@tinycloud/sdk-core 3.12.0-beta.3 → 3.12.0-beta.5

package/dist/index.d.cts

@@ -5,10 +5,10 @@ export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailbox
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { AuthorityRefusal, AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, IStorageService, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListPage, KVListResponse, KVPutOptions, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PinnedKey, PrefixedKVService, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaLocalEraseOutcome, ReplicaPurgeError, ReplicaPurgeFailedEvent, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedReplicationOptions, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageFullHandler, StorageFullMonitor, StorageRejectionDetails, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, appSecretScope, authorizationVerdictOf, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, isStorageFullError, networkDiscoveryKey, ok, openWrappedKey, parseCapabilityResource, parseNetworkId, parseSecretCatalogKey, parseStorageRejection, parseStorageStatus, resolveSecretListPrefix, resolveSecretPath, serviceError, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validatedCapabilityOf, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
-import { h as Delegation, d as CreateDelegationParams, G as GenerateShareParams, v as ShareLink, y as SpaceInfo, a as AccountDelegationQueryOptions, A as AccountDelegationPage, r as DelegationRevocationReceipt } from './types.schema-BmN-OnCA.cjs';
-export { b as AccountDelegationRecord, c as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationWasmParams, f as CreateDelegationWasmResult, g as DelegatedResource, i as DelegationApiResponse, j as DelegationChain, k as DelegationChainV2, l as DelegationDirection, D as DelegationError, m as DelegationErrorCode, n as DelegationErrorCodes, o as DelegationFilters, p as DelegationManagerConfig, q as DelegationRecord, R as DelegationResult, s as DelegationStatus, I as IngestOptions, J as JWK, K as KeyInfo, t as KeyProvider, u as KeyType, S as SessionInvocationSigner, w as ShareLinkData, x as ShareSchema, z as SpaceOwnership } from './types.schema-BmN-OnCA.cjs';
-import { I as ICapabilityKeyRegistry, h as ISharingService, f as DelegationManager } from './recipient-types.schema-BIJcihno.cjs';
-export { C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, bl as CapabilityKeyRegistry, bm as CapabilityKeyRegistryErrorCode, bn as CapabilityKeyRegistryErrorCodes, a as CreateOwnerDelegationParams, b as CredentialInvitationRequest, D as DELIVERY_ADMISSION_DOMAIN, c as DelegateReceivedShareParams, d as DelegatedShareAccess, e as DelegatedShareKey, g as DeliveryAdmission, E as EncodedShareData, M as MAX_CONTENT_BYTES, i as MAX_SEALED_SHARE_CONTENT_BYTES, j as MAX_SHARE_ARTIFACT_BYTES, k as MAX_SHARE_CONTENT_BYTES, l as MemorySenderShareKeyStorage, m as MemorySenderShareRecordStorage, n as MemoryShareCache, O as OwnerDelegationPermission, o as OwnerDelegationReceipt, p as OwnerShareAction, q as OwnerShareDecryption, r as OwnerShareMatcher, s as OwnerSharePolicyRegistration, t as OwnerSharePolicyRegistrationReceipt, u as OwnerSharePolicyV2, P as PortableDelegationImportReceipt, R as ReceiveOptions, v as RegisterOwnerSharePolicyParams, S as SenderShareKeyStorage, w as SenderShareRecord, x as SenderShareRecordStorage, y as SenderShareRevocationScope, z as SenderShareStore, A as ShareAccess, B as ShareAccessError, F as ShareAccessV2, G as ShareAction, J as ShareAddressedDelegationEnvelopeV2, K as ShareAddressedDelegationEnvelopeV2Schema, L as ShareAddressedDelegationRequestV2, N as ShareAddressedDelegationRequestV2Schema, Q as ShareAddressedDelegationResponseV2, T as ShareAddressedDelegationResponseV2Schema, U as ShareAddressedRecipientMatcher, V as ShareArtifactInput, W as ShareArtifactResult, X as ShareArtifactV2, Y as ShareCache, Z as ShareCacheEntry, _ as ShareCacheKey, $ as ShareCacheMetadata, a0 as ShareCapabilityLike, a1 as ShareConflict, a2 as ShareContentMetadata, a3 as ShareContentSource, a4 as ShareDelegationPreflight, a5 as ShareDeliveryAuthorizationV3Receipt, a6 as ShareDeliveryAuthorizationV3Request, a7 as ShareDeliveryRefusedError, a8 as ShareDetachedProof, a9 as ShareEnvelopeError, aa as ShareEnvelopeV2, ab as ShareExpiryBounds, ac as ShareKvContentSource, ad as ShareLinkLocation, ae as ShareListEntry, af as ShareListResult, ag as ShareNativeAction, ah as ShareNativeInvokeEnvelopeV1, ai as ShareNativeInvokeErrorResult, aj as ShareNativeInvokeInput, ak as ShareNativeInvokeResult, al as ShareNativeInvokeSuccessResult, am as ShareNativeResponse, an as ShareNativeResponseSchema, ao as SharePolicy, ap as SharePolicyBinding, aq as SharePolicySession, ar as SharePolicySessionV1, as as SharePolicySessionWireV1, at as SharePortableDelegation, au as ShareReadInvocationV1, av as ShareReadResult, aw as ShareRecipientClient, ax as ShareRecipientClientOptions, az as ShareRecipientPolicy, aB as ShareRecipientResult, aC as ShareRecipientTarget, aE as ShareResource, aG as ShareSaveOptions, aH as ShareSqlContentSource, aI as ShareWireAction, aJ as SharingService, aK as SharingServiceConfig, aL as SignedDelegation, bo as StoredDelegationChain, aM as VerifyShareEnvelopeOptions, aN as canonicalOwnerSharePolicy, aO as computeOwnerShareRegistrationCid, aP as computeShareCid, bp as createCapabilityKeyRegistry, aQ as createDelegatedShareKey, aR as createPolicyEnforcementDelegation, aS as createShareArtifact, aT as createShareArtifactAsync, aU as createSharePolicy, aV as createSharingService, aW as decryptShareBytesAsync, aX as delegatePortablePolicySession, aY as encodeInlineShareUrl, aZ as encodeShareArtifact, a_ as encodeShareUrl, a$ as encryptShareBytes, b0 as encryptShareBytesAsync, b1 as importPortableDelegation, b2 as intersectShareCapabilities, b3 as isV2ShareLink, b4 as normalizeShareActions, b5 as normalizeShareRecipientTarget, b6 as normalizeShareResource, b7 as parsePortableDelegation, b8 as parseShareArtifact, b9 as parseShareUrl, ba as restoreDelegatedShareKey, bb as serializePortableDelegation, bc as shareCapabilityAllows, bd as shortDeliveryLinkBodyCid, be as signShareEnvelope, bf as validateOwnerSharePolicyRegistration, bg as validateOwnerSharePolicyRegistrationBytes, bh as verifyShareCid, bi as verifyShareDeliveryAuthorizationV3Bytes, bj as verifyShareEnvelope, bk as withoutShareLink } from './recipient-types.schema-BIJcihno.cjs';
