@tinycloud/sdk-core 3.8.0-beta.2 → 3.8.0-beta.21

package/dist/index.cjs

@@ -74,13 +74,13 @@ __export(index_exports, {
   ClientSessionSchema: () => ClientSessionSchema,
   CloudLocationResolutionError: () => CloudLocationResolutionError,
   CredentialError: () => CredentialError,
-  DECRYPT_ACTION: () => import_sdk_services9.DECRYPT_ACTION,
-  DECRYPT_FACT_TYPE: () => import_sdk_services9.DECRYPT_FACT_TYPE,
-  DECRYPT_RESULT_TYPE: () => import_sdk_services9.DECRYPT_RESULT_TYPE,
+  DECRYPT_ACTION: () => import_sdk_services10.DECRYPT_ACTION,
+  DECRYPT_FACT_TYPE: () => import_sdk_services10.DECRYPT_FACT_TYPE,
+  DECRYPT_RESULT_TYPE: () => import_sdk_services10.DECRYPT_RESULT_TYPE,
   DEFAULT_DEFAULTS: () => DEFAULT_DEFAULTS,
-  DEFAULT_ENCRYPTION_ALG: () => import_sdk_services9.DEFAULT_ENCRYPTION_ALG,
+  DEFAULT_ENCRYPTION_ALG: () => import_sdk_services10.DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY: () => DEFAULT_EXPIRY,
-  DEFAULT_KEY_VERSION: () => import_sdk_services9.DEFAULT_KEY_VERSION,
+  DEFAULT_KEY_VERSION: () => import_sdk_services10.DEFAULT_KEY_VERSION,
   DEFAULT_KNOWLEDGE_ROOT: () => DEFAULT_KNOWLEDGE_ROOT,
   DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY: () => DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY,
   DEFAULT_LOCAL_NODE_URL: () => DEFAULT_LOCAL_NODE_URL,
@@ -95,36 +95,36 @@ __export(index_exports, {
   DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL: () => DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
   DELIVERY_ADMISSION_DOMAIN: () => DELIVERY_ADMISSION_DOMAIN,
   DUCKDB: () => import_bootstrap4.DUCKDB,
-  DataVaultService: () => import_sdk_services9.DataVaultService,
-  DatabaseHandle: () => import_sdk_services9.DatabaseHandle,
-  DecryptTransportResponseError: () => import_sdk_services9.DecryptTransportResponseError,
+  DataVaultService: () => import_sdk_services10.DataVaultService,
+  DatabaseHandle: () => import_sdk_services10.DatabaseHandle,
+  DecryptTransportResponseError: () => import_sdk_services10.DecryptTransportResponseError,
   DelegationErrorCodes: () => DelegationErrorCodes,
   DelegationManager: () => DelegationManager,
-  DuckDbAction: () => import_sdk_services9.DuckDbAction,
-  DuckDbDatabaseHandle: () => import_sdk_services9.DuckDbDatabaseHandle,
-  DuckDbService: () => import_sdk_services9.DuckDbService,
+  DuckDbAction: () => import_sdk_services10.DuckDbAction,
+  DuckDbDatabaseHandle: () => import_sdk_services10.DuckDbDatabaseHandle,
+  DuckDbService: () => import_sdk_services10.DuckDbService,
   ED25519_JCS_SIGNATURE_SUITE: () => ED25519_JCS_SIGNATURE_SUITE,
   EIP191_JCS_SIGNATURE_SUITE: () => EIP191_JCS_SIGNATURE_SUITE,
   EMAIL_CREDENTIAL_MAX_AGE_SECONDS: () => EMAIL_CREDENTIAL_MAX_AGE_SECONDS,
   EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS: () => EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS,
   ENCRYPTION: () => import_bootstrap4.ENCRYPTION,
   ENCRYPTION_MANIFEST_SPACE: () => ENCRYPTION_MANIFEST_SPACE,
-  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_services9.ENCRYPTION_NETWORK_URN_PREFIX,
+  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_services10.ENCRYPTION_NETWORK_URN_PREFIX,
   ENCRYPTION_PERMISSION_SERVICE: () => ENCRYPTION_PERMISSION_SERVICE,
-  ENCRYPTION_SERVICE: () => import_sdk_services9.ENCRYPTION_SERVICE,
-  ENCRYPTION_SERVICE_SHORT: () => import_sdk_services9.ENCRYPTION_SERVICE_SHORT,
-  ENVELOPE_VERSION: () => import_sdk_services9.ENVELOPE_VERSION,
+  ENCRYPTION_SERVICE: () => import_sdk_services10.ENCRYPTION_SERVICE,
+  ENCRYPTION_SERVICE_SHORT: () => import_sdk_services10.ENCRYPTION_SERVICE_SHORT,
+  ENVELOPE_VERSION: () => import_sdk_services10.ENVELOPE_VERSION,
   EXPIRY: () => EXPIRY,
-  EncryptionService: () => import_sdk_services9.EncryptionService,
+  EncryptionService: () => import_sdk_services10.EncryptionService,
   EnsDataSchema: () => EnsDataSchema,
-  ErrorCodes: () => import_sdk_services9.ErrorCodes,
+  ErrorCodes: () => import_sdk_services10.ErrorCodes,
   HOLDER_BINDING_DOMAIN: () => HOLDER_BINDING_DOMAIN,
   HOLDER_KEY_BINDING_PRESENTATION_SCHEMA: () => HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,
   HOOKS: () => import_bootstrap4.HOOKS,
-  HooksService: () => import_sdk_services9.HooksService,
+  HooksService: () => import_sdk_services10.HooksService,
   IdentityParseError: () => IdentityParseError,
   KV: () => import_bootstrap4.KV,
-  KVService: () => import_sdk_services9.KVService,
+  KVService: () => import_sdk_services10.KVService,
   LAST_V2_CREATE_AT: () => LAST_V2_CREATE_AT,
   LAST_V2_READ_AT: () => LAST_V2_READ_AT,
   LISTEN_SQL_STATEMENT_CATALOG: () => LISTEN_SQL_STATEMENT_CATALOG,
@@ -136,7 +136,7 @@ __export(index_exports, {
   MAX_CONTENT_BYTES: () => MAX_CONTENT_BYTES,
   MAX_LEGACY_ENVELOPE_EXPIRES_AT: () => MAX_LEGACY_ENVELOPE_EXPIRES_AT,
   MAX_SEALED_SHARE_CONTENT_BYTES: () => MAX_SEALED_SHARE_CONTENT_BYTES,
-  MAX_SECRET_SCOPE_LENGTH: () => import_sdk_services9.MAX_SECRET_SCOPE_LENGTH,
+  MAX_SECRET_SCOPE_LENGTH: () => import_sdk_services10.MAX_SECRET_SCOPE_LENGTH,
   MAX_SHARE_ARTIFACT_BYTES: () => MAX_SHARE_ARTIFACT_BYTES,
   MAX_SHARE_CONTENT_BYTES: () => MAX_SHARE_CONTENT_BYTES,
   ManifestValidationError: () => ManifestValidationError,
@@ -144,8 +144,8 @@ __export(index_exports, {
   MemorySenderShareRecordStorage: () => MemorySenderShareRecordStorage,
   MemoryShareCache: () => MemoryShareCache,
   NATIVE_PROJECTION_V1_DOMAIN: () => NATIVE_PROJECTION_V1_DOMAIN,
-  NETWORK_NAME_PATTERN: () => import_sdk_services9.NETWORK_NAME_PATTERN,
-  NetworkIdError: () => import_sdk_services9.NetworkIdError,
+  NETWORK_NAME_PATTERN: () => import_sdk_services10.NETWORK_NAME_PATTERN,
+  NetworkIdError: () => import_sdk_services10.NetworkIdError,
   NodeNotFoundError: () => NodeNotFoundError,
   NodeRegistryEntryExistsError: () => NodeRegistryEntryExistsError,
   OPENKEY_ACTION_ID_SEPARATOR: () => OPENKEY_ACTION_ID_SEPARATOR,
@@ -174,7 +174,7 @@ __export(index_exports, {
   POLICY_V2_SCHEMA: () => POLICY_V2_SCHEMA,
   PORTABLE_DELEGATION_SCHEMA: () => PORTABLE_DELEGATION_SCHEMA,
   PermissionNotInManifestError: () => PermissionNotInManifestError,
-  PrefixedKVService: () => import_sdk_services9.PrefixedKVService,
+  PrefixedKVService: () => import_sdk_services10.PrefixedKVService,
   ProtocolMismatchError: () => ProtocolMismatchError,
   REGISTRY_LOOKUP_MAX_BODY_BYTES: () => REGISTRY_LOOKUP_MAX_BODY_BYTES,
   REGISTRY_NOT_FOUND_BODY: () => REGISTRY_NOT_FOUND_BODY,
@@ -189,22 +189,22 @@ __export(index_exports, {
   RegistryLookupInputError: () => RegistryLookupInputError,
   RegistryUnavailableError: () => RegistryUnavailableError,
   SECRETS_SPACE: () => SECRETS_SPACE,
-  SECRET_NAME_RE: () => import_sdk_services9.SECRET_NAME_RE,
+  SECRET_NAME_RE: () => import_sdk_services10.SECRET_NAME_RE,
   SECRET_RECORDS_SCHEMA: () => import_bootstrap4.SECRET_RECORDS_SCHEMA,
-  SECRET_SCOPE_RE: () => import_sdk_services9.SECRET_SCOPE_RE,
+  SECRET_SCOPE_RE: () => import_sdk_services10.SECRET_SCOPE_RE,
   SERVICE_LONG_TO_SHORT: () => SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG: () => SERVICE_SHORT_TO_LONG,
   SPACE: () => import_bootstrap4.SPACE,
   SQL: () => import_bootstrap4.SQL,
-  SQLAction: () => import_sdk_services9.SQLAction,
-  SQLService: () => import_sdk_services9.SQLService,
-  STORAGE_FULL_MESSAGE: () => import_sdk_services9.STORAGE_FULL_MESSAGE,
-  STORAGE_MANAGE_URL: () => import_sdk_services9.STORAGE_MANAGE_URL,
-  STORAGE_NEARLY_FULL_RATIO: () => import_sdk_services9.STORAGE_NEARLY_FULL_RATIO,
-  STORAGE_WRITE_TOO_LARGE_MESSAGE: () => import_sdk_services9.STORAGE_WRITE_TOO_LARGE_MESSAGE,
-  SecretsService: () => import_sdk_services9.SecretsService,
+  SQLAction: () => import_sdk_services10.SQLAction,
+  SQLService: () => import_sdk_services10.SQLService,
+  STORAGE_FULL_MESSAGE: () => import_sdk_services10.STORAGE_FULL_MESSAGE,
+  STORAGE_MANAGE_URL: () => import_sdk_services10.STORAGE_MANAGE_URL,
+  STORAGE_NEARLY_FULL_RATIO: () => import_sdk_services10.STORAGE_NEARLY_FULL_RATIO,
+  STORAGE_WRITE_TOO_LARGE_MESSAGE: () => import_sdk_services10.STORAGE_WRITE_TOO_LARGE_MESSAGE,
+  SecretsService: () => import_sdk_services10.SecretsService,
   SenderShareStore: () => SenderShareStore,
-  ServiceContext: () => import_sdk_services9.ServiceContext,
+  ServiceContext: () => import_sdk_services10.ServiceContext,
   SessionExpiredError: () => SessionExpiredError,
   ShareAccessError: () => ShareAccessError,
   ShareAddressedDelegationEnvelopeV2Schema: () => ShareAddressedDelegationEnvelopeV2Schema,
@@ -230,8 +230,8 @@ __export(index_exports, {
   Space: () => Space,
   SpaceErrorCodes: () => SpaceErrorCodes,
   SpaceService: () => SpaceService,
-  StorageFullMonitor: () => import_sdk_services9.StorageFullMonitor,
-  TC832_RESERVED_SCOPES: () => import_sdk_services9.TC832_RESERVED_SCOPES,
+  StorageFullMonitor: () => import_sdk_services10.StorageFullMonitor,
+  TC832_RESERVED_SCOPES: () => import_sdk_services10.TC832_RESERVED_SCOPES,
   TERMINAL_DELEGATION_FACT: () => TERMINAL_DELEGATION_FACT,
   TINYCLOUD_ACCOUNT_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
   TINYCLOUD_AGENTS_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_AGENTS_SPACE_MANIFEST,
@@ -242,55 +242,55 @@ __export(index_exports, {
   TINYCLOUD_PUBLIC_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_PUBLIC_SPACE_MANIFEST,
   TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST: () => import_bootstrap4.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud: () => TinyCloud,
-  TinyCloudDebugLogger: () => import_sdk_services9.TinyCloudDebugLogger,
+  TinyCloudDebugLogger: () => import_sdk_services10.TinyCloudDebugLogger,
   TranscriptRequester: () => TranscriptRequester,
   TranscriptRequesterError: () => TranscriptRequesterError,
   UnsupportedFeatureError: () => UnsupportedFeatureError,
   UnsupportedSignatureSuiteError: () => UnsupportedSignatureSuiteError,
   VAULT_PERMISSION_SERVICE: () => VAULT_PERMISSION_SERVICE,
-  VaultHeaders: () => import_sdk_services9.VaultHeaders,
-  VaultPublicSpaceKVActions: () => import_sdk_services9.VaultPublicSpaceKVActions,
+  VaultHeaders: () => import_sdk_services10.VaultHeaders,
+  VaultPublicSpaceKVActions: () => import_sdk_services10.VaultPublicSpaceKVActions,
