@tinycloud/sdk-core 3.1.0-beta.9 → 3.2.0-beta.0

package/dist/index.d.cts

@@ -1,13 +1,13 @@
 import { z } from 'zod';
-import { bq as CredentialHolderBinding, br as CredentialFlowDescriptor, bs as CredentialRequirement, bt as StoredCredentialRecord, bu as VerifiedCredential, bv as CredentialStorageReceipt, bw as IssuedCredentialEnvelope, bx as CredentialIssuerMetadata } from './credential-admission-BxpkckU0.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, by as CREDENTIAL_ACQUISITION_PROTOCOL, bz as CREDENTIAL_CONTRACT_VERSION, bA as CREDENTIAL_FORMAT, by as CREDENTIAL_PROTOCOL, bB as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bC as CredentialClaimDescriptor, bD as CredentialEndpointId, bE as CredentialInputDescriptor, bF as CredentialProgressEvent, bG as CredentialStepDescriptor, bH as CredentialStepType, bI as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bJ as HOLDER_BINDING_DOMAIN, bK as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as policyCidFromCanonicalBytes, aS as policyDigestHex, aT as policyIdForDigestHex, aU as policyV2DigestHex, aV as projectUnifiedPolicyCapabilities, aW as projectUnifiedPolicyCapability, aX as registerPolicyV3, aY as renewPolicyRootStatusV3, a_ as revokePolicyRootV3, a$ as signCompactPolicyDescendant, b0 as signCompactUcanAuthorization, b1 as signCompactUcanRootAuthorization, b2 as signPolicyCredentialPresentationV4, b3 as signedObjectIdFor, b4 as toSignedObjectError, b5 as unifiedNativeProjectionHashHex, b6 as unifiedPolicyCapabilityContains, b7 as unifiedPolicyCapabilityDigestHex, b8 as unifiedPolicyCapabilityFromNative, b9 as validatePolicyCredentialRequirementV1, ba as validatePolicyEngineRecordSigned, bb as validatePolicyEngineRecordSignedShape, bc as validatePolicyEngineRecordUnsigned, bd as validatePolicySigned, be as validatePolicySignedShape, bf as validatePolicyStatusSigned, bg as validatePolicyStatusSignedShape, bh as validatePolicyStatusUnsigned, bi as validatePolicyUnsigned, bj as validateUnifiedPolicyV2, bk as verifyPolicy, bl as verifyPolicyEngineRecord, bm as verifyPolicyRootRevocationV3, bn as verifyPolicyRootStatusCheckpointV3, bo as verifyPolicyStatus, bp as verifySignedObject } from './credential-admission-BxpkckU0.cjs';
+import { br as CredentialHolderBinding, bs as CredentialFlowDescriptor, bt as CredentialRequirement, bu as StoredCredentialRecord, bv as VerifiedCredential, bw as CredentialStorageReceipt, bx as IssuedCredentialEnvelope, by as CredentialIssuerMetadata } from './credential-admission-1EOQgdzY.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bz as CREDENTIAL_ACQUISITION_PROTOCOL, bA as CREDENTIAL_CONTRACT_VERSION, bB as CREDENTIAL_FORMAT, bz as CREDENTIAL_PROTOCOL, bC as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bD as CredentialClaimDescriptor, bE as CredentialEndpointId, bF as CredentialInputDescriptor, bG as CredentialProgressEvent, bH as CredentialStepDescriptor, bI as CredentialStepType, bJ as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bK as HOLDER_BINDING_DOMAIN, bL as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from './credential-admission-1EOQgdzY.cjs';
 export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, authorizationVerdictOf, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, isStorageFullError, networkDiscoveryKey, ok, openWrappedKey, parseCapabilityResource, parseNetworkId, parseSecretCatalogKey, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, validatedCapabilityOf, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
-import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-_JkBDZB6.cjs';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-_JkBDZB6.cjs';
-export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
+import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-D-IMys0b.cjs';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-D-IMys0b.cjs';
+export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.cjs';
 export { SiweMessage } from 'siwe';
 