+import { h as Delegation, d as CreateDelegationParams, G as GenerateShareParams, v as ShareLink, y as SpaceInfo, a as AccountDelegationQueryOptions, A as AccountDelegationPage, r as DelegationRevocationReceipt } from './types.schema-B0ZUx7Ss.cjs';
+export { b as AccountDelegationRecord, c as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationWasmParams, f as CreateDelegationWasmResult, g as DelegatedResource, i as DelegationApiResponse, j as DelegationChain, k as DelegationChainV2, l as DelegationDirection, D as DelegationError, m as DelegationErrorCode, n as DelegationErrorCodes, o as DelegationFilters, p as DelegationManagerConfig, q as DelegationRecord, R as DelegationResult, s as DelegationStatus, I as IngestOptions, J as JWK, K as KeyInfo, t as KeyProvider, u as KeyType, S as SessionInvocationSigner, w as ShareLinkData, x as ShareSchema, z as SpaceOwnership } from './types.schema-B0ZUx7Ss.cjs';
+import { I as ICapabilityKeyRegistry, h as ISharingService, f as DelegationManager } from './recipient-types.schema-C-q64lEk.cjs';
+export { C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, bl as CapabilityKeyRegistry, bm as CapabilityKeyRegistryErrorCode, bn as CapabilityKeyRegistryErrorCodes, a as CreateOwnerDelegationParams, b as CredentialInvitationRequest, D as DELIVERY_ADMISSION_DOMAIN, c as DelegateReceivedShareParams, d as DelegatedShareAccess, e as DelegatedShareKey, g as DeliveryAdmission, E as EncodedShareData, M as MAX_CONTENT_BYTES, i as MAX_SEALED_SHARE_CONTENT_BYTES, j as MAX_SHARE_ARTIFACT_BYTES, k as MAX_SHARE_CONTENT_BYTES, l as MemorySenderShareKeyStorage, m as MemorySenderShareRecordStorage, n as MemoryShareCache, O as OwnerDelegationPermission, o as OwnerDelegationReceipt, p as OwnerShareAction, q as OwnerShareDecryption, r as OwnerShareMatcher, s as OwnerSharePolicyRegistration, t as OwnerSharePolicyRegistrationReceipt, u as OwnerSharePolicyV2, P as PortableDelegationImportReceipt, R as ReceiveOptions, v as RegisterOwnerSharePolicyParams, S as SenderShareKeyStorage, w as SenderShareRecord, x as SenderShareRecordStorage, y as SenderShareRevocationScope, z as SenderShareStore, A as ShareAccess, B as ShareAccessError, F as ShareAccessV2, G as ShareAction, J as ShareAddressedDelegationEnvelopeV2, K as ShareAddressedDelegationEnvelopeV2Schema, L as ShareAddressedDelegationRequestV2, N as ShareAddressedDelegationRequestV2Schema, Q as ShareAddressedDelegationResponseV2, T as ShareAddressedDelegationResponseV2Schema, U as ShareAddressedRecipientMatcher, V as ShareArtifactInput, W as ShareArtifactResult, X as ShareArtifactV2, Y as ShareCache, Z as ShareCacheEntry, _ as ShareCacheKey, $ as ShareCacheMetadata, a0 as ShareCapabilityLike, a1 as ShareConflict, a2 as ShareContentMetadata, a3 as ShareContentSource, a4 as ShareDelegationPreflight, a5 as ShareDeliveryAuthorizationV3Receipt, a6 as ShareDeliveryAuthorizationV3Request, a7 as ShareDeliveryRefusedError, a8 as ShareDetachedProof, a9 as ShareEnvelopeError, aa as ShareEnvelopeV2, ab as ShareExpiryBounds, ac as ShareKvContentSource, ad as ShareLinkLocation, ae as ShareListEntry, af as ShareListResult, ag as ShareNativeAction, ah as ShareNativeInvokeEnvelopeV1, ai as ShareNativeInvokeErrorResult, aj as ShareNativeInvokeInput, ak as ShareNativeInvokeResult, al as ShareNativeInvokeSuccessResult, am as ShareNativeResponse, an as ShareNativeResponseSchema, ao as SharePolicy, ap as SharePolicyBinding, aq as SharePolicySession, ar as SharePolicySessionV1, as as SharePolicySessionWireV1, at as SharePortableDelegation, au as ShareReadInvocationV1, av as ShareReadResult, aw as ShareRecipientClient, ax as ShareRecipientClientOptions, az as ShareRecipientPolicy, aB as ShareRecipientResult, aC as ShareRecipientTarget, aE as ShareResource, aG as ShareSaveOptions, aH as ShareSqlContentSource, aI as ShareWireAction, aJ as SharingService, aK as SharingServiceConfig, aL as SignedDelegation, bo as StoredDelegationChain, aM as VerifyShareEnvelopeOptions, aN as canonicalOwnerSharePolicy, aO as computeOwnerShareRegistrationCid, aP as computeShareCid, bp as createCapabilityKeyRegistry, aQ as createDelegatedShareKey, aR as createPolicyEnforcementDelegation, aS as createShareArtifact, aT as createShareArtifactAsync, aU as createSharePolicy, aV as createSharingService, aW as decryptShareBytesAsync, aX as delegatePortablePolicySession, aY as encodeInlineShareUrl, aZ as encodeShareArtifact, a_ as encodeShareUrl, a$ as encryptShareBytes, b0 as encryptShareBytesAsync, b1 as importPortableDelegation, b2 as intersectShareCapabilities, b3 as isV2ShareLink, b4 as normalizeShareActions, b5 as normalizeShareRecipientTarget, b6 as normalizeShareResource, b7 as parsePortableDelegation, b8 as parseShareArtifact, b9 as parseShareUrl, ba as restoreDelegatedShareKey, bb as serializePortableDelegation, bc as shareCapabilityAllows, bd as shortDeliveryLinkBodyCid, be as signShareEnvelope, bf as validateOwnerSharePolicyRegistration, bg as validateOwnerSharePolicyRegistrationBytes, bh as verifyShareCid, bi as verifyShareDeliveryAuthorizationV3Bytes, bj as verifyShareEnvelope, bk as withoutShareLink } from './recipient-types.schema-C-q64lEk.cjs';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.cjs';
 export { SiweMessage } from 'siwe';
@@ -1073,6 +1073,15 @@ declare function principalDidEquals(a: string, b: string): boolean;
 declare function didCacheKey(input: string, options?: DidCacheKeyOptions): string;
 declare function makePkhSpaceId(address: string, chainId: number, name: string): string;
 
+/**
+ * The public key of `jwk`: only the standard public members of its key type, plus `kid` when it is a string, are
+ * copied, so private members and anything else (`alg`, `use`, unknown fields) are dropped. Use it for every JWK that
+ * leaves the device.