   VersionCheckError: () => VersionCheckError,
   actionContains: () => actionContains,
   activateSessionWithHost: () => activateSessionWithHost,
   addressStorageKey: () => addressStorageKey,
   admitPolicyCredentialV3: () => admitPolicyCredentialV3,
   admitPolicyCredentialV4: () => admitPolicyCredentialV4,
-  appSecretScope: () => import_sdk_services9.appSecretScope,
+  appSecretScope: () => import_sdk_services10.appSecretScope,
   applyPrefix: () => applyPrefix,
   assertSpaceCreationAllowed: () => assertSpaceCreationAllowed,
-  authorizationVerdictOf: () => import_sdk_services9.authorizationVerdictOf,
+  authorizationVerdictOf: () => import_sdk_services10.authorizationVerdictOf,
   bootstrapEncryptionNetworkId: () => import_bootstrap4.bootstrapEncryptionNetworkId,
   bootstrapSpaceId: () => import_bootstrap4.bootstrapSpaceId,
   bootstrapSteps: () => import_bootstrap4.bootstrapSteps,
-  buildCanonicalDecryptRequest: () => import_sdk_services9.buildCanonicalDecryptRequest,
-  buildDecryptAttenuation: () => import_sdk_services9.buildDecryptAttenuation,
-  buildDecryptFacts: () => import_sdk_services9.buildDecryptFacts,
-  buildDecryptInvocation: () => import_sdk_services9.buildDecryptInvocation,
-  buildNetworkId: () => import_sdk_services9.buildNetworkId,
+  buildCanonicalDecryptRequest: () => import_sdk_services10.buildCanonicalDecryptRequest,
+  buildDecryptAttenuation: () => import_sdk_services10.buildDecryptAttenuation,
+  buildDecryptFacts: () => import_sdk_services10.buildDecryptFacts,
+  buildDecryptInvocation: () => import_sdk_services10.buildDecryptInvocation,
+  buildNetworkId: () => import_sdk_services10.buildNetworkId,
   buildPolicyCredentialPresentationV3: () => buildPolicyCredentialPresentationV3,
   buildPolicyCredentialPresentationV4: () => buildPolicyCredentialPresentationV4,
   buildSpaceUri: () => buildSpaceUri,
   canonicalDigest: () => canonicalDigest,
   canonicalEmailDomain: () => import_share_envelope.canonicalEmailDomain,
-  canonicalHashHex: () => import_sdk_services9.canonicalHashHex,
+  canonicalHashHex: () => import_sdk_services10.canonicalHashHex,
   canonicalLocationPayload: () => canonicalLocationPayload,
   canonicalMailbox: () => import_share_envelope.canonicalMailbox,
   canonicalOwnerSharePolicy: () => canonicalOwnerSharePolicy,
-  canonicalSignedResponse: () => import_sdk_services9.canonicalSignedResponse,
+  canonicalSignedResponse: () => import_sdk_services10.canonicalSignedResponse,
   canonicalizeAddress: () => canonicalizeAddress,
   canonicalizeDid: () => canonicalizeDid,
   canonicalizeDidUrl: () => canonicalizeDidUrl,
-  canonicalizeEncryptionJson: () => import_sdk_services9.canonicalizeEncryptionJson,
+  canonicalizeEncryptionJson: () => import_sdk_services10.canonicalizeEncryptionJson,
   canonicalizeNetworkId: () => canonicalizeNetworkId,
   canonicalizeRecapCaveats: () => canonicalizeRecapCaveats,
-  canonicalizeSecretScope: () => import_sdk_services9.canonicalizeSecretScope,
+  canonicalizeSecretScope: () => import_sdk_services10.canonicalizeSecretScope,
   canonicalizeSignedObjectUnsigned: () => canonicalizeSignedObjectUnsigned,
   canonicalizeUnifiedPolicyCapability: () => canonicalizeUnifiedPolicyCapability,
-  checkDecryptInvocationInput: () => import_sdk_services9.checkDecryptInvocationInput,
+  checkDecryptInvocationInput: () => import_sdk_services10.checkDecryptInvocationInput,
   checkNodeInfo: () => checkNodeInfo,
   classifyRegistryLookup: () => classifyRegistryLookup,
-  clearTinyCloudDebugLogs: () => import_sdk_services9.clearTinyCloudDebugLogs,
+  clearTinyCloudDebugLogs: () => import_sdk_services10.clearTinyCloudDebugLogs,
   compactAttenuationContains: () => compactAttenuationContains,
   composeBootstrapSpaceManifest: () => import_bootstrap4.composeBootstrapSpaceManifest,
   composeManifestRequest: () => composeManifestRequest,
@@ -321,7 +321,7 @@ __export(index_exports, {
   createStorageReceipt: () => createStorageReceipt,
   createStoredCredentialRecord: () => createStoredCredentialRecord,
   createTranscriptRequester: () => createTranscriptRequester,
-  createVaultCrypto: () => import_sdk_services9.createVaultCrypto,
+  createVaultCrypto: () => import_sdk_services10.createVaultCrypto,
   credentialEndpointPath: () => credentialEndpointPath,
   credentialError: () => credentialError,
   credentialIndexKey: () => credentialIndexKey,
@@ -329,65 +329,67 @@ __export(index_exports, {
   credentialRecordKey: () => credentialRecordKey,
   credentialRequirementDigest: () => credentialRequirementDigest,
   decodeBase64Url: () => decodeBase64Url,
-  decryptEnvelopeWithKey: () => import_sdk_services9.decryptEnvelopeWithKey,
+  decryptEnvelopeWithKey: () => import_sdk_services10.decryptEnvelopeWithKey,
   decryptShareBytesAsync: () => decryptShareBytesAsync,
-  defaultRetryPolicy: () => import_sdk_services9.defaultRetryPolicy,
+  defaultRetryPolicy: () => import_sdk_services10.defaultRetryPolicy,
   defaultSignStrategy: () => defaultSignStrategy,
   defaultSpaceCreationHandler: () => defaultSpaceCreationHandler,
   delegatePortablePolicySession: () => delegatePortablePolicySession,
   deriveDelegationCid: () => deriveDelegationCid,
   deriveSignedObjectMaterial: () => deriveSignedObjectMaterial,
-  deriveSignedReceiverKey: () => import_sdk_services9.deriveSignedReceiverKey,
+  deriveSignedReceiverKey: () => import_sdk_services10.deriveSignedReceiverKey,
   descriptorSatisfiesRequirement: () => descriptorSatisfiesRequirement,
   didCacheKey: () => didCacheKey,
   didEquals: () => didEquals,
   diffImmutableSiweFields: () => diffImmutableSiweFields,
-  disableTinyCloudDebug: () => import_sdk_services9.disableTinyCloudDebug,
+  disableTinyCloudDebug: () => import_sdk_services10.disableTinyCloudDebug,
   discoverLocalTinyCloudNode: () => discoverLocalTinyCloudNode,
-  discoverNetwork: () => import_sdk_services9.discoverNetwork,
-  enableTinyCloudDebug: () => import_sdk_services9.enableTinyCloudDebug,
+  discoverNetwork: () => import_sdk_services10.discoverNetwork,
+  enableTinyCloudDebug: () => import_sdk_services10.enableTinyCloudDebug,
   encodeBase64Url: () => encodeBase64Url,
   encodeInlineShareUrl: () => encodeInlineShareUrl,
   encodeShareArtifact: () => encodeShareArtifact,
   encodeShareUrl: () => encodeShareUrl,
   encryptShareBytes: () => encryptShareBytes,
   encryptShareBytesAsync: () => encryptShareBytesAsync,
-  encryptToNetwork: () => import_sdk_services9.encryptToNetwork,
-  encryptionBase64Decode: () => import_sdk_services9.base64Decode,
-  encryptionBase64Encode: () => import_sdk_services9.base64Encode,
-  encryptionError: () => import_sdk_services9.encryptionError,
-  encryptionUtf8Decode: () => import_sdk_services9.utf8Decode,
-  encryptionUtf8Encode: () => import_sdk_services9.utf8Encode,
-  ensureNetworkUsableForDecrypt: () => import_sdk_services9.ensureNetworkUsableForDecrypt,
-  err: () => import_sdk_services9.err,
+  encryptToNetwork: () => import_sdk_services10.encryptToNetwork,
+  encryptionBase64Decode: () => import_sdk_services10.base64Decode,
+  encryptionBase64Encode: () => import_sdk_services10.base64Encode,
+  encryptionError: () => import_sdk_services10.encryptionError,
+  encryptionUtf8Decode: () => import_sdk_services10.utf8Decode,
+  encryptionUtf8Encode: () => import_sdk_services10.utf8Encode,
+  ensureNetworkUsableForDecrypt: () => import_sdk_services10.ensureNetworkUsableForDecrypt,
+  err: () => import_sdk_services10.err,
   expandActionShortNames: () => expandActionShortNames,
+  expandDelegationPermissionEntries: () => expandDelegationPermissionEntries,
   expandPermissionEntries: () => expandPermissionEntries,
   expandPermissionEntry: () => expandPermissionEntry,
+  expandRuntimePermissionEntries: () => expandRuntimePermissionEntries,
   extractImmutableSiweFields: () => extractImmutableSiweFields,
   extractRecapAttenuations: () => extractRecapAttenuations,
   fetchLocationRecord: () => fetchLocationRecord,
   fetchPeerId: () => fetchPeerId,
-  generateRandomReceiverKey: () => import_sdk_services9.generateRandomReceiverKey,
+  generateRandomReceiverKey: () => import_sdk_services10.generateRandomReceiverKey,
   getPolicyRootStatusV3: () => getPolicyRootStatusV3,
-  getTinyCloudDebugLogs: () => import_sdk_services9.getTinyCloudDebugLogs,
+  getTinyCloudDebugLogs: () => import_sdk_services10.getTinyCloudDebugLogs,
   hasTinyCloudManageKeyScope: () => hasTinyCloudManageKeyScope,
-  hexDecode: () => import_sdk_services9.hexDecode,
-  hexEncode: () => import_sdk_services9.hexEncode,
+  hexDecode: () => import_sdk_services10.hexDecode,
+  hexEncode: () => import_sdk_services10.hexEncode,
   holderBindingCanonicalBytes: () => holderBindingCanonicalBytes,
   holderBindingSigningBytes: () => holderBindingSigningBytes,
   httpResponseError: () => httpResponseError,
   httpUrlToMultiaddr: () => httpUrlToMultiaddr,
   importPortableDelegation: () => importPortableDelegation,
-  installTinyCloudDebugGlobals: () => import_sdk_services9.installTinyCloudDebugGlobals,
+  installTinyCloudDebugGlobals: () => import_sdk_services10.installTinyCloudDebugGlobals,
   intersectShareCapabilities: () => intersectShareCapabilities,
   isCanonicalEmailDomain: () => import_share_envelope.isCanonicalEmailDomain,
   isCapabilitySubset: () => isCapabilitySubset,
   isDigest: () => isDigest,
   isEvmAddress: () => isEvmAddress,
   isExplicitOnlyAction: () => isExplicitOnlyAction,
-  isNetworkId: () => import_sdk_services9.isNetworkId,
+  isNetworkId: () => import_sdk_services10.isNetworkId,
   isPlausibleOpenKeyActionId: () => isPlausibleOpenKeyActionId,
-  isStorageFullError: () => import_sdk_services9.isStorageFullError,
+  isStorageFullError: () => import_sdk_services10.isStorageFullError,
   isV2ShareLink: () => isV2ShareLink,
   issuedCredentialEnvelopeFromVerified: () => issuedCredentialEnvelopeFromVerified,
   jcsCanonicalize: () => jcsCanonicalize,
@@ -400,36 +402,36 @@ __export(index_exports, {
   manifestAbilitiesUnion: () => manifestAbilitiesUnion,
   markDelegationTerminal: () => markDelegationTerminal,
   multiaddrToHttpUrl: () => multiaddrToHttpUrl,
-  networkDiscoveryKey: () => import_sdk_services9.networkDiscoveryKey,
+  networkDiscoveryKey: () => import_sdk_services10.networkDiscoveryKey,