@@ -3052,6 +3052,12 @@ declare class AccountService {
          * leave the first attempt's blocks orphaned.
          */
         registerBatch: (spaces: readonly (SpaceInfo | AccountSpace)[]) => Promise<Result<RegisterBatchSuccess>>;
+        /**
+         * Register only spaces without a registry record (TC-800). Existing
+         * records, including renamed or archived ones, are kept byte-for-byte.
+         * Bootstrap repair uses this on populated accounts.
+         */
+        registerMissing: (spaces: readonly (SpaceInfo | AccountSpace)[]) => Promise<Result<AccountSpace[]>>;
         syncAccessible: () => Promise<Result<AccountSpace[]>>;
         remove: (spaceId: string) => Promise<Result<void>>;
     };

package/dist/index.d.ts

@@ -1,13 +1,13 @@
 import { z } from 'zod';
-import { bq as CredentialHolderBinding, br as CredentialFlowDescriptor, bs as CredentialRequirement, bt as StoredCredentialRecord, bu as VerifiedCredential, bv as CredentialStorageReceipt, bw as IssuedCredentialEnvelope, bx as CredentialIssuerMetadata } from './credential-admission-CO9WMtGs.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, by as CREDENTIAL_ACQUISITION_PROTOCOL, bz as CREDENTIAL_CONTRACT_VERSION, bA as CREDENTIAL_FORMAT, by as CREDENTIAL_PROTOCOL, bB as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bC as CredentialClaimDescriptor, bD as CredentialEndpointId, bE as CredentialInputDescriptor, bF as CredentialProgressEvent, bG as CredentialStepDescriptor, bH as CredentialStepType, bI as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bJ as HOLDER_BINDING_DOMAIN, bK as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as policyCidFromCanonicalBytes, aS as policyDigestHex, aT as policyIdForDigestHex, aU as policyV2DigestHex, aV as projectUnifiedPolicyCapabilities, aW as projectUnifiedPolicyCapability, aX as registerPolicyV3, aY as renewPolicyRootStatusV3, a_ as revokePolicyRootV3, a$ as signCompactPolicyDescendant, b0 as signCompactUcanAuthorization, b1 as signCompactUcanRootAuthorization, b2 as signPolicyCredentialPresentationV4, b3 as signedObjectIdFor, b4 as toSignedObjectError, b5 as unifiedNativeProjectionHashHex, b6 as unifiedPolicyCapabilityContains, b7 as unifiedPolicyCapabilityDigestHex, b8 as unifiedPolicyCapabilityFromNative, b9 as validatePolicyCredentialRequirementV1, ba as validatePolicyEngineRecordSigned, bb as validatePolicyEngineRecordSignedShape, bc as validatePolicyEngineRecordUnsigned, bd as validatePolicySigned, be as validatePolicySignedShape, bf as validatePolicyStatusSigned, bg as validatePolicyStatusSignedShape, bh as validatePolicyStatusUnsigned, bi as validatePolicyUnsigned, bj as validateUnifiedPolicyV2, bk as verifyPolicy, bl as verifyPolicyEngineRecord, bm as verifyPolicyRootRevocationV3, bn as verifyPolicyRootStatusCheckpointV3, bo as verifyPolicyStatus, bp as verifySignedObject } from './credential-admission-CO9WMtGs.js';
+import { br as CredentialHolderBinding, bs as CredentialFlowDescriptor, bt as CredentialRequirement, bu as StoredCredentialRecord, bv as VerifiedCredential, bw as CredentialStorageReceipt, bx as IssuedCredentialEnvelope, by as CredentialIssuerMetadata } from './credential-admission-CJ1ZPqcx.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bz as CREDENTIAL_ACQUISITION_PROTOCOL, bA as CREDENTIAL_CONTRACT_VERSION, bB as CREDENTIAL_FORMAT, bz as CREDENTIAL_PROTOCOL, bC as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bD as CredentialClaimDescriptor, bE as CredentialEndpointId, bF as CredentialInputDescriptor, bG as CredentialProgressEvent, bH as CredentialStepDescriptor, bI as CredentialStepType, bJ as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bK as HOLDER_BINDING_DOMAIN, bL as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from './credential-admission-CJ1ZPqcx.js';
 export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, authorizationVerdictOf, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, isStorageFullError, networkDiscoveryKey, ok, openWrappedKey, parseCapabilityResource, parseNetworkId, parseSecretCatalogKey, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, validatedCapabilityOf, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
-import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-_JkBDZB6.js';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-_JkBDZB6.js';
-export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
+import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-D-IMys0b.js';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-D-IMys0b.js';
+export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';
 export { SiweMessage } from 'siwe';
 