+ *
+ * Throws for a key type without a public form (`oct`, unknown) or a missing public member.
+ */
+declare function publicJwk(jwk: unknown): Record<string, string>;
+
 type ReCapAttenuation = Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;
 /** A wallet-signed SIWE CACAO whose encoding, signature and exact-bytes CID were verified. */
 interface SignedSiweCacao {
@@ -3882,8 +3891,8 @@ declare function verifyRegistryCacheEntry(subject: string, ownerKey: string, ent
 /**
  * Signed-v2 registry policy for host resolution and space creation (TC-2481).
  * Every routing decision awaits a bounded refresh. A reverified cache younger
- * than one hour can serve transport/timeouts or HTTP 502/503/504 only. Genuine
- * absence and cold outages retain onboarding; invalid or known absent state refuses.
+ * than one hour can serve transport/timeouts or HTTP 502/503/504 only.
+ * Only verified absence permits onboarding; an outage without saved settings refuses.
  *
  * V2 owner keys are chain-independent: EOA records use the exact EIP-55
  * address and did:key records use the exact DID. V1 probes distinguish
@@ -4008,9 +4017,9 @@ interface LookupOwnerRegistryVerdictOptions {
     onRegistryFallback?: (reason: string, code?: RegistryFallbackReason) => void;
 }
 /**
- * {@link resolveOwnerHosts} for policy decisions: a lookup that throws, or no
- * configured registry, becomes {@link RegistryUnavailableError}. An
- * `unavailable` verdict is returned as a verdict.
+ * {@link resolveOwnerHosts} for policy decisions: a lookup that throws, no
+ * configured registry, or cold outage without saved settings becomes
+ * {@link RegistryUnavailableError}. Other `unavailable` verdicts remain verdicts.
  */
 declare function lookupOwnerRegistryVerdict(subject: string, options?: LookupOwnerRegistryVerdictOptions): Promise<RegistryVerdict>;
 /**
@@ -4136,4 +4145,4 @@ declare function assertExpiryWithinTechnicalLimit(expiresAt: Date | number, kind
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type CheckChangedExpirationInput, type ClassifyRegistryLookupOptions, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_NEW_USER_HOST, DEFAULT_REGISTRY_CACHE_STORAGE_KEY, DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS, DEFAULT_REGISTRY_OWNER_CHAIN_ID, DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type FailClosedHostOptions, type FailClosedHosts, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, type LocationRecordV2, type LocationRecordV2Payload, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type LookupOwnerRegistryVerdictOptions, MAX_SIWE_EXPIRY_MS, MAX_UCAN_EXPIRY_MS, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type NodeNotFoundContext, type NodeNotFoundDecision, NodeNotFoundError, NodeRegistryEntryExistsError, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OnNodeNotFound, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, REGISTRY_CACHE_MAX_AGE_MS, REGISTRY_LOOKUP_MAX_BODY_BYTES, REGISTRY_NOT_FOUND_BODY, type RecapAttenuation, type RegisterBatchSuccess, type RegisteredRegistryVerdict, type RegistryCacheEntry, type RegistryCacheRecord, type RegistryCacheStore, type RegistryCacheTombstone, type RegistryFallbackReason, type RegistryHost, type RegistryHostSource, RegistryLookupInputError, type RegistryLookupInputErrorCode, type RegistryLookupResponse, type RegistryPolicy, type RegistrySequenceStore, RegistryUnavailableError, type RegistryUnavailableReason, type RegistryVerdict, type RegistryVerdictSource, type RegistryVerdictStatus, type ResolveCloudLocationOptions, type ResolveOwnerHostsOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, type SignedSiweCacao, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TERMINAL_DELEGATION_FACT, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, type TechnicalExpiryKind, type TerminalDelegationSigningKey, TicketHolderBinding, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, type UnavailableRegistryVerdict, type UnregisteredRegistryVerdict, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, assertExpiryWithinTechnicalLimit, assertSpaceCreationAllowed, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalLocationPayloadV2, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkChangedExpiration, checkNodeInfo, classifyRegistryLookup, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createInMemoryRegistryCacheStore, createInMemoryRegistrySequenceStore, createLocalStorageLocalNodeIdentityStore, createLocalStorageRegistryCacheStore, createLocalStorageRegistrySequenceStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, exactHttpOrigin, expandActionShortNames, expandDelegationPermissionEntries, expandPermissionEntries, expandPermissionEntry, expandRuntimePermissionEntries, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, lookupOwnerRegistryVerdict, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, markDelegationTerminal, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSignedSiweCacao, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, refreshOwnerRegistry, registryOwnerKeyV2, registryOwnerSubjectV1, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveFailClosedTinyCloudHosts, resolveManifest, resolveManifestKnowledgeRoot, resolveOwnerHosts, resolveRegistryResource, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, signLocationRecordV2, submitHostDelegation, technicalExpiryRefusal, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateLocationRecordV2, validateLocationRecordV2Payload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyLocationRecordV2, verifyOwnerNodeBinding, verifyRegistryCacheEntry, verifyStorageReceipt, warnRegistryDefaultNode };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type CheckChangedExpirationInput, type ClassifyRegistryLookupOptions, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_NEW_USER_HOST, DEFAULT_REGISTRY_CACHE_STORAGE_KEY, DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS, DEFAULT_REGISTRY_OWNER_CHAIN_ID, DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type FailClosedHostOptions, type FailClosedHosts, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, type LocationRecordV2, type LocationRecordV2Payload, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type LookupOwnerRegistryVerdictOptions, MAX_SIWE_EXPIRY_MS, MAX_UCAN_EXPIRY_MS, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type NodeNotFoundContext, type NodeNotFoundDecision, NodeNotFoundError, NodeRegistryEntryExistsError, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OnNodeNotFound, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, REGISTRY_CACHE_MAX_AGE_MS, REGISTRY_LOOKUP_MAX_BODY_BYTES, REGISTRY_NOT_FOUND_BODY, type RecapAttenuation, type RegisterBatchSuccess, type RegisteredRegistryVerdict, type RegistryCacheEntry, type RegistryCacheRecord, type RegistryCacheStore, type RegistryCacheTombstone, type RegistryFallbackReason, type RegistryHost, type RegistryHostSource, RegistryLookupInputError, type RegistryLookupInputErrorCode, type RegistryLookupResponse, type RegistryPolicy, type RegistrySequenceStore, RegistryUnavailableError, type RegistryUnavailableReason, type RegistryVerdict, type RegistryVerdictSource, type RegistryVerdictStatus, type