   normalizeDefaults: () => normalizeDefaults,
   normalizeJson: () => normalizeJson,
   normalizeShareActions: () => normalizeShareActions,
   normalizeShareRecipientTarget: () => normalizeShareRecipientTarget,
   normalizeShareResource: () => normalizeShareResource,
   normalizeUnifiedPolicyCapability: () => normalizeUnifiedPolicyCapability,
-  ok: () => import_sdk_services9.ok,
-  openWrappedKey: () => import_sdk_services9.openWrappedKey,
+  ok: () => import_sdk_services10.ok,
+  openWrappedKey: () => import_sdk_services10.openWrappedKey,
   parseCanonicalNetworkId: () => parseCanonicalNetworkId,
   parseCanonicalRecapResource: () => parseCanonicalRecapResource,
   parseCanonicalTinyCloudIdentity: () => parseCanonicalTinyCloudIdentity,
   parseCanonicalTinyCloudIdentityClaims: () => parseCanonicalTinyCloudIdentityClaims,
-  parseCapabilityResource: () => import_sdk_services9.parseCapabilityResource,
+  parseCapabilityResource: () => import_sdk_services10.parseCapabilityResource,
   parseCompactUcanAuthorization: () => parseCompactUcanAuthorization,
   parseExpiry: () => parseExpiry,
-  parseNetworkId: () => import_sdk_services9.parseNetworkId,
+  parseNetworkId: () => import_sdk_services10.parseNetworkId,
   parseNodeNativePortableDelegation: () => parseNodeNativePortableDelegation,
   parsePkhDid: () => parsePkhDid,
   parsePolicySessionUcan: () => parsePolicySessionUcan,
   parsePortableDelegation: () => parsePortableDelegation,
   parseRecapCapabilities: () => parseRecapCapabilities,
-  parseSecretCatalogKey: () => import_sdk_services9.parseSecretCatalogKey,
+  parseSecretCatalogKey: () => import_sdk_services10.parseSecretCatalogKey,
   parseShareArtifact: () => parseShareArtifact,
   parseShareUrl: () => parseShareUrl,
   parseSignedCompactUcanAttenuation: () => parseSignedCompactUcanAttenuation,
   parseSignedSiweCacao: () => parseSignedSiweCacao,
   parseSpaceUri: () => parseSpaceUri,
-  parseStorageRejection: () => import_sdk_services9.parseStorageRejection,
-  parseStorageStatus: () => import_sdk_services9.parseStorageStatus,
+  parseStorageRejection: () => import_sdk_services10.parseStorageRejection,
+  parseStorageStatus: () => import_sdk_services10.parseStorageStatus,
   pkhDid: () => pkhDid,
   policyCidFromCanonicalBytes: () => policyCidFromCanonicalBytes,
   policyDigestHex: () => policyDigestHex,
@@ -450,8 +452,8 @@ __export(index_exports, {
   resolveManifest: () => resolveManifest,
   resolveManifestKnowledgeRoot: () => resolveManifestKnowledgeRoot,
   resolveOwnerHosts: () => resolveOwnerHosts,
-  resolveSecretListPrefix: () => import_sdk_services9.resolveSecretListPrefix,
-  resolveSecretPath: () => import_sdk_services9.resolveSecretPath,
+  resolveSecretListPrefix: () => import_sdk_services10.resolveSecretListPrefix,
+  resolveSecretPath: () => import_sdk_services10.resolveSecretPath,
   resolveTinyCloudHosts: () => resolveTinyCloudHosts,
   resourceCapabilitiesToAbilitiesMap: () => resourceCapabilitiesToAbilitiesMap,
   resourceCapabilitiesToSpaceAbilitiesMap: () => resourceCapabilitiesToSpaceAbilitiesMap,
@@ -459,7 +461,7 @@ __export(index_exports, {
   revokePolicyRootV3: () => revokePolicyRootV3,
   serializeJcsJson: () => serialize,
   serializePortableDelegation: () => serializePortableDelegation,
-  serviceError: () => import_sdk_services9.serviceError,
+  serviceError: () => import_sdk_services10.serviceError,
   sha256Base64Url: () => sha256Base64Url,
   shareCapabilityAllows: () => shareCapabilityAllows,
   shortDeliveryLinkBodyCid: () => shortDeliveryLinkBodyCid,
@@ -470,9 +472,9 @@ __export(index_exports, {
   signPolicyCredentialPresentationV4: () => signPolicyCredentialPresentationV4,
   signShareEnvelope: () => signShareEnvelope,
   signedObjectIdFor: () => signedObjectIdFor,
-  storageUsageState: () => import_sdk_services9.storageUsageState,
+  storageUsageState: () => import_sdk_services10.storageUsageState,
   submitHostDelegation: () => submitHostDelegation,
-  tinyCloudDebugLogger: () => import_sdk_services9.tinyCloudDebugLogger,
+  tinyCloudDebugLogger: () => import_sdk_services10.tinyCloudDebugLogger,
   toSignedObjectError: () => toSignedObjectError,
   unauthorizedRecapCapabilities: () => unauthorizedRecapCapabilities,
   unifiedNativeProjectionHashHex: () => unifiedNativeProjectionHashHex,
@@ -484,7 +486,7 @@ __export(index_exports, {
   validateCredentialFlowDescriptor: () => validateCredentialFlowDescriptor,
   validateCredentialHolderBinding: () => validateCredentialHolderBinding,
   validateCredentialRequirement: () => validateCredentialRequirement,
-  validateEnvelope: () => import_sdk_services9.validateEnvelope,
+  validateEnvelope: () => import_sdk_services10.validateEnvelope,
   validateLocationRecord: () => validateLocationRecord,
   validateLocationRecordPayload: () => validateLocationRecordPayload,
   validateManifest: () => validateManifest,
@@ -502,8 +504,8 @@ __export(index_exports, {
   validatePolicyStatusUnsigned: () => validatePolicyStatusUnsigned,
   validatePolicyUnsigned: () => validatePolicyUnsigned,
   validateUnifiedPolicyV2: () => validateUnifiedPolicyV2,
-  validatedCapabilityOf: () => import_sdk_services9.validatedCapabilityOf,
-  verifyDecryptResponse: () => import_sdk_services9.verifyDecryptResponse,
+  validatedCapabilityOf: () => import_sdk_services10.validatedCapabilityOf,
+  verifyDecryptResponse: () => import_sdk_services10.verifyDecryptResponse,
   verifyDidKeyEd25519Signature: () => verifyDidKeyEd25519Signature,
   verifyEip191MessageSignature: () => verifyEip191MessageSignature,
   verifyIssuedCredential: () => verifyIssuedCredential,
@@ -3947,6 +3949,7 @@ var import_sha256 = require("@noble/hashes/sha256");
 var import_blake3 = require("@noble/hashes/blake3");
 var import_ed255193 = require("@noble/curves/ed25519");
 var import_zod2 = require("zod");
+var import_sdk_services2 = require("@tinycloud/sdk-services");
 
 // src/http-error.ts
 var import_sdk_services = require("@tinycloud/sdk-services");
@@ -4215,12 +4218,9 @@ function parseKvResource(resource) {
   return { space, path };
 }
 function parseEncryptionResource(resource) {
-  if (!resource.startsWith("urn:tinycloud:encryption:")) throw new Error("encryption capability is invalid");
-  const rest = resource.slice("urn:tinycloud:encryption:".length);
-  const separator = rest.lastIndexOf(":");
-  const ownerDid = separator < 0 ? "" : rest.slice(0, separator);
-  const network = separator < 0 ? "" : rest.slice(separator + 1);
-  if (!ownerDid.startsWith("did:") || network.length === 0 || network.includes(":") || network.includes("/") || network.includes("%") || network.includes("?") || network.includes("#")) {
+  try {
+    if ((0, import_sdk_services2.parseEncryptionResource)(resource).keyPath?.endsWith("/")) throw new Error("prefix");
+  } catch {
     throw new Error("encryption capability is invalid");
   }
 }
@@ -6687,7 +6687,11 @@ var DelegationErrorCodes = {
   KV_SERVICE_UNAVAILABLE: "KV_SERVICE_UNAVAILABLE",
   DATA_FETCH_FAILED: "DATA_FETCH_FAILED",
   VALIDATION_ERROR: "VALIDATION_ERROR",
-  UNSUPPORTED_OPERATION: "UNSUPPORTED_OPERATION"
+  UNSUPPORTED_OPERATION: "UNSUPPORTED_OPERATION",
+  /** The node answered 503: the delegation chain is too deep to evaluate right now. Retry later. */
+  CHAIN_TOO_DEEP: "CHAIN_TOO_DEEP",
+  /** The node answered 400 "invalid delegation query cursor": malformed, foreign or from another filter. Start the listing again without it. */
+  INVALID_CURSOR: "INVALID_CURSOR"
 };
 var DelegationSchema = import_zod4.z.object({
   /** Content identifier (CID) of the delegation */
@@ -6764,7 +6768,7 @@ var AccountDelegationPageSchema = import_zod4.z.object({
   nextCursor: import_zod4.z.string().optional()
 }).strict();
 var AccountDelegationQueryOptionsSchema = import_zod4.z.object({
-  direction: import_zod4.z.enum(["granted", "received", "all"]).optional(),
+  direction: import_zod4.z.enum(["granted", "received", "all", "issued"]).optional(),
   status: import_zod4.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]).optional(),
   space: import_zod4.z.string().trim().min(1).optional(),
   limit: import_zod4.z.number().int().min(1).max(100).optional(),
@@ -6950,6 +6954,8 @@ var DelegationManagerConfigSchema = import_zod4.z.object({
   ).optional(),
   /** Optional owner-signed authorization for direct CID revocation */
   signOwnerRevocation: import_zod4.z.custom().optional(),
+  /** Optional signer for proofless invocations by the session's own did:key (issued-delegation list and revoke) */
+  sessionInvocationSigner: import_zod4.z.custom().optional(),
   /** Optional custom fetch implementation */
   fetch: import_zod4.z.unknown().refine(
     (val) => val === void 0 || typeof val === "function",
@@ -7045,7 +7051,7 @@ var CreateDelegationWasmResultSchema = import_zod4.z.object({
   resources: import_zod4.z.array(DelegatedResourceSchema)
 });
 
-// src/delegations/DelegationManager.ts
+// src/delegations/shared.ts
 var DelegationAction = {
   REVOKE: "tinycloud.delegation/revoke",
   STATUS: "tinycloud.delegation/status",
@@ -7062,6 +7068,8 @@ function createError(code3, message, cause, meta) {
     meta
   };
 }
+
+// src/delegations/DelegationManager.ts
 async function readInvokedJson(response, action) {
   const text3 = await response.text();
   if (text3.trim() === "") {
@@ -7084,11 +7092,13 @@ var DelegationManager = class {
    * @param config - Configuration including hosts, session, and invoke function
    */
   constructor(config) {
+    this.issuedState = { issuedQuerySupported: false };
     this.hosts = config.hosts;
     this.session = config.session;
     this.invoke = config.invoke;
     this.invokeAny = config.invokeAny;
     this.signOwnerRevocation = config.signOwnerRevocation;
+    this.sessionInvocationSigner = config.sessionInvocationSigner;
     this.fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
     this.accountSpaceId = config.accountSpaceId;
   }
@@ -7311,8 +7321,14 @@ var DelegationManager = class {
       };
     }
   }
-  /** Query lifecycle-complete delegation history for the authenticated account. */
-  async query(options2 = {}) {
+  /**
+   * Query lifecycle-complete delegation history for the authenticated account.
