     return error.meta?.requestMayHaveDispatched === true;
   }
-  if (error.code === ErrorCodes3.KV_WRITE_FAILED) {
+  if (error.code === ErrorCodes4.KV_WRITE_FAILED) {
     const status = error.meta?.status;
     return typeof status === "number" && AMBIGUOUS_WRITE_STATUSES.has(status);
   }
@@ -14755,9 +14764,11 @@ import {
   PrefixedKVService,
   ok as ok5,
   err as err5,
-  serviceError as serviceError5,
-  ErrorCodes as ErrorCodes4,
-  authorizationVerdictOf,
+  serviceError as serviceError6,
+  ErrorCodes as ErrorCodes5,
+  authorizationVerdictOf as authorizationVerdictOf2,
+  validatedCapabilityOf,
+  parseCapabilityResource,
   isStorageFullError as isStorageFullError2,
   STORAGE_FULL_MESSAGE,
   STORAGE_WRITE_TOO_LARGE_MESSAGE,
@@ -14836,7 +14847,9 @@ async function fetchPeerId(host, spaceId) {
   );
   if (!res.ok) {
     const error = await res.text().catch(() => res.statusText);
-    throw new Error(`Failed to get peer ID: ${res.status} - ${error}`);
+    throw Object.assign(new Error(`Failed to get peer ID: ${res.status} - ${error}`), {
+      status: res.status
+    });
   }
   return res.text();
 }
@@ -14926,7 +14939,7 @@ async function postSessionActivation(host, delegationHeader) {
 }
 
 // src/authorization/CapabilityKeyRegistry.ts
-import { ok as ok4, err as err4, serviceError as serviceError4 } from "@tinycloud/sdk-services";
+import { ok as ok4, err as err4, serviceError as serviceError5 } from "@tinycloud/sdk-services";
 var SERVICE_NAME3 = "capability-key-registry";
 var CapabilityKeyRegistryErrorCodes = {
   /** Key not found in registry */
@@ -15152,7 +15165,7 @@ var CapabilityKeyRegistry = class {
     const stored = this.store.byCid.get(cid2);
     if (!stored || stored.length === 0) {
       return err4(
-        serviceError4(
+        serviceError5(
           CapabilityKeyRegistryErrorCodes.KEY_NOT_FOUND,
           `Delegation not found: ${cid2}`,
           SERVICE_NAME3
@@ -18584,7 +18597,7 @@ export {
   EXPIRY,
   EncryptionService,
   EnsDataSchema,
-  ErrorCodes4 as ErrorCodes,
+  ErrorCodes5 as ErrorCodes,
   HOLDER_BINDING_DOMAIN,
   HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,
   HOOKS,
@@ -18709,7 +18722,7 @@ export {
   admitPolicyCredentialV3,
   admitPolicyCredentialV4,
   applyPrefix,
-  authorizationVerdictOf,
+  authorizationVerdictOf2 as authorizationVerdictOf,
   bootstrapEncryptionNetworkId,
   bootstrapSpaceId,
   bootstrapSteps,
@@ -18822,6 +18835,7 @@ export {
   hexEncode,
   holderBindingCanonicalBytes,
   holderBindingSigningBytes,
+  httpResponseError,
   httpUrlToMultiaddr,
   importPortableDelegation,
   installTinyCloudDebugGlobals,
@@ -18856,6 +18870,7 @@ export {
   parseCanonicalRecapResource,
   parseCanonicalTinyCloudIdentity,
   parseCanonicalTinyCloudIdentityClaims,
+  parseCapabilityResource,
   parseCompactUcanAuthorization,
   parseExpiry,
   parseNetworkId2 as parseNetworkId,
@@ -18894,7 +18909,7 @@ export {
   revokePolicyRootV3,
   serialize as serializeJcsJson,
   serializePortableDelegation,
-  serviceError5 as serviceError,
+  serviceError6 as serviceError,
   sha256Base64Url,
   shareCapabilityAllows,
   signCompactPolicyDescendant,
@@ -18936,6 +18951,7 @@ export {
   validatePolicyUnsigned,
   validateShareDeliveryAuthorizationV3Bytes,
   validateUnifiedPolicyV2,
+  validatedCapabilityOf,
   verifyDecryptResponse,
   verifyDidKeyEd25519Signature,
   verifyEip191MessageSignature,