ResolveCloudLocationOptions, type ResolveOwnerHostsOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, type SignedSiweCacao, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TERMINAL_DELEGATION_FACT, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, type TechnicalExpiryKind, type TerminalDelegationSigningKey, TicketHolderBinding, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, type UnavailableRegistryVerdict, type UnregisteredRegistryVerdict, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, assertExpiryWithinTechnicalLimit, assertSpaceCreationAllowed, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalLocationPayloadV2, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkChangedExpiration, checkNodeInfo, classifyRegistryLookup, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createInMemoryRegistryCacheStore, createInMemoryRegistrySequenceStore, createLocalStorageLocalNodeIdentityStore, createLocalStorageRegistryCacheStore, createLocalStorageRegistrySequenceStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, exactHttpOrigin, expandActionShortNames, expandDelegationPermissionEntries, expandPermissionEntries, expandPermissionEntry, expandRuntimePermissionEntries, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, lookupOwnerRegistryVerdict, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, markDelegationTerminal, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSignedSiweCacao, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publicJwk, publishLocationRecord, recapCaveatsEqual, refreshOwnerRegistry, registryOwnerKeyV2, registryOwnerSubjectV1, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveFailClosedTinyCloudHosts, resolveManifest, resolveManifestKnowledgeRoot, resolveOwnerHosts, resolveRegistryResource, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, signLocationRecordV2, submitHostDelegation, technicalExpiryRefusal, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateLocationRecordV2, validateLocationRecordV2Payload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyLocationRecordV2, verifyOwnerNodeBinding, verifyRegistryCacheEntry, verifyStorageReceipt, warnRegistryDefaultNode };

package/dist/index.d.ts

@@ -5,10 +5,10 @@ export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailbox
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { AuthorityRefusal, AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, IStorageService, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListPage, KVListResponse, KVPutOptions, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PinnedKey, PrefixedKVService, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaLocalEraseOutcome, ReplicaPurgeError, ReplicaPurgeFailedEvent, ReplicaPurgeLocalCopyResult, ReplicaPurgeTrigger, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedReplicationOptions, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageFullHandler, StorageFullMonitor, StorageRejectionDetails, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, appSecretScope, authorizationVerdictOf, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, isStorageFullError, networkDiscoveryKey, ok, openWrappedKey, parseCapabilityResource, parseNetworkId, parseSecretCatalogKey, parseStorageRejection, parseStorageStatus, resolveSecretListPrefix, resolveSecretPath, serviceError, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validatedCapabilityOf, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
-import { h as Delegation, d as CreateDelegationParams, G as GenerateShareParams, v as ShareLink, y as SpaceInfo, a as AccountDelegationQueryOptions, A as AccountDelegationPage, r as DelegationRevocationReceipt } from './types.schema-BmN-OnCA.js';
-export { b as AccountDelegationRecord, c as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationWasmParams, f as CreateDelegationWasmResult, g as DelegatedResource, i as DelegationApiResponse, j as DelegationChain, k as DelegationChainV2, l as DelegationDirection, D as DelegationError, m as DelegationErrorCode, n as DelegationErrorCodes, o as DelegationFilters, p as DelegationManagerConfig, q as DelegationRecord, R as DelegationResult, s as DelegationStatus, I as IngestOptions, J as JWK, K as KeyInfo, t as KeyProvider, u as KeyType, S as SessionInvocationSigner, w as ShareLinkData, x as ShareSchema, z as SpaceOwnership } from './types.schema-BmN-OnCA.js';
-import { I as ICapabilityKeyRegistry, h as ISharingService, f as DelegationManager } from './recipient-types.schema-Ebi5aliq.js';
-export { C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, bl as CapabilityKeyRegistry, bm as CapabilityKeyRegistryErrorCode, bn as CapabilityKeyRegistryErrorCodes, a as CreateOwnerDelegationParams, b as CredentialInvitationRequest, D as DELIVERY_ADMISSION_DOMAIN, c as DelegateReceivedShareParams, d as DelegatedShareAccess, e as DelegatedShareKey, g as DeliveryAdmission, E as EncodedShareData, M as MAX_CONTENT_BYTES, i as MAX_SEALED_SHARE_CONTENT_BYTES, j as MAX_SHARE_ARTIFACT_BYTES, k as MAX_SHARE_CONTENT_BYTES, l as MemorySenderShareKeyStorage, m as MemorySenderShareRecordStorage, n as MemoryShareCache, O as OwnerDelegationPermission, o as OwnerDelegationReceipt, p as OwnerShareAction, q as OwnerShareDecryption, r as OwnerShareMatcher, s as OwnerSharePolicyRegistration, t as OwnerSharePolicyRegistrationReceipt, u as OwnerSharePolicyV2, P as PortableDelegationImportReceipt, R as ReceiveOptions, v as RegisterOwnerSharePolicyParams, S as SenderShareKeyStorage, w as SenderShareRecord, x as SenderShareRecordStorage, y as SenderShareRevocationScope, z as SenderShareStore, A as ShareAccess, B as ShareAccessError, F as ShareAccessV2, G as ShareAction, J as ShareAddressedDelegationEnvelopeV2, K as ShareAddressedDelegationEnvelopeV2Schema, L as ShareAddressedDelegationRequestV2, N as ShareAddressedDelegationRequestV2Schema, Q as ShareAddressedDelegationResponseV2, T as ShareAddressedDelegationResponseV2Schema, U as ShareAddressedRecipientMatcher, V as ShareArtifactInput, W as ShareArtifactResult, X as ShareArtifactV2, Y as ShareCache, Z as ShareCacheEntry, _ as ShareCacheKey, $ as ShareCacheMetadata, a0 as ShareCapabilityLike, a1 as ShareConflict, a2 as ShareContentMetadata, a3 as ShareContentSource, a4 as ShareDelegationPreflight, a5 as ShareDeliveryAuthorizationV3Receipt, a6 as ShareDeliveryAuthorizationV3Request, a7 as ShareDeliveryRefusedError, a8 as ShareDetachedProof, a9 as ShareEnvelopeError, aa as ShareEnvelopeV2, ab as ShareExpiryBounds, ac as ShareKvContentSource, ad as ShareLinkLocation, ae as ShareListEntry, af as ShareListResult, ag as ShareNativeAction, ah as ShareNativeInvokeEnvelopeV1, ai as ShareNativeInvokeErrorResult, aj as ShareNativeInvokeInput, ak as ShareNativeInvokeResult, al as ShareNativeInvokeSuccessResult, am as ShareNativeResponse, an as ShareNativeResponseSchema, ao as SharePolicy, ap as SharePolicyBinding, aq as SharePolicySession, ar as SharePolicySessionV1, as as SharePolicySessionWireV1, at as SharePortableDelegation, au as ShareReadInvocationV1, av as ShareReadResult, aw as ShareRecipientClient, ax as ShareRecipientClientOptions, az as ShareRecipientPolicy, aB as ShareRecipientResult, aC as ShareRecipientTarget, aE