+   *
+   * `scope.spaces` lists the spaces to sign `tinycloud.delegation/list` for, in order. Omitted, the
+   * account space is tried, then the session's own space. A caller that knows which of them the session
+   * holds passes only those; an empty list sends nothing and answers PERMISSION_DENIED.
+   */
+  async query(options2 = {}, scope = {}) {
     const validated = AccountDelegationQueryOptionsSchema.safeParse(options2);
     if (!validated.success) {
       return {
@@ -7325,6 +7341,7 @@ var DelegationManager = class {
         )
       };
     }
+    if (validated.data.direction === "issued") return this.queryIssued(validated.data);
     if (!this.invokeAny) {
       return {
         ok: false,
@@ -7346,7 +7363,7 @@ var DelegationManager = class {
     }
     try {
       let response;
-      for (const spaceId of /* @__PURE__ */ new Set([accountSpaceId, this.session.spaceId])) {
+      for (const spaceId of new Set(scope.spaces ?? [accountSpaceId, this.session.spaceId])) {
         const headers = Object.fromEntries(new Headers(this.invokeAny(this.session, [{
           spaceId,
           service: "delegation",
@@ -7406,6 +7423,45 @@ var DelegationManager = class {
       };
     }
   }
+  /** The state the lazily loaded issued-delegation module reads and updates. */
+  issuedContext() {
+    return {
+      host: this.host,
+      fetchFn: this.fetchFn,
+      sessionInvocationSigner: this.sessionInvocationSigner,
+      state: this.issuedState
+    };
+  }
+  /**
+   * Lists the delegations this session's own key issued (`direction: "issued"`).
+   * The implementation loads on first use.
+   */
+  async queryIssued(options2) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.queryIssued(this.issuedContext(), options2);
+  }
+  /**
+   * Every delegation this session's key issued, following `nextCursor` until
+   * it is absent. `maxItems` stops early once that many are collected;
+   * `untilCid` stops after the page that contains that delegation. Items come
+   * in CID order (each carries `issuedAt`). The implementation loads on first use.
+   */
+  async queryAllIssued(options2 = {}) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.queryAllIssued((page) => this.query(page), options2);
+  }
+  /**
+   * Revokes a delegation this session's key issued, with no proof: a UCAN
+   * signed by the session's own did:key carrying `urn:cid:<cid>` and
+   * `tinycloud.delegation/revoke`. Revoking a delegation that is already revoked
+   * succeeds. A refusal (the key is not the delegator) carries the node's
+   * message; 503 means the chain is too deep right now, retry later.
+   * The implementation loads on first use.
+   */
+  async revokeIssued(cid2) {
+    const issued = await import("@tinycloud/sdk-core/delegations/issued");
+    return issued.revokeIssued(this.issuedContext(), cid2);
+  }
   /**
    * Gets the full delegation chain for a given delegation.
    *
@@ -7712,7 +7768,8 @@ function validateEncodedShareData(data) {
 // src/manifest.ts
 var import_ms = __toESM(require("ms"), 1);
 var import_bootstrap2 = require("@tinycloud/bootstrap");
-var import_sdk_services2 = require("@tinycloud/sdk-services");
+var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_resource = require("@tinycloud/sdk-services/encryption/resource");
 var DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
 var ManifestValidationError = class extends Error {
   constructor(message) {
@@ -7835,6 +7892,16 @@ function expandEncryptionPermissionEntry(entry) {
       `tinycloud.encryption entries require path to be a networkId URN (got ${JSON.stringify(entry.path)})`
     );
   }
+  const sharePrefix = entry.path.endsWith("/share/");
+  if (entry.path.includes("/") && !sharePrefix) {
+    throw new ManifestValidationError("named keys go in manifest.keys");
+  }
+  try {
+    const network = (0, import_sdk_services3.parseNetworkId)(sharePrefix ? entry.path.slice(0, -"/share/".length) : entry.path);
+    if (sharePrefix && network.name !== "default") throw new Error("share prefix requires default network");
+  } catch {
+    throw new ManifestValidationError("tinycloud.encryption entries require a valid networkId URN");
+  }
   const normalizedActions = [];
   for (const action of entry.actions) {
     if (action === "decrypt" || action === "tinycloud.encryption/decrypt") {
@@ -7866,6 +7933,9 @@ function expandEncryptionPermissionEntry(entry) {
       seen.add(a);
     }
   }
+  if (sharePrefix && dedupedActions.some((action) => action !== "tinycloud.encryption/decrypt")) {
+    throw new ManifestValidationError("share prefix only supports decrypt");
+  }
   return [
     {
       service: ENCRYPTION_PERMISSION_SERVICE,
@@ -7881,6 +7951,55 @@ function expandEncryptionPermissionEntry(entry) {
 function expandPermissionEntries(entries) {
   return entries.flatMap(expandPermissionEntry);
 }
+function expandRuntimePermissionEntries(entries, ownerDid) {
+  return entries.flatMap((entry) => {
+    if (entry.service !== ENCRYPTION_PERMISSION_SERVICE || typeof entry.path !== "string" || !entry.path.includes("/") || entry.path.endsWith("/share/")) {
+      return expandPermissionEntry(entry);
+    }
+    let resource;
+    let ownerNetwork;
+    try {
+      resource = (0, import_resource.parseEncryptionResource)(entry.path);
+      if (typeof ownerDid !== "string" || ownerDid.length === 0) throw new Error("missing owner");
+      ownerNetwork = (0, import_resource.parseEncryptionResource)(`urn:tinycloud:encryption:${ownerDid}:default`);
+    } catch {
+      throw new ManifestValidationError("runtime Share key creation requires a canonical current-owner key resource");
+    }
+    if (resource.kind !== "key" || resource.networkId !== ownerNetwork.networkId || !/^share\/[^/]+$/.test(resource.path) || entry.space !== void 0 && entry.space !== ENCRYPTION_MANIFEST_SPACE || !Array.isArray(entry.actions) || entry.actions.length === 0 || entry.actions.some((action) => action !== "key.create" && action !== "tinycloud.encryption/key.create")) {
+      throw new ManifestValidationError("runtime Share key creation requires the current owner's exact default/share/<id> key and key.create only");
+    }
+    return [{
+      ...entry,
+      space: ENCRYPTION_MANIFEST_SPACE,
+      path: `${resource.networkId}/${resource.path}`,
+      actions: ["tinycloud.encryption/key.create"],
+      skipPrefix: true
+    }];
+  });
+}
+function expandDelegationPermissionEntries(entries) {
+  return entries.flatMap((entry) => {
+    if (entry.service !== ENCRYPTION_PERMISSION_SERVICE || typeof entry.path !== "string" || !entry.path.includes("/")) {
+      return expandPermissionEntry(entry);
+    }
+    let resource;
+    try {
+      resource = (0, import_resource.parseEncryptionResource)(entry.path);
+    } catch {
+      throw new ManifestValidationError("delegation requires a canonical exact named-key resource");
+    }
+    if (resource.kind !== "key" || !Array.isArray(entry.actions) || entry.actions.length === 0 || entry.actions.some((action) => action !== "decrypt" && action !== "tinycloud.encryption/decrypt")) {
+      throw new ManifestValidationError("named-key delegation requires an exact key and decrypt only");
+    }
+    return [{
+      ...entry,
+      space: ENCRYPTION_MANIFEST_SPACE,
+      path: `${resource.networkId}/${resource.path}`,
+      actions: ["tinycloud.encryption/decrypt"],
+      skipPrefix: true
+    }];
+  });
+}
 function applyPrefix(prefix, path, skipPrefix) {
   if (skipPrefix) {
     return path;
@@ -7959,8 +8078,56 @@ function validateManifest(input) {
   if (m.secrets !== void 0) {
     validateManifestSecrets(m.secrets);
   }
+  if (Object.prototype.hasOwnProperty.call(m, "keys_app_id") && (typeof m.keys_app_id !== "string" || !KEY_APP_ID.test(m.keys_app_id))) {
+    throw new ManifestValidationError("manifest.keys_app_id is invalid");
+  }
+  validateManifestKeys(m.keys_app_id ?? m.app_id, m.keys);
   return m;
 }
+var KEY_SEGMENT = "[a-z0-9][a-z0-9._-]{0,63}";
+var KEY_APP_ID = new RegExp(`^${KEY_SEGMENT}$`);
+var KEY_PATH = new RegExp(`^${KEY_SEGMENT}(?:/${KEY_SEGMENT}){2,7}$`);
+var KEY_ABILITIES = ["key.create", "decrypt", "key.block", "key.unblock"];
+function validateManifestKeys(appId, keys) {
+  if (keys === void 0) return;
+  if (!Array.isArray(keys) || keys.length > 32) {
+    throw new ManifestValidationError("manifest.keys must contain at most 32 entries");
+  }
+  if (keys.length === 0) return;
+  if (!KEY_APP_ID.test(appId)) {
+    throw new ManifestValidationError("manifest.keys requires a valid app_id");
+  }
+  const paths = /* @__PURE__ */ new Set();
+  let prefixSeen = false;
+  for (const [index, value] of keys.entries()) {
+    const label = `manifest.keys[${index}]`;
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new ManifestValidationError(`${label} must be an object`);
+    }
+    const entry = value;
+    const fields = Object.keys(entry);
+    const hasPath = Object.prototype.hasOwnProperty.call(entry, "path");
+    const hasPrefix = Object.prototype.hasOwnProperty.call(entry, "prefix");
+    if (hasPath === hasPrefix || fields.some((field) => !["path", "prefix", "abilities"].includes(field))) {
+      throw new ManifestValidationError(`${label} must have one path or prefix and abilities`);
+    }
+    if (!Array.isArray(entry.abilities) || entry.abilities.length === 0 || new Set(entry.abilities).size !== entry.abilities.length || entry.abilities.some((ability) => typeof ability !== "string" || !KEY_ABILITIES.includes(ability))) {
+      throw new ManifestValidationError(`${label}.abilities is invalid`);
+    }
+    if (hasPath) {
+      const path = entry.path;
+      if (typeof path !== "string" || path.length > 255 || !KEY_PATH.test(path) || !path.startsWith(`apps/${appId}/`) || paths.has(path)) {
+        throw new ManifestValidationError(`${label}.path is invalid`);
+      }
+      paths.add(path);
+    } else {
+      if (entry.prefix !== `apps/${appId}/` || prefixSeen) {
+        throw new ManifestValidationError(`${label}.prefix is invalid`);
+      }
+      prefixSeen = true;
+    }
+  }
+}
 function resolveManifestKnowledgeRoot(knowledge) {
   if (knowledge === void 0) {
     return void 0;
@@ -7985,13 +8152,13 @@ function validateManifestSecrets(secrets) {
     throw new ManifestValidationError("manifest.secrets must be an object");
   }
   for (const [name2, spec] of Object.entries(secrets)) {
-    if (!import_sdk_services2.SECRET_NAME_RE.test(name2)) {
+    if (!import_sdk_services3.SECRET_NAME_RE.test(name2)) {
       throw new ManifestValidationError(
-        `manifest.secrets.${name2} must match ${import_sdk_services2.SECRET_NAME_RE.source}`
+        `manifest.secrets.${name2} must match ${import_sdk_services3.SECRET_NAME_RE.source}`
       );
     }
     try {
-      (0, import_sdk_services2.resolveSecretPath)(
+      (0, import_sdk_services3.resolveSecretPath)(
         secretNameFromSpec(name2, spec),
         { scope: secretScopeFromSpec(spec) }
       );
@@ -8208,7 +8375,7 @@ function secretEntriesForManifest(secrets) {
   const entries = [];
   for (const [name2, spec] of Object.entries(secrets)) {
     const actions = secretActionsFromSpec(name2, spec);
-    const secretPath = (0, import_sdk_services2.resolveSecretPath)(
+    const secretPath = (0, import_sdk_services3.resolveSecretPath)(
       secretNameFromSpec(name2, spec),
       { scope: secretScopeFromSpec(spec) }
     );
@@ -8478,6 +8645,7 @@ function manifestAbilitiesUnion(resolved) {
 }
 
 // src/capabilities.ts
+var import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
 var PermissionNotInManifestError = class extends Error {
   constructor(missing, granted) {
     super(
@@ -8529,10 +8697,9 @@ function isCapabilitySubset(requested, granted) {
     const grantedActions = matchingScope.flatMap(
       (entry) => expandActionShortNames(entry.service, entry.actions)
     );
+    const namedKeyRequest = req.service === "tinycloud.encryption" && req.path.startsWith("urn:tinycloud:encryption:") && req.path.includes("/");
     const covered = requestedActions.every(
-      (requestedAction) => grantedActions.some(
-        (grantedAction) => actionContains(grantedAction, requestedAction)
-      )
+      (requestedAction) => grantedActions.some((grantedAction) => namedKeyRequest ? grantedAction === requestedAction : actionContains(grantedAction, requestedAction))
     );
     if (!covered) {