@@ -3052,6 +3052,12 @@ declare class AccountService {
          * leave the first attempt's blocks orphaned.
          */
         registerBatch: (spaces: readonly (SpaceInfo | AccountSpace)[]) => Promise<Result<RegisterBatchSuccess>>;
+        /**
+         * Register only spaces without a registry record (TC-800). Existing
+         * records, including renamed or archived ones, are kept byte-for-byte.
+         * Bootstrap repair uses this on populated accounts.
+         */
+        registerMissing: (spaces: readonly (SpaceInfo | AccountSpace)[]) => Promise<Result<AccountSpace[]>>;
         syncAccessible: () => Promise<Result<AccountSpace[]>>;
         remove: (spaceId: string) => Promise<Result<void>>;
     };

package/dist/index.js

@@ -4207,6 +4207,34 @@ function parseCompactUcanAuthorization(input, expectedCid) {
     throw new Error("compact UCAN CID does not match exact Authorization bytes");
   return { authorization: input, cid: cid2, header, payload };
 }
+var SignedCompactAttenuationSchema = z2.record(z2.record(z2.array(z2.unknown()).min(1)));
+function parseSignedCompactUcanAttenuation(input, expectedCid) {
+  if (typeof input !== "string" || /\s/.test(input))
+    throw new Error("Authorization must be compact UCAN bytes");
+  const segments = input.split(".");
+  if (segments.length !== 3 || segments.some((segment) => segment.length === 0))
+    throw new Error("Authorization must have three compact segments");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  const headerValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url2(headerSegment)));
+  const payloadValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url2(payloadSegment)));
+  if (!isRecordValue(headerValue) || !isRecordValue(headerValue.jwk) || headerValue.alg !== "EdDSA" || headerValue.typ !== "JWT" || headerValue.ucv !== "0.10.0" || headerValue.jwk.kty !== "OKP" || headerValue.jwk.crv !== "Ed25519" || !isRecordValue(payloadValue) || typeof payloadValue.iss !== "string")
+    throw new Error("Authorization has an invalid signed UCAN header or issuer");
+  const att = SignedCompactAttenuationSchema.parse(payloadValue.att);
+  const principal = payloadValue.iss.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  const publicKey = didMaterial.length === 34 && didMaterial[0] === 237 && didMaterial[1] === 1 ? didMaterial.slice(2) : new Uint8Array();
+  const jwkKey = typeof headerValue.jwk.x === "string" ? decodeBase64Url2(headerValue.jwk.x) : new Uint8Array();
+  if (publicKey.length !== 32 || !equalBytes(publicKey, jwkKey))
+    throw new Error("compact UCAN JWK does not bind issuer");
+  const signature = decodeBase64Url2(signatureSegment);
+  if (!ed255193.verify(signature, new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), publicKey))
+    throw new Error("compact UCAN signature is invalid");
+  if (typeof payloadValue.aud !== "string" || payloadValue.aud.length === 0)
+    throw new Error("compact UCAN signed audience is missing");
+  const cid2 = CID.createV1(85, create(30, blake3(new TextEncoder().encode(input)))).toString();
+  if (expectedCid !== void 0 && cid2 !== expectedCid) throw new Error("compact UCAN CID does not match exact Authorization bytes");
+  return { cid: cid2, payload: { att, aud: payloadValue.aud } };
+}
 function parsePolicySessionUcan(authorization, expectedProofs) {
   const parsed = parseCompactUcanAuthorization(authorization);
   const fact = parsed.payload.fct[0];
@@ -6694,7 +6722,7 @@ var DelegationManager = class {
    * }
    * ```
    */
-  async revoke(cid2) {
+  async revoke(cid2, options2) {
     if (!cid2) {
       return {
         ok: false,
@@ -6714,15 +6742,20 @@ var DelegationManager = class {
           )
         };
       }
-      const headers = this.invokeAny(
-        this.session,
-        [{
-          resource: `urn:cid:${cid2}`,
-          service: "delegation",
-          path: "",
-          action: DelegationAction.REVOKE
-        }]
-      );
+      const entry = {
+        resource: `urn:cid:${cid2}`,
+        ...options2?.targetSpaceId === void 0 ? {} : { spaceId: options2.targetSpaceId },
+        service: "delegation",
+        path: "",
+        action: DelegationAction.REVOKE
+      };
+      if (options2?.authorityCid !== void 0) {
+        Object.defineProperty(entry, "revokeAuthorityCid", {
+          value: options2.authorityCid,
+          enumerable: false
+        });
+      }
+      const headers = this.invokeAny(this.session, [entry]);
       const response = await this.fetchFn(`${this.host}/revoke`, {
         method: "POST",