as ShareResource, aG as ShareSaveOptions, aH as ShareSqlContentSource, aI as ShareWireAction, aJ as SharingService, aK as SharingServiceConfig, aL as SignedDelegation, bo as StoredDelegationChain, aM as VerifyShareEnvelopeOptions, aN as canonicalOwnerSharePolicy, aO as computeOwnerShareRegistrationCid, aP as computeShareCid, bp as createCapabilityKeyRegistry, aQ as createDelegatedShareKey, aR as createPolicyEnforcementDelegation, aS as createShareArtifact, aT as createShareArtifactAsync, aU as createSharePolicy, aV as createSharingService, aW as decryptShareBytesAsync, aX as delegatePortablePolicySession, aY as encodeInlineShareUrl, aZ as encodeShareArtifact, a_ as encodeShareUrl, a$ as encryptShareBytes, b0 as encryptShareBytesAsync, b1 as importPortableDelegation, b2 as intersectShareCapabilities, b3 as isV2ShareLink, b4 as normalizeShareActions, b5 as normalizeShareRecipientTarget, b6 as normalizeShareResource, b7 as parsePortableDelegation, b8 as parseShareArtifact, b9 as parseShareUrl, ba as restoreDelegatedShareKey, bb as serializePortableDelegation, bc as shareCapabilityAllows, bd as shortDeliveryLinkBodyCid, be as signShareEnvelope, bf as validateOwnerSharePolicyRegistration, bg as validateOwnerSharePolicyRegistrationBytes, bh as verifyShareCid, bi as verifyShareDeliveryAuthorizationV3Bytes, bj as verifyShareEnvelope, bk as withoutShareLink } from './recipient-types.schema-Ebi5aliq.js';
+import { h as Delegation, d as CreateDelegationParams, G as GenerateShareParams, v as ShareLink, y as SpaceInfo, a as AccountDelegationQueryOptions, A as AccountDelegationPage, r as DelegationRevocationReceipt } from './types.schema-B0ZUx7Ss.js';
+export { b as AccountDelegationRecord, c as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationWasmParams, f as CreateDelegationWasmResult, g as DelegatedResource, i as DelegationApiResponse, j as DelegationChain, k as DelegationChainV2, l as DelegationDirection, D as DelegationError, m as DelegationErrorCode, n as DelegationErrorCodes, o as DelegationFilters, p as DelegationManagerConfig, q as DelegationRecord, R as DelegationResult, s as DelegationStatus, I as IngestOptions, J as JWK, K as KeyInfo, t as KeyProvider, u as KeyType, S as SessionInvocationSigner, w as ShareLinkData, x as ShareSchema, z as SpaceOwnership } from './types.schema-B0ZUx7Ss.js';
+import { I as ICapabilityKeyRegistry, h as ISharingService, f as DelegationManager } from './recipient-types.schema--5j8kRNE.js';
+export { C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, bl as CapabilityKeyRegistry, bm as CapabilityKeyRegistryErrorCode, bn as CapabilityKeyRegistryErrorCodes, a as CreateOwnerDelegationParams, b as CredentialInvitationRequest, D as DELIVERY_ADMISSION_DOMAIN, c as DelegateReceivedShareParams, d as DelegatedShareAccess, e as DelegatedShareKey, g as DeliveryAdmission, E as EncodedShareData, M as MAX_CONTENT_BYTES, i as MAX_SEALED_SHARE_CONTENT_BYTES, j as MAX_SHARE_ARTIFACT_BYTES, k as MAX_SHARE_CONTENT_BYTES, l as MemorySenderShareKeyStorage, m as MemorySenderShareRecordStorage, n as MemoryShareCache, O as OwnerDelegationPermission, o as OwnerDelegationReceipt, p as OwnerShareAction, q as OwnerShareDecryption, r as OwnerShareMatcher, s as OwnerSharePolicyRegistration, t as OwnerSharePolicyRegistrationReceipt, u as OwnerSharePolicyV2, P as PortableDelegationImportReceipt, R as ReceiveOptions, v as RegisterOwnerSharePolicyParams, S as SenderShareKeyStorage, w as SenderShareRecord, x as SenderShareRecordStorage, y as SenderShareRevocationScope, z as SenderShareStore, A as ShareAccess, B as ShareAccessError, F as ShareAccessV2, G as ShareAction, J as ShareAddressedDelegationEnvelopeV2, K as ShareAddressedDelegationEnvelopeV2Schema, L as ShareAddressedDelegationRequestV2, N as ShareAddressedDelegationRequestV2Schema, Q as ShareAddressedDelegationResponseV2, T as ShareAddressedDelegationResponseV2Schema, U as ShareAddressedRecipientMatcher, V as ShareArtifactInput, W as ShareArtifactResult, X as ShareArtifactV2, Y as ShareCache, Z as ShareCacheEntry, _ as ShareCacheKey, $ as ShareCacheMetadata, a0 as ShareCapabilityLike, a1 as ShareConflict, a2 as ShareContentMetadata, a3 as ShareContentSource, a4 as ShareDelegationPreflight, a5 as ShareDeliveryAuthorizationV3Receipt, a6 as ShareDeliveryAuthorizationV3Request, a7 as ShareDeliveryRefusedError, a8 as ShareDetachedProof, a9 as ShareEnvelopeError, aa as ShareEnvelopeV2, ab as ShareExpiryBounds, ac as ShareKvContentSource, ad as ShareLinkLocation, ae as ShareListEntry, af as ShareListResult, ag as ShareNativeAction, ah as ShareNativeInvokeEnvelopeV1, ai as ShareNativeInvokeErrorResult, aj as ShareNativeInvokeInput, ak as ShareNativeInvokeResult, al as ShareNativeInvokeSuccessResult, am as ShareNativeResponse, an as ShareNativeResponseSchema, ao as SharePolicy, ap as SharePolicyBinding, aq as SharePolicySession, ar as SharePolicySessionV1, as as SharePolicySessionWireV1, at as SharePortableDelegation, au as ShareReadInvocationV1, av as ShareReadResult, aw as ShareRecipientClient, ax as ShareRecipientClientOptions, az as ShareRecipientPolicy, aB as ShareRecipientResult, aC as ShareRecipientTarget, aE as ShareResource, aG as ShareSaveOptions, aH as ShareSqlContentSource, aI as ShareWireAction, aJ as SharingService, aK as SharingServiceConfig, aL as SignedDelegation, bo as StoredDelegationChain, aM as VerifyShareEnvelopeOptions, aN as canonicalOwnerSharePolicy, aO as computeOwnerShareRegistrationCid, aP as computeShareCid, bp as createCapabilityKeyRegistry, aQ as createDelegatedShareKey, aR as createPolicyEnforcementDelegation, aS as createShareArtifact, aT as createShareArtifactAsync, aU as createSharePolicy, aV as createSharingService, aW as decryptShareBytesAsync, aX as delegatePortablePolicySession, aY as encodeInlineShareUrl, aZ as encodeShareArtifact, a_ as encodeShareUrl, a$ as encryptShareBytes, b0 as encryptShareBytesAsync, b1 as importPortableDelegation, b2 as intersectShareCapabilities, b3 as isV2ShareLink, b4 as normalizeShareActions, b5 as normalizeShareRecipientTarget, b6 as normalizeShareResource, b7 as parsePortableDelegation, b8 as parseShareArtifact, b9 as parseShareUrl, ba as restoreDelegatedShareKey, bb as serializePortableDelegation, bc as shareCapabilityAllows, bd as shortDeliveryLinkBodyCid, be as signShareEnvelope, bf as validateOwnerSharePolicyRegistration, bg as validateOwnerSharePolicyRegistrationBytes, bh as verifyShareCid, bi as verifyShareDeliveryAuthorizationV3Bytes, bj as verifyShareEnvelope, bk as withoutShareLink } from './recipient-types.schema--5j8kRNE.js';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';
 export { SiweMessage } from 'siwe';
@@ -1073,6 +1073,15 @@ declare function principalDidEquals(a: string, b: string): boolean;
 declare function didCacheKey(input: string, options?: DidCacheKeyOptions): string;
 declare function makePkhSpaceId(address: string, chainId: number, name: string): string;
 
+/**
+ * The public key of `jwk`: only the standard public members of its key type, plus `kid` when it is a string, are
+ * copied, so private members and anything else (`alg`, `use`, unknown fields) are dropped. Use it for every JWK that
+ * leaves the device.