       missing.push(cloneEntry(req));
@@ -8547,7 +8714,9 @@ function canonicalizeEntryScopeMatches(requested, granted) {
   if (normalizeSpace(requested.space ?? DEFAULT_MANIFEST_SPACE) !== normalizeSpace(granted.space ?? DEFAULT_MANIFEST_SPACE)) {
     return false;
   }
-  if (!pathContains2(granted.path, requested.path)) {
+  const namedKeyRequest = requested.service === "tinycloud.encryption" && requested.path.startsWith("urn:tinycloud:encryption:") && requested.path.includes("/");
+  const coveredPath = namedKeyRequest ? (0, import_resource2.encryptionResourceContains)(granted.path, requested.path) : pathContains2(granted.path, requested.path);
+  if (!coveredPath) {
     return false;
   }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
@@ -8659,7 +8828,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
 var import_ed255197 = require("@noble/curves/ed25519");
 
 // src/delegations/ShareRecipientClient.ts
-var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_sdk_services4 = require("@tinycloud/sdk-services");
 var import_ed255196 = require("@noble/curves/ed25519");
 var import_sha2565 = require("@noble/hashes/sha256");
 
@@ -9846,9 +10015,9 @@ function redactedCode(error) {
   if (error instanceof ShareConflict) return error.code;
   const code3 = error && typeof error === "object" && "code" in error ? error.code : void 0;
   if (typeof code3 !== "string") return "SHARE_INVALID";
-  if (code3 === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED || code3 === "412") return "SHARE_CONFLICT";
-  if (code3 === import_sdk_services3.ErrorCodes.NODE_BUSY || code3 === import_sdk_services3.ErrorCodes.REQUEST_TIMEOUT) return "SHARE_OFFLINE";
-  if (code3 === import_sdk_services3.ErrorCodes.OUTCOME_UNKNOWN) return "SHARE_WRITE_FAILED";
+  if (code3 === import_sdk_services4.ErrorCodes.KV_PRECONDITION_FAILED || code3 === "412") return "SHARE_CONFLICT";
+  if (code3 === import_sdk_services4.ErrorCodes.NODE_BUSY || code3 === import_sdk_services4.ErrorCodes.REQUEST_TIMEOUT) return "SHARE_OFFLINE";
+  if (code3 === import_sdk_services4.ErrorCodes.OUTCOME_UNKNOWN) return "SHARE_WRITE_FAILED";
   if (code3 === "KV_NOT_FOUND" || code3 === "NOT_FOUND" || code3 === "404") return "SHARE_NOT_FOUND";
   if (code3.includes("EXPIRED") || code3 === "expired") return "SHARE_EXPIRED";
   if (code3.includes("REVOK")) return "SHARE_REVOKED";
@@ -10087,7 +10256,7 @@ var ShareRecipientClient = class {
           if (portableDelegation !== void 0 && kv !== void 0) {
             const result2 = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
             if (!result2.ok) {
-              if (result2.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
+              if (result2.error.code === import_sdk_services4.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
               throw result2.error;
             }
             return { etag: result2.data.headers.etag };
@@ -10095,7 +10264,7 @@ var ShareRecipientClient = class {
           if (policySession !== void 0) return this.nativeSave(envelope, policySession, resolvedPath, bytes2, input);
           const result = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
           if (!result.ok) {
-            if (result.error.code === import_sdk_services3.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
+            if (result.error.code === import_sdk_services4.ErrorCodes.KV_PRECONDITION_FAILED) throw new ShareConflict(resolvedPath, result.error.meta?.etag);
             throw result.error;
           }
           return { etag: result.data.headers.etag };
@@ -10179,8 +10348,8 @@ var ShareRecipientClient = class {
     if (this.options.createKVService !== void 0) {
       return this.options.createKVService({ hosts: [origin2], session, invoke, fetch: this.fetchFn });
     }
-    const context = new import_sdk_services3.ServiceContext({ hosts: [origin2], session, invoke, fetch: this.fetchFn });
-    const service = new import_sdk_services3.KVService({ prefix: "" });
+    const context = new import_sdk_services4.ServiceContext({ hosts: [origin2], session, invoke, fetch: this.fetchFn });
+    const service = new import_sdk_services4.KVService({ prefix: "" });
     context.registerService("kv", service);
     service.initialize(context);
     return service;
@@ -12728,14 +12897,14 @@ function markDelegationTerminal(token, key) {
 }
 
 // src/networkId.ts
-var import_sdk_services4 = require("@tinycloud/sdk-services");
+var import_sdk_services5 = require("@tinycloud/sdk-services");
 function canonicalizeNetworkId(networkId) {
-  const parsed = (0, import_sdk_services4.parseNetworkId)(networkId);
-  return (0, import_sdk_services4.buildNetworkId)(canonicalizeDid(parsed.ownerDid), parsed.name);
+  const parsed = (0, import_sdk_services5.parseNetworkId)(networkId);
+  return (0, import_sdk_services5.buildNetworkId)(canonicalizeDid(parsed.ownerDid), parsed.name);
 }
 function parseCanonicalNetworkId(networkId) {
   const canonical = canonicalizeNetworkId(networkId);
-  return (0, import_sdk_services4.parseNetworkId)(canonical);
+  return (0, import_sdk_services5.parseNetworkId)(canonical);
 }
 
 // src/storage.schema.ts
@@ -12843,10 +13012,10 @@ function validatePersistedSessionData(data) {
 }
 
 // src/TinyCloud.ts
-var import_sdk_services6 = require("@tinycloud/sdk-services");
+var import_sdk_services7 = require("@tinycloud/sdk-services");
 
 // src/spaces/SpaceService.ts
-var import_sdk_services5 = require("@tinycloud/sdk-services");
+var import_sdk_services6 = require("@tinycloud/sdk-services");
 
 // src/spaces/Space.ts
 function unavailableSecretsService() {
@@ -13281,8 +13450,8 @@ var SpaceService = class {
    */
   async list() {
     if (!this.session) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     try {
@@ -13291,8 +13460,8 @@ var SpaceService = class {
       if (ownedResult.ok) {
         spaces.push(...ownedResult.data);
       } else {
-        const verdict = (0, import_sdk_services5.authorizationVerdictOf)(ownedResult.error);
-        if (verdict === "unauthenticated" || verdict === "forbidden") return (0, import_sdk_services5.err)(ownedResult.error);
+        const verdict = (0, import_sdk_services6.authorizationVerdictOf)(ownedResult.error);
+        if (verdict === "unauthenticated" || verdict === "forbidden") return (0, import_sdk_services6.err)(ownedResult.error);
       }
       if (this.capabilityRegistry) {
         const delegatedSpaces = this.discoverDelegatedSpaces();
@@ -13304,10 +13473,10 @@ var SpaceService = class {
           this.notifySpaceRegistered(space);
         }
       }
-      return (0, import_sdk_services5.ok)(uniqueSpaces);
+      return (0, import_sdk_services6.ok)(uniqueSpaces);
     } catch (error) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Failed to list spaces: ${String(error)}`,
           SERVICE_NAME,
@@ -13327,7 +13496,7 @@ var SpaceService = class {
         headers
       });
       if (!response.ok) {
-        return (0, import_sdk_services5.err)(await serviceHttpError(
+        return (0, import_sdk_services6.err)(await serviceHttpError(
           response,
           SpaceErrorCodes.NETWORK_ERROR,
           "Failed to list owned spaces",
@@ -13337,8 +13506,8 @@ var SpaceService = class {
       const rawData = await response.json();
       const validationResult = validateServerOwnedSpacesResponse(rawData);
       if (!validationResult.ok) {
-        return (0, import_sdk_services5.err)(
-          (0, import_sdk_services5.serviceError)(
+        return (0, import_sdk_services6.err)(
+          (0, import_sdk_services6.serviceError)(
             SpaceErrorCodes.NETWORK_ERROR,
             validationResult.error.message,
             SERVICE_NAME,
@@ -13354,10 +13523,10 @@ var SpaceService = class {
         permissions: ["*"]
         // Full permissions for owned spaces
       }));
-      return (0, import_sdk_services5.ok)(spaces);
+      return (0, import_sdk_services6.ok)(spaces);
     } catch (error) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error listing owned spaces: ${String(error)}`,
           SERVICE_NAME,
@@ -13438,13 +13607,13 @@ var SpaceService = class {
    */
   async create(name2) {
     if (!this.session) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     if (!name2 || !/^[a-zA-Z0-9_-]+$/.test(name2)) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(
           SpaceErrorCodes.INVALID_NAME,
           "Space name must contain only alphanumeric characters, underscores, and hyphens",
           SERVICE_NAME
@@ -13460,14 +13629,14 @@ var SpaceService = class {
       });
       if (!response.ok) {
         if (response.status === 409) {
-          return (0, import_sdk_services5.err)(await serviceHttpError(
+          return (0, import_sdk_services6.err)(await serviceHttpError(
             response,
             SpaceErrorCodes.ALREADY_EXISTS,
             `Space "${name2}" already exists`,
             SERVICE_NAME
           ));
         }
-        return (0, import_sdk_services5.err)(await serviceHttpError(
+        return (0, import_sdk_services6.err)(await serviceHttpError(
           response,
           SpaceErrorCodes.CREATION_FAILED,
           "Failed to create space",
@@ -13477,8 +13646,8 @@ var SpaceService = class {
       const rawData = await response.json();
       const validationResult = validateServerCreateSpaceResponse(rawData);
       if (!validationResult.ok) {
-        return (0, import_sdk_services5.err)(
-          (0, import_sdk_services5.serviceError)(
+        return (0, import_sdk_services6.err)(
+          (0, import_sdk_services6.serviceError)(
             SpaceErrorCodes.CREATION_FAILED,
             validationResult.error.message,
             SERVICE_NAME,
@@ -13495,10 +13664,10 @@ var SpaceService = class {
       };
       this.infoCache.set(spaceInfo.id, { info: spaceInfo, cachedAt: Date.now() });
       this.notifySpaceRegistered(spaceInfo);
-      return (0, import_sdk_services5.ok)(spaceInfo);
+      return (0, import_sdk_services6.ok)(spaceInfo);
     } catch (error) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error creating space: ${String(error)}`,
           SERVICE_NAME,
@@ -13568,10 +13737,10 @@ var SpaceService = class {
     const spaceId = this.resolveSpaceId(nameOrUri);
     const cached = this.infoCache.get(spaceId);
     if (cached && Date.now() - cached.cachedAt < this.cacheTTL) {
-      return (0, import_sdk_services5.ok)(true);
+      return (0, import_sdk_services6.ok)(true);
     }
     const infoResult = await this.getSpaceInfo(spaceId);
-    return (0, import_sdk_services5.ok)(infoResult.ok);
+    return (0, import_sdk_services6.ok)(infoResult.ok);
   }
   // ===========================================================================
   // Space Info
@@ -13582,11 +13751,11 @@ var SpaceService = class {
   async getSpaceInfo(spaceId) {
     const cached = this.infoCache.get(spaceId);
     if (cached && Date.now() - cached.cachedAt < this.cacheTTL) {
-      return (0, import_sdk_services5.ok)(cached.info);
+      return (0, import_sdk_services6.ok)(cached.info);
     }
     if (!this.session) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(SpaceErrorCodes.AUTH_REQUIRED, "Authentication required", SERVICE_NAME)
       );
     }
     try {
@@ -13598,14 +13767,14 @@ var SpaceService = class {
       });
       if (!response.ok) {
         if (response.status === 404) {
-          return (0, import_sdk_services5.err)(await serviceHttpError(
+          return (0, import_sdk_services6.err)(await serviceHttpError(
             response,
             SpaceErrorCodes.NOT_FOUND,
             `Space not found: ${spaceId}`,
             SERVICE_NAME
           ));
         }
-        return (0, import_sdk_services5.err)(await serviceHttpError(
+        return (0, import_sdk_services6.err)(await serviceHttpError(
           response,
           SpaceErrorCodes.NETWORK_ERROR,
           "Failed to get space info",
@@ -13615,8 +13784,8 @@ var SpaceService = class {
       const rawData = await response.json();
       const validationResult = validateServerSpaceInfoResponse(rawData);
       if (!validationResult.ok) {
-        return (0, import_sdk_services5.err)(
-          (0, import_sdk_services5.serviceError)(
+        return (0, import_sdk_services6.err)(
+          (0, import_sdk_services6.serviceError)(
             SpaceErrorCodes.NETWORK_ERROR,
             validationResult.error.message,