         headers
@@ -6880,7 +6913,8 @@ var DelegationManager = class {
         )
       };
     }
-    if (!this.accountSpaceId) {
+    const accountSpaceId = this.accountSpaceId;
+    if (!accountSpaceId) {
       return {
         ok: false,
         error: createError(
@@ -6891,7 +6925,7 @@ var DelegationManager = class {
     }
     try {
       const invocationHeaders = this.invokeAny(this.session, [{
-        spaceId: this.accountSpaceId,
+        spaceId: accountSpaceId,
         service: "delegation",
         path: "",
         action: DelegationAction.LIST
@@ -13976,6 +14010,56 @@ var AccountService = class {
         await this.upsertSpacesIndexQuietly(registered);
         return ok3({ spaces: registered, recoveredFromBatchError: batchResult.error });
       },
+      /**
+       * Register only spaces without a registry record (TC-800). Existing
+       * records, including renamed or archived ones, are kept byte-for-byte.
+       * Bootstrap repair uses this on populated accounts.
+       */
+      registerMissing: async (spaces) => {
+        if (spaces.length === 0) return ok3([]);
+        await this.config.ensureAccountSpaceHosted?.();
+        const kvResult = this.accountKV();
+        if (!kvResult.ok) return kvResult;
+        const kv = kvResult.data;
+        const stored = spaces.map((space) => spaceRecordFromInput(space));
+        const keys = stored.map((record2) => spaceKey(record2.space_id));
+        const read2 = await kv.batchGet(keys);
+        if (!read2.ok) return accountErr(read2.error);
+        const byKey = new Map(read2.data.results.map((result) => [result.key, result.result]));
+        const final = new Array(keys.length);
+        const missing = [];
+        for (let i = 0; i < keys.length; i++) {
+          const key = keys[i];
+          const result = byKey.get(key);
+          if (!result) {
+            return err3(serviceError4(
+              ErrorCodes4.NETWORK_ERROR,
+              `KV batch read omitted requested key ${JSON.stringify(key)}`,
+              SERVICE_NAME2
+            ));
+          }
+          if (result.ok) {
+            final[i] = spaceFromRecord(key, result.data.data);
+          } else if (result.error.code === ErrorCodes4.KV_NOT_FOUND) {
+            missing.push({ index: i, key, record: stored[i] });
+          } else {
+            return accountErr(result.error);
+          }
+        }
+        const creates = await Promise.all(missing.map(async ({ index, key, record: record2 }) => {
+          const written = await kv.put(key, record2, { ifNoneMatch: "*" });
+          if (written.ok) return { index, result: ok3(spaceFromRecord(key, record2)) };
+          const raced = await kv.get(key);
+          if (raced.ok) return { index, result: ok3(spaceFromRecord(key, raced.data.data)) };
+          return { index, result: err3(written.error) };
+        }));
+        for (const { index, result } of creates) {
+          if (!result.ok) return accountErr(result.error);
+          final[index] = result.data;
+        }
+        await this.upsertSpacesIndexQuietly(final);
+        return ok3(final);
+      },
       syncAccessible: async () => {
         const synced = await this.syncAccessibleSpaces({ tolerateStorageFull: false });
         return synced.ok ? ok3(synced.data.spaces) : synced;
@@ -16041,10 +16125,12 @@ import {
   BOOTSTRAP_SESSION_REQUESTS,
   BOOTSTRAP_SPACE_MANIFESTS,
   BOOTSTRAP_SPACE_NAMES,
+  AGENTS_SPACE,
   SECRET_RECORDS_SCHEMA,
   TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
   TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
   TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_AGENTS_SPACE_MANIFEST,
   TINYCLOUD_PUBLIC_SPACE_MANIFEST,
   TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   bootstrapEncryptionNetworkId,
@@ -18539,6 +18625,7 @@ export {
   ACCOUNT_MANIFEST_PERMISSIONS2 as ACCOUNT_MANIFEST_PERMISSIONS,
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE,
+  AGENTS_SPACE,
   ATTESTED_ENFORCER_BINDING_V2_SCHEMA,
   AccountService,
   AutoApproveSpaceCreationHandler,
@@ -18711,6 +18798,7 @@ export {
   SpaceErrorCodes,
   SpaceService,
   TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_AGENTS_SPACE_MANIFEST,
   TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
   TINYCLOUD_CANONICAL_IDENTITY_CLAIM,
   TINYCLOUD_DEFAULT_SPACE_MANIFEST,
@@ -18894,6 +18982,7 @@ export {
   parseSecretCatalogKey,
   parseShareArtifact,
   parseShareUrl,
+  parseSignedCompactUcanAttenuation,
   parseSpaceUri,
   pkhDid,
   policyCidFromCanonicalBytes,