+ *
+ * Throws for a key type without a public form (`oct`, unknown) or a missing public member.
+ */
+declare function publicJwk(jwk: unknown): Record<string, string>;
+
 type ReCapAttenuation = Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;
 /** A wallet-signed SIWE CACAO whose encoding, signature and exact-bytes CID were verified. */
 interface SignedSiweCacao {
@@ -3882,8 +3891,8 @@ declare function verifyRegistryCacheEntry(subject: string, ownerKey: string, ent
 /**
  * Signed-v2 registry policy for host resolution and space creation (TC-2481).
  * Every routing decision awaits a bounded refresh. A reverified cache younger
- * than one hour can serve transport/timeouts or HTTP 502/503/504 only. Genuine
- * absence and cold outages retain onboarding; invalid or known absent state refuses.
+ * than one hour can serve transport/timeouts or HTTP 502/503/504 only.
+ * Only verified absence permits onboarding; an outage without saved settings refuses.
  *
  * V2 owner keys are chain-independent: EOA records use the exact EIP-55
  * address and did:key records use the exact DID. V1 probes distinguish
@@ -4008,9 +4017,9 @@ interface LookupOwnerRegistryVerdictOptions {
     onRegistryFallback?: (reason: string, code?: RegistryFallbackReason) => void;
 }
 /**
- * {@link resolveOwnerHosts} for policy decisions: a lookup that throws, or no
- * configured registry, becomes {@link RegistryUnavailableError}. An
- * `unavailable` verdict is returned as a verdict.
+ * {@link resolveOwnerHosts} for policy decisions: a lookup that throws, no
+ * configured registry, or cold outage without saved settings becomes
+ * {@link RegistryUnavailableError}. Other `unavailable` verdicts remain verdicts.
  */
 declare function lookupOwnerRegistryVerdict(subject: string, options?: LookupOwnerRegistryVerdictOptions): Promise<RegistryVerdict>;
 /**
@@ -4136,4 +4145,4 @@ declare function assertExpiryWithinTechnicalLimit(expiresAt: Date | number, kind
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type CheckChangedExpirationInput, type ClassifyRegistryLookupOptions, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_NEW_USER_HOST, DEFAULT_REGISTRY_CACHE_STORAGE_KEY, DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS, DEFAULT_REGISTRY_OWNER_CHAIN_ID, DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type FailClosedHostOptions, type FailClosedHosts, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, type LocationRecordV2, type LocationRecordV2Payload, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type LookupOwnerRegistryVerdictOptions, MAX_SIWE_EXPIRY_MS, MAX_UCAN_EXPIRY_MS, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type NodeNotFoundContext, type NodeNotFoundDecision, NodeNotFoundError, NodeRegistryEntryExistsError, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OnNodeNotFound, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, REGISTRY_CACHE_MAX_AGE_MS, REGISTRY_LOOKUP_MAX_BODY_BYTES, REGISTRY_NOT_FOUND_BODY, type RecapAttenuation, type RegisterBatchSuccess, type RegisteredRegistryVerdict, type RegistryCacheEntry, type RegistryCacheRecord, type RegistryCacheStore, type RegistryCacheTombstone, type RegistryFallbackReason, type RegistryHost, type RegistryHostSource, RegistryLookupInputError, type RegistryLookupInputErrorCode, type RegistryLookupResponse, type RegistryPolicy, type RegistrySequenceStore, RegistryUnavailableError, type RegistryUnavailableReason, type RegistryVerdict, type RegistryVerdictSource, type RegistryVerdictStatus, type ResolveCloudLocationOptions, type ResolveOwnerHostsOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, type SignedSiweCacao, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TERMINAL_DELEGATION_FACT, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, type TechnicalExpiryKind, type TerminalDelegationSigningKey, TicketHolderBinding, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, type UnavailableRegistryVerdict, type UnregisteredRegistryVerdict, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, assertExpiryWithinTechnicalLimit, assertSpaceCreationAllowed, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalLocationPayloadV2, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkChangedExpiration, checkNodeInfo, classifyRegistryLookup, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createInMemoryRegistryCacheStore, createInMemoryRegistrySequenceStore, createLocalStorageLocalNodeIdentityStore, createLocalStorageRegistryCacheStore, createLocalStorageRegistrySequenceStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, exactHttpOrigin, expandActionShortNames, expandDelegationPermissionEntries, expandPermissionEntries, expandPermissionEntry, expandRuntimePermissionEntries, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, lookupOwnerRegistryVerdict, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, markDelegationTerminal, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSignedSiweCacao, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, refreshOwnerRegistry, registryOwnerKeyV2, registryOwnerSubjectV1, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveFailClosedTinyCloudHosts, resolveManifest, resolveManifestKnowledgeRoot, resolveOwnerHosts, resolveRegistryResource, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, signLocationRecordV2, submitHostDelegation, technicalExpiryRefusal, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateLocationRecordV2, validateLocationRecordV2Payload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyLocationRecordV2, verifyOwnerNodeBinding, verifyRegistryCacheEntry, verifyStorageReceipt, warnRegistryDefaultNode };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type CheckChangedExpirationInput, type ClassifyRegistryLookupOptions, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_NEW_USER_HOST, DEFAULT_REGISTRY_CACHE_STORAGE_KEY, DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS, DEFAULT_REGISTRY_OWNER_CHAIN_ID, DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type FailClosedHostOptions, type FailClosedHosts, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, type LocationRecordV2, type LocationRecordV2Payload, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type LookupOwnerRegistryVerdictOptions, MAX_SIWE_EXPIRY_MS, MAX_UCAN_EXPIRY_MS, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type NodeNotFoundContext, type NodeNotFoundDecision, NodeNotFoundError, NodeRegistryEntryExistsError, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OnNodeNotFound, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, REGISTRY_CACHE_MAX_AGE_MS, REGISTRY_LOOKUP_MAX_BODY_BYTES, REGISTRY_NOT_FOUND_BODY, type