             SERVICE_NAME,
@@ -13634,10 +13803,10 @@ var SpaceService = class {
         expiresAt: data.expiresAt ? new Date(data.expiresAt) : void 0
       };
       this.infoCache.set(spaceId, { info: spaceInfo, cachedAt: Date.now() });
-      return (0, import_sdk_services5.ok)(spaceInfo);
+      return (0, import_sdk_services6.ok)(spaceInfo);
     } catch (error) {
-      return (0, import_sdk_services5.err)(
-        (0, import_sdk_services5.serviceError)(
+      return (0, import_sdk_services6.err)(
+        (0, import_sdk_services6.serviceError)(
           SpaceErrorCodes.NETWORK_ERROR,
           `Network error getting space info: ${String(error)}`,
           SERVICE_NAME,
@@ -13722,7 +13891,7 @@ var SpaceService = class {
             headers
           });
           if (!response.ok) {
-            return (0, import_sdk_services5.err)(await serviceHttpError(
+            return (0, import_sdk_services6.err)(await serviceHttpError(
               response,
               SpaceErrorCodes.NETWORK_ERROR,
               "Failed to list delegations",
@@ -13732,8 +13901,8 @@ var SpaceService = class {
           const rawData = await response.json();
           const validationResult = validateServerDelegationsResponse(rawData);
           if (!validationResult.ok) {
-            return (0, import_sdk_services5.err)(
-              (0, import_sdk_services5.serviceError)(
+            return (0, import_sdk_services6.err)(
+              (0, import_sdk_services6.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 validationResult.error.message,
                 SERVICE_NAME,
@@ -13742,10 +13911,10 @@ var SpaceService = class {
             );
           }
           const delegations = transformServerDelegations(validationResult.data, spaceId);
-          return (0, import_sdk_services5.ok)(delegations);
+          return (0, import_sdk_services6.ok)(delegations);
         } catch (error) {
-          return (0, import_sdk_services5.err)(
-            (0, import_sdk_services5.serviceError)(
+          return (0, import_sdk_services6.err)(
+            (0, import_sdk_services6.serviceError)(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error listing delegations: ${String(error)}`,
               SERVICE_NAME
@@ -13775,7 +13944,7 @@ var SpaceService = class {
             headers
           });
           if (!response.ok) {
-            return (0, import_sdk_services5.err)(await serviceHttpError(
+            return (0, import_sdk_services6.err)(await serviceHttpError(
               response,
               SpaceErrorCodes.NETWORK_ERROR,
               "Failed to list received delegations",
@@ -13785,8 +13954,8 @@ var SpaceService = class {
           const rawData = await response.json();
           const validationResult = validateServerDelegationsResponse(rawData);
           if (!validationResult.ok) {
-            return (0, import_sdk_services5.err)(
-              (0, import_sdk_services5.serviceError)(
+            return (0, import_sdk_services6.err)(
+              (0, import_sdk_services6.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 validationResult.error.message,
                 SERVICE_NAME,
@@ -13795,10 +13964,10 @@ var SpaceService = class {
             );
           }
           const delegations = transformServerDelegations(validationResult.data, spaceId);
-          return (0, import_sdk_services5.ok)(delegations);
+          return (0, import_sdk_services6.ok)(delegations);
         } catch (error) {
-          return (0, import_sdk_services5.err)(
-            (0, import_sdk_services5.serviceError)(
+          return (0, import_sdk_services6.err)(
+            (0, import_sdk_services6.serviceError)(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error listing received delegations: ${String(error)}`,
               SERVICE_NAME
@@ -13810,8 +13979,8 @@ var SpaceService = class {
         if (self.createDelegationFn) {
           return self.createDelegationFn({ ...params, spaceId });
         }
-        return (0, import_sdk_services5.err)(
-          (0, import_sdk_services5.serviceError)(
+        return (0, import_sdk_services6.err)(
+          (0, import_sdk_services6.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Delegation creation requires a createDelegation function. This should be provided by the platform SDK (web-sdk or node-sdk).",
             SERVICE_NAME
@@ -13832,17 +14001,17 @@ var SpaceService = class {
             body: JSON.stringify({ cid: cid2, spaceId })
           });
           if (!response.ok) {
-            return (0, import_sdk_services5.err)(await serviceHttpError(
+            return (0, import_sdk_services6.err)(await serviceHttpError(
               response,
               SpaceErrorCodes.NETWORK_ERROR,
               "Failed to revoke delegation",
               SERVICE_NAME
             ));
           }
-          return (0, import_sdk_services5.ok)(void 0);
+          return (0, import_sdk_services6.ok)(void 0);
         } catch (error) {
-          return (0, import_sdk_services5.err)(
-            (0, import_sdk_services5.serviceError)(
+          return (0, import_sdk_services6.err)(
+            (0, import_sdk_services6.serviceError)(
               SpaceErrorCodes.NETWORK_ERROR,
               `Network error revoking delegation: ${String(error)}`,
               SERVICE_NAME
@@ -13865,18 +14034,18 @@ var SpaceService = class {
         if (self.sharingService) {
           const result = await self.sharingService.generate(params);
           if (!result.ok) {
-            return (0, import_sdk_services5.err)(
-              (0, import_sdk_services5.serviceError)(
+            return (0, import_sdk_services6.err)(
+              (0, import_sdk_services6.serviceError)(
                 SpaceErrorCodes.NETWORK_ERROR,
                 result.error.message || "Failed to generate share link",
                 SERVICE_NAME
               )
             );
           }
-          return (0, import_sdk_services5.ok)(result.data);
+          return (0, import_sdk_services6.ok)(result.data);
         }
-        return (0, import_sdk_services5.err)(
-          (0, import_sdk_services5.serviceError)(
+        return (0, import_sdk_services6.err)(
+          (0, import_sdk_services6.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "SharingService not configured. V2 sharing requires a SharingService instance.",
             SERVICE_NAME
@@ -13884,8 +14053,8 @@ var SpaceService = class {
         );
       },
       async list() {
-        return (0, import_sdk_services5.err)(
-          (0, import_sdk_services5.serviceError)(
+        return (0, import_sdk_services6.err)(
+          (0, import_sdk_services6.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Listing share links is not supported in v2. Share links are self-contained tokens that are not tracked on the server.",
             SERVICE_NAME
@@ -13893,8 +14062,8 @@ var SpaceService = class {
         );
       },
       async revoke(token) {
-        return (0, import_sdk_services5.err)(
-          (0, import_sdk_services5.serviceError)(
+        return (0, import_sdk_services6.err)(
+          (0, import_sdk_services6.serviceError)(
             SpaceErrorCodes.NOT_INITIALIZED,
             "Revoking share links by token is not supported in v2. To revoke access, revoke the underlying delegation using space.delegations.revoke(cid).",
             SERVICE_NAME
@@ -13954,7 +14123,7 @@ var TinyCloud = class _TinyCloud {
         "hosts are required to initialize services. Provide them via config.hosts or initializeServices()."
       );
     }
-    this._serviceContext = new import_sdk_services6.ServiceContext({
+    this._serviceContext = new import_sdk_services7.ServiceContext({
       invoke: effectiveInvoke,
       invokeAny: this.config.invokeAny,
       fetch: fetchFn ?? this.config.fetch ?? globalThis.fetch.bind(globalThis),
@@ -13963,10 +14132,10 @@ var TinyCloud = class _TinyCloud {
       telemetry: this.config.telemetry
     });
     const serviceConstructors = {
-      kv: import_sdk_services6.KVService,
-      sql: import_sdk_services6.SQLService,
-      duckdb: import_sdk_services6.DuckDbService,
-      hooks: import_sdk_services6.HooksService,
+      kv: import_sdk_services7.KVService,
+      sql: import_sdk_services7.SQLService,
+      duckdb: import_sdk_services7.DuckDbService,
+      hooks: import_sdk_services7.HooksService,
       ...this.config.services
     };
     for (const [name2, ServiceClass] of Object.entries(serviceConstructors)) {
@@ -14230,18 +14399,18 @@ var TinyCloud = class _TinyCloud {
     const address = this.address();
     const chainId = this.chainId();
     if (!address || !chainId) {
-      return (0, import_sdk_services6.err)(
-        (0, import_sdk_services6.serviceError)(
-          import_sdk_services6.ErrorCodes.AUTH_REQUIRED,
+      return (0, import_sdk_services7.err)(
+        (0, import_sdk_services7.serviceError)(
+          import_sdk_services7.ErrorCodes.AUTH_REQUIRED,
           "Must be signed in to ensure public space",
           "public-space"
         )
       );
     }
     if (!this._serviceContext) {
-      return (0, import_sdk_services6.err)(
-        (0, import_sdk_services6.serviceError)(
-          import_sdk_services6.ErrorCodes.AUTH_REQUIRED,
+      return (0, import_sdk_services7.err)(
+        (0, import_sdk_services7.serviceError)(
+          import_sdk_services7.ErrorCodes.AUTH_REQUIRED,
           "Services not initialized. Call initializeServices() or signIn() first.",
           "public-space"
         )
@@ -14251,9 +14420,9 @@ var TinyCloud = class _TinyCloud {
     try {
       const session = this._serviceContext.session;
       if (!session) {
-        return (0, import_sdk_services6.err)(
-          (0, import_sdk_services6.serviceError)(
-            import_sdk_services6.ErrorCodes.AUTH_REQUIRED,
+        return (0, import_sdk_services7.err)(
+          (0, import_sdk_services7.serviceError)(
+            import_sdk_services7.ErrorCodes.AUTH_REQUIRED,
             "No active session",
             "public-space"
           )
@@ -14270,7 +14439,7 @@ var TinyCloud = class _TinyCloud {
         { method: "POST", headers, body: JSON.stringify({ spaceId }) }
       );
       if (response.ok) {
-        return (0, import_sdk_services6.ok)(void 0);
+        return (0, import_sdk_services7.ok)(void 0);
       }
       if (response.status === 404) {
         const createHeaders = this._serviceContext.invoke(
@@ -14289,27 +14458,27 @@ var TinyCloud = class _TinyCloud {
         );
         if (!createResponse.ok) {
           if (createResponse.status === 409) {
-            return (0, import_sdk_services6.ok)(void 0);
+            return (0, import_sdk_services7.ok)(void 0);
           }
-          return (0, import_sdk_services6.err)(await serviceHttpError(
+          return (0, import_sdk_services7.err)(await serviceHttpError(
             createResponse,
-            import_sdk_services6.ErrorCodes.NETWORK_ERROR,
+            import_sdk_services7.ErrorCodes.NETWORK_ERROR,
             "Failed to create public space",
             "public-space"
           ));
         }
-        return (0, import_sdk_services6.ok)(void 0);
+        return (0, import_sdk_services7.ok)(void 0);
       }
-      return (0, import_sdk_services6.err)(await serviceHttpError(
+      return (0, import_sdk_services7.err)(await serviceHttpError(
         response,
-        import_sdk_services6.ErrorCodes.NETWORK_ERROR,
+        import_sdk_services7.ErrorCodes.NETWORK_ERROR,
         "Failed to check public space",
         "public-space"
       ));
     } catch (error) {
-      return (0, import_sdk_services6.err)(
-        (0, import_sdk_services6.serviceError)(
-          import_sdk_services6.ErrorCodes.NETWORK_ERROR,
+      return (0, import_sdk_services7.err)(
+        (0, import_sdk_services7.serviceError)(
+          import_sdk_services7.ErrorCodes.NETWORK_ERROR,
           `Network error ensuring public space: ${String(error)}`,
           "public-space",
           { cause: error instanceof Error ? error : void 0 }
@@ -14342,8 +14511,8 @@ var TinyCloud = class _TinyCloud {
     if (!session) {
       throw new Error("No active session. Sign in first.");
     }
-    const publicKV = new import_sdk_services6.KVService({ prefix: "" });
-    const publicContext = new import_sdk_services6.ServiceContext({