RecapAttenuation, type RegisterBatchSuccess, type RegisteredRegistryVerdict, type RegistryCacheEntry, type RegistryCacheRecord, type RegistryCacheStore, type RegistryCacheTombstone, type RegistryFallbackReason, type RegistryHost, type RegistryHostSource, RegistryLookupInputError, type RegistryLookupInputErrorCode, type RegistryLookupResponse, type RegistryPolicy, type RegistrySequenceStore, RegistryUnavailableError, type RegistryUnavailableReason, type RegistryVerdict, type RegistryVerdictSource, type RegistryVerdictStatus, type ResolveCloudLocationOptions, type ResolveOwnerHostsOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, type SignedSiweCacao, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TERMINAL_DELEGATION_FACT, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, type TechnicalExpiryKind, type TerminalDelegationSigningKey, TicketHolderBinding, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, type UnavailableRegistryVerdict, type UnregisteredRegistryVerdict, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, assertExpiryWithinTechnicalLimit, assertSpaceCreationAllowed, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalLocationPayloadV2, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkChangedExpiration, checkNodeInfo, classifyRegistryLookup, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createInMemoryRegistryCacheStore, createInMemoryRegistrySequenceStore, createLocalStorageLocalNodeIdentityStore, createLocalStorageRegistryCacheStore, createLocalStorageRegistrySequenceStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, exactHttpOrigin, expandActionShortNames, expandDelegationPermissionEntries, expandPermissionEntries, expandPermissionEntry, expandRuntimePermissionEntries, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, lookupOwnerRegistryVerdict, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, markDelegationTerminal, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSignedSiweCacao, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publicJwk, publishLocationRecord, recapCaveatsEqual, refreshOwnerRegistry, registryOwnerKeyV2, registryOwnerSubjectV1, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveFailClosedTinyCloudHosts, resolveManifest, resolveManifestKnowledgeRoot, resolveOwnerHosts, resolveRegistryResource, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, signLocationRecordV2, submitHostDelegation, technicalExpiryRefusal, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateLocationRecordV2, validateLocationRecordV2Payload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyLocationRecordV2, verifyOwnerNodeBinding, verifyRegistryCacheEntry, verifyStorageReceipt, warnRegistryDefaultNode };

package/dist/index.js

@@ -845,6 +845,35 @@ function makePkhSpaceId(address, chainId, name2) {
   return `tinycloud:pkh:eip155:${chainId}:${canonicalizeAddress(address)}:${name2}`;
 }
 
+// src/jwk.ts
+var PUBLIC_MEMBERS = {
+  OKP: ["kty", "crv", "x"],
+  EC: ["kty", "crv", "x", "y"],
+  RSA: ["kty", "n", "e"]
+};
+var hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+function publicJwk(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new TypeError("A JWK must be an object");
+  }
+  const source = jwk;
+  const kty = hasOwn(source, "kty") ? source.kty : void 0;
+  const members = typeof kty === "string" && hasOwn(PUBLIC_MEMBERS, kty) ? PUBLIC_MEMBERS[kty] : void 0;
+  if (!members) {
+    throw new TypeError(`JWK key type ${JSON.stringify(kty)} has no public form`);
+  }
+  const result = {};
+  for (const member of members) {
+    const value = hasOwn(source, member) ? source[member] : void 0;
+    if (typeof value !== "string" || value === "") {
+      throw new TypeError(`JWK is missing its public "${member}" member`);
+    }
+    result[member] = value;
+  }
+  if (hasOwn(source, "kid") && typeof source.kid === "string") result.kid = source.kid;
+  return result;
+}
+
 // src/requester/index.ts
 import { bytesToHex as bytesToHex3, sha256 as sha2566 } from "viem";
 import { blake3 as blake32 } from "@noble/hashes/blake3";
@@ -1855,7 +1884,7 @@ function normalizePolicyCapabilityWithOptions(input, options2) {
   output.space = canonicalSpace;
   output.path = path;
   output.actions = actions;
-  if (hasOwn(object4, "caveats")) {
+  if (hasOwn2(object4, "caveats")) {
     output.caveats = validateCaveats(
       requiredValue(object4, "caveats", "$", "policy-capability-malformed-caveats"),
       output.service
@@ -1892,7 +1921,7 @@ function assertExactKeys(object4, allowed, path) {
   }
 }
 function requiredValue(object4, key, path, code3) {
-  if (!hasOwn(object4, key)) {
+  if (!hasOwn2(object4, key)) {
     throw new PolicyCapabilityError(code3, `${path}.${key} is required`);
   }
   return object4[key];
@@ -2092,7 +2121,7 @@ function assertCaveatKeys(object4, allowed, path) {
   }
 }
 function requiredCaveat(object4, key, path) {
-  if (!hasOwn(object4, key)) {
+  if (!hasOwn2(object4, key)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.${key} is required`
@@ -2132,7 +2161,7 @@ function caveatsContain(authority, request) {
     (statement) => authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement))
   );
 }
-function hasOwn(object4, key) {
+function hasOwn2(object4, key) {
   return objectHasOwn2(object4, key);
 }
 
@@ -2617,10 +2646,10 @@ function validatePolicyShape(input, signed) {
   validatePolicyResource(requiredValue2(object4, "resource", "$"), "$.resource");
   validateExpression(requiredValue2(object4, "when", "$"), "$.when");
   validateGrant(requiredValue2(object4, "grant", "$"), "$.grant");
-  if (hasOwn2(object4, "disclosure")) {
+  if (hasOwn3(object4, "disclosure")) {
     validateDisclosure(requiredValue2(object4, "disclosure", "$"), "$.disclosure");
   }
-  if (hasOwn2(object4, "audit")) {
+  if (hasOwn3(object4, "audit")) {
     validateAudit(requiredValue2(object4, "audit", "$"), "$.audit");
   }
   return object4;
@@ -2818,7 +2847,7 @@ function validateEvidenceRequirement(input, path) {
   requiredString2(object4, "requirementId", path);
   requiredString2(object4, "verifier", path);
   requiredValue2(object4, "requirements", path);
-  if (hasOwn2(object4, "authority")) {
+  if (hasOwn3(object4, "authority")) {
     const authority = expectJsonObject(requiredValue2(object4, "authority", path), `${path}.authority`);
     assertExactKeys2(
       authority,
@@ -2826,12 +2855,12 @@ function validateEvidenceRequirement(input, path) {
       `${path}.authority`
     );
     optionalString(authority, "profile", `${path}.authority`);
-    if (hasOwn2(authority, "acceptedIssuers")) {
+    if (hasOwn3(authority, "acceptedIssuers")) {
       requiredStringArray(authority, "acceptedIssuers", `${path}.authority`);
     }
     optionalBoolean(authority, "allowOwnerAuthorizedIssuer", `${path}.authority`);
   }
-  if (hasOwn2(object4, "freshness")) {
+  if (hasOwn3(object4, "freshness")) {
     const freshness = expectJsonObject(requiredValue2(object4, "freshness", path), `${path}.freshness`);
     assertExactKeys2(freshness, ["maxStatusAgeSeconds"], `${path}.freshness`);
     requiredInteger(freshness, "maxStatusAgeSeconds", `${path}.freshness`, 0);
@@ -2891,7 +2920,7 @@ function assertIdMatches(signed, material, descriptor) {
   throw new SignedObjectIdError(`${descriptor.idField} does not match ${descriptor.idPrefix}`);
 }
 function assertSigningKeyBindingForCreate(unsigned, signerDid) {
-  if (!hasOwn2(unsigned, "signingKeyDid")) {
+  if (!hasOwn3(unsigned, "signingKeyDid")) {
     return;
   }
   const signingKeyDid = requiredString2(unsigned, "signingKeyDid", "$");
@@ -2902,7 +2931,7 @@ function assertSigningKeyBindingForCreate(unsigned, signerDid) {
   }
 }
 function assertSigningKeyBindingForVerify(signed, signature) {
-  if (!hasOwn2(signed, "signingKeyDid")) {
+  if (!hasOwn3(signed, "signingKeyDid")) {
     return;
   }
   const signingKeyDid = requiredString2(signed, "signingKeyDid", "$");
@@ -3043,7 +3072,7 @@ function assertExactKeys2(object4, allowed, path) {
   }
 }
 function requiredValue2(object4, key, path) {
-  if (!hasOwn2(object4, key)) {
+  if (!hasOwn3(object4, key)) {
     throw new SignedObjectSchemaError(`${path}.${key} is required`);
   }
   return object4[key];
@@ -3052,7 +3081,7 @@ function requiredString2(object4, key, path) {
   return requireStringType(requiredValue2(object4, key, path), `${path}.${key}`);
 }
 function optionalString(object4, key, path) {
-  if (!hasOwn2(object4, key)) {
+  if (!hasOwn3(object4, key)) {
     return;
   }
   requireStringType(requiredValue2(object4, key, path), `${path}.${key}`);
@@ -3064,7 +3093,7 @@ function requireStringType(value, path) {
   return value;
 }
 function optionalBoolean(object4, key, path) {
-  if (!hasOwn2(object4, key)) {
+  if (!hasOwn3(object4, key)) {
     return;
   }
   if (typeof requiredValue2(object4, key, path) !== "boolean") {
@@ -3101,7 +3130,7 @@ function requiredDateString(object4, key, path) {
   assertRfc3339(requiredString2(object4, key, path), `${path}.${key}`);
 }
 function optionalDateString(object4, key, path) {
-  if (!hasOwn2(object4, key)) {
+  if (!hasOwn3(object4, key)) {
     return;
   }
   assertRfc3339(requiredString2(object4, key, path), `${path}.${key}`);
@@ -3136,7 +3165,7 @@ function expectOneOf(actual, allowed, path) {
   }
   throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);
 }
-function hasOwn2(object4, key) {
+function hasOwn3(object4, key) {
   return objectHasOwn3(object4, key);
 }
 function assertSupportedSignatureSuite(suite) {
@@ -3254,7 +3283,7 @@ async function verifyPolicyEngineRecordForRequester(options2) {
     ],
     "$"
   );
-  if (!hasOwn3(normalized, "signedRecord")) {
+  if (!hasOwn4(normalized, "signedRecord")) {
     throw new PolicyAuthoringError(
       "policy-engine-record-absent",
       "$.signedRecord must be present"
@@ -3328,14 +3357,14 @@ async function verifyPolicyEngineRecordForRequester(options2) {
       "$.signedRecord.grantIssuerDid does not match"
     );
   }
-  const requiredPolicyVersion = hasOwn3(normalized, "requiredPolicyVersion") ? requiredString3(normalized, "requiredPolicyVersion", "$") : POLICY_VERSION_V0;
+  const requiredPolicyVersion = hasOwn4(normalized, "requiredPolicyVersion") ? requiredString3(normalized, "requiredPolicyVersion", "$") : POLICY_VERSION_V0;
   if (!verified.supportedPolicyVersions.includes(requiredPolicyVersion)) {
     throw new PolicyAuthoringError(
       "policy-engine-record-policy-version-unsupported",
       "$.signedRecord.supportedPolicyVersions does not include the required version"
     );
   }
-  const requiredEvidenceVerifier = hasOwn3(
+  const requiredEvidenceVerifier = hasOwn4(
     normalized,
     "requiredEvidenceVerifier"
   ) ? requiredString3(normalized, "requiredEvidenceVerifier", "$") : W3C_VC_CREDENTIAL_VERIFIER;
@@ -3376,7 +3405,7 @@ function assertExactKeys3(object4, allowed, path) {
   }
 }
 function requiredValue3(object4, key, path) {
-  if (!hasOwn3(object4, key)) {
+  if (!hasOwn4(object4, key)) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
       `${path}.${key} is required`
@@ -3395,7 +3424,7 @@ function requiredString3(object4, key, path) {
   return value;
 }
 function fieldString(object4, key, path, code3) {
-  if (!hasOwn3(object4, key)) {
+  if (!hasOwn4(object4, key)) {
     throw new PolicyAuthoringError(code3, `${path}.${key} is required`);
   }
   const value = object4[key];
@@ -3436,7 +3465,7 @@ function parseStrictRfc3339(value, path) {
 var objectHasOwn4 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
   Object.prototype.hasOwnProperty
 );
-function hasOwn3(object4, key) {
+function hasOwn4(object4, key) {
   return objectHasOwn4(object4, key);
 }
 
@@ -20395,8 +20424,9 @@ async function lookupOwnerRegistryVerdict(subject, options2 = {}) {
       message: "no location registry is configured"
     });
   }
+  let verdict;
   try {
-    return await resolveOwnerHosts(subject, {
+    verdict = await resolveOwnerHosts(subject, {
       registryUrl: options2.registryUrl,
       sequenceStore: options2.sequenceStore,
       cacheStore: options2.cacheStore,
@@ -20410,6 +20440,12 @@ async function lookupOwnerRegistryVerdict(subject, options2 = {}) {
       cause: error
     });
   }
+  if (verdict.status === "unregistered" && verdict.offline) {
+    throw Object.assign(new RegistryUnavailableError(subject, void 0, {
+      message: "Couldn't reach your storage settings, and none are saved on this computer yet, so this didn't run. Try again in a few minutes."
+    }), { meta: { reason: "no-saved-settings" } });
+  }
+  return verdict;
 }
 async function resolveRegistryResource(subject, resource, access, options2) {
   const verdict = await lookupOwnerRegistryVerdict(subject, options2);
@@ -20986,6 +21022,7 @@ export {
   principalDidEquals,
   projectUnifiedPolicyCapabilities,
   projectUnifiedPolicyCapability,
+  publicJwk,
   publishLocationRecord,
   recapCaveatsEqual,
   refreshOwnerRegistry,