+    const publicKV = new import_sdk_services7.KVService({ prefix: "" });
+    const publicContext = new import_sdk_services7.ServiceContext({
       invoke: this._serviceContext.invoke,
       fetch: this._serviceContext.fetch,
       hosts: this._serviceContext.hosts,
@@ -14376,16 +14545,16 @@ var TinyCloud = class _TinyCloud {
       const response = await doFetch(url, { method: "GET" });
       if (!response.ok) {
         if (response.status === 404) {
-          return (0, import_sdk_services6.err)(await serviceHttpError(
+          return (0, import_sdk_services7.err)(await serviceHttpError(
             response,
-            import_sdk_services6.ErrorCodes.NOT_FOUND,
+            import_sdk_services7.ErrorCodes.NOT_FOUND,
             `Key not found: ${key} in space ${spaceId}`,
             "public-space"
           ));
         }
-        return (0, import_sdk_services6.err)(await serviceHttpError(
+        return (0, import_sdk_services7.err)(await serviceHttpError(
           response,
-          import_sdk_services6.ErrorCodes.NETWORK_ERROR,
+          import_sdk_services7.ErrorCodes.NETWORK_ERROR,
           "Failed to read public space",
           "public-space"
         ));
@@ -14402,11 +14571,11 @@ var TinyCloud = class _TinyCloud {
           data = text3;
         }
       }
-      return (0, import_sdk_services6.ok)(data);
+      return (0, import_sdk_services7.ok)(data);
     } catch (error) {
-      return (0, import_sdk_services6.err)(
-        (0, import_sdk_services6.serviceError)(
-          import_sdk_services6.ErrorCodes.NETWORK_ERROR,
+      return (0, import_sdk_services7.err)(
+        (0, import_sdk_services7.serviceError)(
+          import_sdk_services7.ErrorCodes.NETWORK_ERROR,
           `Network error reading public space: ${String(error)}`,
           "public-space",
           { cause: error instanceof Error ? error : void 0 }
@@ -14432,7 +14601,7 @@ var TinyCloud = class _TinyCloud {
 };
 
 // src/account/AccountService.ts
-var import_sdk_services7 = require("@tinycloud/sdk-services");
+var import_sdk_services8 = require("@tinycloud/sdk-services");
 var import_bootstrap3 = require("@tinycloud/bootstrap");
 var SERVICE_NAME2 = "account";
 var ACCOUNT_INDEX_DB = "account";
@@ -14480,7 +14649,7 @@ var AccountService = class {
           applications.push(applicationFromRecord(key, loaded.data.data));
         }
         applications.sort((a, b) => a.appId.localeCompare(b.appId));
-        return (0, import_sdk_services7.ok)(applications);
+        return (0, import_sdk_services8.ok)(applications);
       },
       get: async (appId) => {
         const kvResult = this.accountKV();
@@ -14488,14 +14657,14 @@ var AccountService = class {
         const key = applicationKey(appId);
         const loaded = await kvResult.data.get(key);
         if (!loaded.ok) return accountErr(loaded.error);
-        return (0, import_sdk_services7.ok)(applicationFromRecord(key, loaded.data.data));
+        return (0, import_sdk_services8.ok)(applicationFromRecord(key, loaded.data.data));
       },
       register: async (manifest, options2 = {}) => {
         const manifests = Array.isArray(manifest) ? manifest : [manifest];
         const request = composeManifestRequest(manifests);
         if (request.registryRecords.length === 0) {
-          return (0, import_sdk_services7.err)(
-            (0, import_sdk_services7.serviceError)(
+          return (0, import_sdk_services8.err)(
+            (0, import_sdk_services8.serviceError)(
               "INVALID_MANIFEST",
               "Manifest did not produce an account application registry record",
               SERVICE_NAME2
@@ -14529,7 +14698,7 @@ var AccountService = class {
           registered = applicationFromRecord(record2.key, stored);
           await this.upsertApplicationIndexQuietly(registered);
         }
-        return (0, import_sdk_services7.ok)(registered);
+        return (0, import_sdk_services8.ok)(registered);
       },
       remove: async (appId) => {
         const kvResult = this.accountKV();
@@ -14537,7 +14706,7 @@ var AccountService = class {
         const removed = await kvResult.data.delete(applicationKey(appId));
         if (!removed.ok) return accountErr(removed.error);
         await this.deleteApplicationIndexQuietly(appId);
-        return (0, import_sdk_services7.ok)(void 0);
+        return (0, import_sdk_services8.ok)(void 0);
       }
     };
     this.spaces = {
@@ -14551,7 +14720,7 @@ var AccountService = class {
           if (canonical.data.allRegistered && options2.refreshIndex !== false) {
             await this.replaceSpacesIndexQuietly(canonical.data.spaces);
           }
-          return (0, import_sdk_services7.ok)(canonical.data.spaces);
+          return (0, import_sdk_services8.ok)(canonical.data.spaces);
         }
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
@@ -14564,14 +14733,14 @@ var AccountService = class {
           spaces.push(spaceFromRecord(key, loaded.data.data));
         }
         spaces.sort((a, b) => a.name.localeCompare(b.name) || a.spaceId.localeCompare(b.spaceId));
-        return (0, import_sdk_services7.ok)(spaces);
+        return (0, import_sdk_services8.ok)(spaces);
       },
       get: async (spaceId) => {
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
         const loaded = await kvResult.data.get(spaceKey(spaceId));
         if (!loaded.ok) return accountErr(loaded.error);
-        return (0, import_sdk_services7.ok)(spaceFromRecord(spaceKey(spaceId), loaded.data.data));
+        return (0, import_sdk_services8.ok)(spaceFromRecord(spaceKey(spaceId), loaded.data.data));
       },
       register: async (space) => {
         await this.config.ensureAccountSpaceHosted?.();
@@ -14582,7 +14751,7 @@ var AccountService = class {
         if (!written.ok) return accountErr(written.error);
         const registered = spaceFromRecord(spaceKey(stored.space_id), stored);
         await this.upsertSpaceIndexQuietly(registered);
-        return (0, import_sdk_services7.ok)(registered);
+        return (0, import_sdk_services8.ok)(registered);
       },
       /**
        * Register multiple spaces in one KV batch write + one multi-row index
@@ -14595,7 +14764,7 @@ var AccountService = class {
        * leave the first attempt's blocks orphaned.
        */
       registerBatch: async (spaces) => {
-        if (spaces.length === 0) return (0, import_sdk_services7.ok)({ spaces: [] });
+        if (spaces.length === 0) return (0, import_sdk_services8.ok)({ spaces: [] });
         await this.config.ensureAccountSpaceHosted?.();
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
@@ -14610,7 +14779,7 @@ var AccountService = class {
         const batchResult = await kvResult.data.batchPut(items);
         if (batchResult.ok) {
           await this.upsertSpacesIndexQuietly(registered);
-          return (0, import_sdk_services7.ok)({ spaces: registered });
+          return (0, import_sdk_services8.ok)({ spaces: registered });
         }
         if (!isAmbiguousBatchFailure(batchResult.error)) {
           return accountErr(batchResult.error);
@@ -14623,8 +14792,8 @@ var AccountService = class {
           }
         }
         if (reconcileFailures.length > 0) {
-          return (0, import_sdk_services7.err)(
-            (0, import_sdk_services7.serviceError)(
+          return (0, import_sdk_services8.err)(
+            (0, import_sdk_services8.serviceError)(
               "KV_BATCH_RECONCILE_FAILED",
               `KV batch write for ${items.length} space(s) failed ambiguously (${batchResult.error.message}) and per-space reconciliation also failed for: ${reconcileFailures.join("; ")}`,
               SERVICE_NAME2,
@@ -14636,7 +14805,7 @@ var AccountService = class {
           `[AccountService] KV batch write for ${items.length} space(s) returned an ambiguous error and was reconciled via per-space fallback. Original error: ${batchResult.error.message}`
         );
         await this.upsertSpacesIndexQuietly(registered);
-        return (0, import_sdk_services7.ok)({ spaces: registered, recoveredFromBatchError: batchResult.error });
+        return (0, import_sdk_services8.ok)({ spaces: registered, recoveredFromBatchError: batchResult.error });
       },
       /**
        * Register only spaces without a registry record (TC-800). Existing
@@ -14644,7 +14813,7 @@ var AccountService = class {
        * Bootstrap repair uses this on populated accounts.
        */
       registerMissing: async (spaces) => {
-        if (spaces.length === 0) return (0, import_sdk_services7.ok)([]);
+        if (spaces.length === 0) return (0, import_sdk_services8.ok)([]);
         await this.config.ensureAccountSpaceHosted?.();
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
@@ -14660,15 +14829,15 @@ var AccountService = class {
           const key = keys[i];
           const result = byKey.get(key);
           if (!result) {
-            return (0, import_sdk_services7.err)((0, import_sdk_services7.serviceError)(
-              import_sdk_services7.ErrorCodes.NETWORK_ERROR,
+            return (0, import_sdk_services8.err)((0, import_sdk_services8.serviceError)(
+              import_sdk_services8.ErrorCodes.NETWORK_ERROR,
               `KV batch read omitted requested key ${JSON.stringify(key)}`,
               SERVICE_NAME2
             ));
           }
           if (result.ok) {
             final[i] = spaceFromRecord(key, result.data.data);
-          } else if (result.error.code === import_sdk_services7.ErrorCodes.KV_NOT_FOUND) {
+          } else if (result.error.code === import_sdk_services8.ErrorCodes.KV_NOT_FOUND) {
             missing.push({ index: i, key, record: stored[i] });
           } else {
             return accountErr(result.error);
@@ -14676,21 +14845,21 @@ var AccountService = class {
         }
         const creates = await Promise.all(missing.map(async ({ index, key, record: record2 }) => {
           const written = await kv.put(key, record2, { ifNoneMatch: "*" });
-          if (written.ok) return { index, result: (0, import_sdk_services7.ok)(spaceFromRecord(key, record2)) };
+          if (written.ok) return { index, result: (0, import_sdk_services8.ok)(spaceFromRecord(key, record2)) };
           const raced = await kv.get(key);
-          if (raced.ok) return { index, result: (0, import_sdk_services7.ok)(spaceFromRecord(key, raced.data.data)) };
-          return { index, result: (0, import_sdk_services7.err)(written.error) };
+          if (raced.ok) return { index, result: (0, import_sdk_services8.ok)(spaceFromRecord(key, raced.data.data)) };
+          return { index, result: (0, import_sdk_services8.err)(written.error) };
         }));
         for (const { index, result } of creates) {
           if (!result.ok) return accountErr(result.error);
           final[index] = result.data;
         }
         await this.upsertSpacesIndexQuietly(final);
-        return (0, import_sdk_services7.ok)(final);
+        return (0, import_sdk_services8.ok)(final);
       },
       syncAccessible: async () => {
         const synced = await this.syncAccessibleSpaces({ tolerateStorageFull: false });
-        return synced.ok ? (0, import_sdk_services7.ok)(synced.data.spaces) : synced;
+        return synced.ok ? (0, import_sdk_services8.ok)(synced.data.spaces) : synced;
       },
       remove: async (spaceId) => {
         const kvResult = this.accountKV();
@@ -14698,21 +14867,21 @@ var AccountService = class {
         const removed = await kvResult.data.delete(spaceKey(spaceId));
         if (!removed.ok) return accountErr(removed.error);
         await this.deleteSpaceIndexQuietly(spaceId);
-        return (0, import_sdk_services7.ok)(void 0);
+        return (0, import_sdk_services8.ok)(void 0);
       }
     };
     this.delegations = {
       query: async (options2 = {}) => {
         const manager = this.config.getDelegationManager?.();
         if (!manager) {
-          return (0, import_sdk_services7.err)((0, import_sdk_services7.serviceError)(
+          return (0, import_sdk_services8.err)((0, import_sdk_services8.serviceError)(
             "NOT_INITIALIZED",
             "Delegation history requires an authenticated delegation manager",
             SERVICE_NAME2
           ));
         }
         const queried = await manager.query(options2);
-        return queried.ok ? (0, import_sdk_services7.ok)(queried.data) : accountErr(queried.error);
+        return queried.ok ? (0, import_sdk_services8.ok)(queried.data) : accountErr(queried.error);
       },
       list: async (options2 = {}) => {
         if (options2.preferIndex) {
@@ -14746,17 +14915,17 @@ var AccountService = class {
           }
         }
         delegations.sort((a, b) => a.spaceId.localeCompare(b.spaceId) || a.cid.localeCompare(b.cid));
-        return (0, import_sdk_services7.ok)(delegations);
+        return (0, import_sdk_services8.ok)(delegations);
       },
       revoke: async (input) => {
         const cid2 = typeof input === "string" ? input : input.cid;
         const manager = this.config.getDelegationManager?.();
         if (manager) {
           const revoked2 = await manager.revoke(cid2);
-          return revoked2.ok ? (0, import_sdk_services7.ok)(revoked2.data) : accountErr(revoked2.error);
+          return revoked2.ok ? (0, import_sdk_services8.ok)(revoked2.data) : accountErr(revoked2.error);
         }
         if (typeof input === "string") {
-          return (0, import_sdk_services7.err)((0, import_sdk_services7.serviceError)(
+          return (0, import_sdk_services8.err)((0, import_sdk_services8.serviceError)(
             "NOT_INITIALIZED",
             "CID-only revocation requires an authenticated delegation manager",
             SERVICE_NAME2
@@ -14766,7 +14935,7 @@ var AccountService = class {
         if (!space.ok) return space;
         const revoked = await this.config.getSpaces().get(space.data.id).delegations.revoke(cid2);
         if (!revoked.ok) return accountErr(revoked.error);
-        return (0, import_sdk_services7.ok)(void 0);
+        return (0, import_sdk_services8.ok)(void 0);
       }
     };
     this.index = {
@@ -14775,7 +14944,7 @@ var AccountService = class {
         if (!dbResult.ok) return dbResult;
         const schema = await this.ensureAccountIndex(dbResult.data);
         if (!schema.ok) return schema;
-        return (0, import_sdk_services7.ok)({ database: ACCOUNT_INDEX_DB });
+        return (0, import_sdk_services8.ok)({ database: ACCOUNT_INDEX_DB });
       },
       rebuild: async () => {
         const dbResult = this.accountDb();
@@ -14857,7 +15026,7 @@ var AccountService = class {
         ];
         const rebuilt = await dbResult.data.batch(statements);
         if (!rebuilt.ok) return accountErr(rebuilt.error);
-        return (0, import_sdk_services7.ok)({
+        return (0, import_sdk_services8.ok)({
           database: ACCOUNT_INDEX_DB,
           applications: applications.data.length,
           spaces: spaces.data.length,
@@ -14873,7 +15042,7 @@ var AccountService = class {
             "SELECT applications.app_id, name, description, updated_at, manifest_json, application_state.manifest_hash FROM applications LEFT JOIN application_state ON applications.app_id = application_state.app_id ORDER BY applications.app_id"
           );
           if (!queried.ok) return accountErr(queried.error);
-          return (0, import_sdk_services7.ok)(queried.data.rows.map(indexedApplicationFromRow));
+          return (0, import_sdk_services8.ok)(queried.data.rows.map(indexedApplicationFromRow));
         }
       },
       spaces: {
@@ -14884,7 +15053,7 @@ var AccountService = class {
             "SELECT space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at FROM spaces ORDER BY name, space_id"
           );
           if (!queried.ok) return accountErr(queried.error);
-          return (0, import_sdk_services7.ok)(queried.data.rows.map(indexedSpaceFromRow));
+          return (0, import_sdk_services8.ok)(queried.data.rows.map(indexedSpaceFromRow));
         }
       },
       delegations: {
@@ -14906,7 +15075,7 @@ var AccountService = class {
             params
           );
           if (!queried.ok) return accountErr(queried.error);
-          return (0, import_sdk_services7.ok)(queried.data.rows.map(indexedDelegationFromRow));
+          return (0, import_sdk_services8.ok)(queried.data.rows.map(indexedDelegationFromRow));
         }
       },
       query: async (sql, params) => {
@@ -14914,7 +15083,7 @@ var AccountService = class {
         if (!dbResult.ok) return dbResult;
         const queried = await dbResult.data.query(sql, params);
         if (!queried.ok) return accountErr(queried.error);
-        return (0, import_sdk_services7.ok)(queried.data);
+        return (0, import_sdk_services8.ok)(queried.data);
       },
       status: async () => {
         const dbResult = this.accountDb();
@@ -14924,11 +15093,11 @@ var AccountService = class {
         );
         if (!queried.ok) {
           if (isMissingIndexError(queried.error)) {
-            return (0, import_sdk_services7.ok)({ database: ACCOUNT_INDEX_DB, state: "missing", sources: [] });
+            return (0, import_sdk_services8.ok)({ database: ACCOUNT_INDEX_DB, state: "missing", sources: [] });
           }
           return accountErr(queried.error);
         }
-        return (0, import_sdk_services7.ok)({
+        return (0, import_sdk_services8.ok)({
           database: ACCOUNT_INDEX_DB,
           state: "ready",
           sources: queried.data.rows.map(([source, syncedAt, count]) => ({
@@ -14947,7 +15116,7 @@ var AccountService = class {
     if (!delegations.ok) return delegations;
     const spaces = await this.spaces.list();
     if (!spaces.ok) return spaces;
-    return (0, import_sdk_services7.ok)({
+    return (0, import_sdk_services8.ok)({
       did: this.config.getDid(),
       host: this.config.getHost(),
       primarySpaceId: this.config.getPrimarySpaceId(),
@@ -14961,28 +15130,28 @@ var AccountService = class {
   accountKV() {
     const accountSpaceId = this.config.getAccountSpaceId();
     if (!accountSpaceId) {
-      return (0, import_sdk_services7.err)(
-        (0, import_sdk_services7.serviceError)(
+      return (0, import_sdk_services8.err)(
+        (0, import_sdk_services8.serviceError)(
           "ACCOUNT_SPACE_UNAVAILABLE",
           "Account space is unavailable. Sign in with a wallet-backed profile first.",
           SERVICE_NAME2
         )
       );
     }
-    return (0, import_sdk_services7.ok)(this.config.getSpaces().get(accountSpaceId).kv);
+    return (0, import_sdk_services8.ok)(this.config.getSpaces().get(accountSpaceId).kv);
   }
   accountDb() {
     const db = this.config.getAccountDb?.();
     if (!db) {
-      return (0, import_sdk_services7.err)(
-        (0, import_sdk_services7.serviceError)(
+      return (0, import_sdk_services8.err)(
+        (0, import_sdk_services8.serviceError)(
           "ACCOUNT_INDEX_UNAVAILABLE",
           "Account index database is unavailable. Sign in with a wallet-backed profile first.",
           SERVICE_NAME2
         )
       );
     }
-    return (0, import_sdk_services7.ok)(db);
+    return (0, import_sdk_services8.ok)(db);
   }
   async indexHasApplicationHash(appId, manifestHash) {
     const dbResult = this.accountDb();
@@ -15000,7 +15169,7 @@ var AccountService = class {
   }
   async upsertApplicationIndex(app) {
     const dbResult = this.accountDb();
-    if (!dbResult.ok) return (0, import_sdk_services7.ok)(void 0);
+    if (!dbResult.ok) return (0, import_sdk_services8.ok)(void 0);
     const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return schema;
     const updatedAt = app.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -15022,14 +15191,14 @@ var AccountService = class {
       }
     ]);
     if (!written.ok) return accountErr(written.error);
-    return (0, import_sdk_services7.ok)(void 0);
+    return (0, import_sdk_services8.ok)(void 0);
   }
   async deleteApplicationIndexQuietly(appId) {
     await ignoreIndexFailure(() => this.deleteApplicationIndex(appId));
   }
   async deleteApplicationIndex(appId) {
     const dbResult = this.accountDb();
-    if (!dbResult.ok) return (0, import_sdk_services7.ok)(void 0);
+    if (!dbResult.ok) return (0, import_sdk_services8.ok)(void 0);
     const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
@@ -15037,14 +15206,14 @@ var AccountService = class {
       { sql: "DELETE FROM application_state WHERE app_id = ?", params: [appId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
-    return (0, import_sdk_services7.ok)(void 0);
+    return (0, import_sdk_services8.ok)(void 0);
   }
   async upsertSpaceIndexQuietly(space) {
     await ignoreIndexFailure(() => this.upsertSpaceIndex(space));
   }
   async upsertSpaceIndex(space) {
     const dbResult = this.accountDb();
-    if (!dbResult.ok) return (0, import_sdk_services7.ok)(void 0);
+    if (!dbResult.ok) return (0, import_sdk_services8.ok)(void 0);
     const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return schema;
     const updatedAt = space.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -15065,7 +15234,7 @@ var AccountService = class {
       }
     ]);
     if (!written.ok) return accountErr(written.error);
-    return (0, import_sdk_services7.ok)(void 0);
+    return (0, import_sdk_services8.ok)(void 0);
   }
   async upsertSpacesIndexQuietly(spaces) {
     await ignoreIndexFailure(() => this.upsertSpacesIndex(spaces));
@@ -15079,9 +15248,9 @@ var AccountService = class {
    * atomically: all rows or none.
    */
   async upsertSpacesIndex(spaces) {
-    if (spaces.length === 0) return (0, import_sdk_services7.ok)(void 0);
+    if (spaces.length === 0) return (0, import_sdk_services8.ok)(void 0);
     const dbResult = this.accountDb();
-    if (!dbResult.ok) return (0, import_sdk_services7.ok)(void 0);
+    if (!dbResult.ok) return (0, import_sdk_services8.ok)(void 0);
     const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return schema;
     const placeholders = spaces.map(() => "(?, ?, ?, ?, ?, ?, ?, ?, ?)").join(", ");
@@ -15106,21 +15275,21 @@ var AccountService = class {
       }
     ]);
     if (!written.ok) return accountErr(written.error);
-    return (0, import_sdk_services7.ok)(void 0);
+    return (0, import_sdk_services8.ok)(void 0);
   }
   async deleteSpaceIndexQuietly(spaceId) {
     await ignoreIndexFailure(() => this.deleteSpaceIndex(spaceId));
   }
   async deleteSpaceIndex(spaceId) {
     const dbResult = this.accountDb();
-    if (!dbResult.ok) return (0, import_sdk_services7.ok)(void 0);
+    if (!dbResult.ok) return (0, import_sdk_services8.ok)(void 0);
     const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
       { sql: "DELETE FROM spaces WHERE space_id = ?", params: [spaceId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
-    return (0, import_sdk_services7.ok)(void 0);
+    return (0, import_sdk_services8.ok)(void 0);
   }
   /**
    * Register every space the session can reach and return them. With
@@ -15140,7 +15309,7 @@ var AccountService = class {
           spaces.push(result.data);
           continue;
         }
-        if (!options2.tolerateStorageFull || !(0, import_sdk_services7.isStorageFullError)(result.error)) {
+        if (!options2.tolerateStorageFull || !(0, import_sdk_services8.isStorageFullError)(result.error)) {
           return result;
         }
         allRegistered = false;
@@ -15148,18 +15317,18 @@ var AccountService = class {
       const record2 = spaceRecordFromInput(space);
       spaces.push(spaceFromRecord(spaceKey(record2.space_id), record2));
     }
-    return (0, import_sdk_services7.ok)({ spaces, allRegistered });
+    return (0, import_sdk_services8.ok)({ spaces, allRegistered });
   }
   async resolveSpace(space) {
     const listed = await this.config.getSpaces().list();
     if (!listed.ok) return accountErr(listed.error);
     const found = listed.data.find((candidate) => candidate.id === space || candidate.name === space);
     if (!found) {
-      return (0, import_sdk_services7.err)(
-        (0, import_sdk_services7.serviceError)("SPACE_NOT_FOUND", `No account space found for ${JSON.stringify(space)}`, SERVICE_NAME2)
+      return (0, import_sdk_services8.err)(
+        (0, import_sdk_services8.serviceError)("SPACE_NOT_FOUND", `No account space found for ${JSON.stringify(space)}`, SERVICE_NAME2)
       );
     }
-    return (0, import_sdk_services7.ok)(found);
+    return (0, import_sdk_services8.ok)(found);
   }
   async replaceApplicationsIndexQuietly(applications) {
     await ignoreIndexFailure(async () => {
@@ -15301,7 +15470,7 @@ var AccountService = class {
       ]
     });
     if (!migrated.ok) return accountErr(migrated.error);
-    return (0, import_sdk_services7.ok)(void 0);
+    return (0, import_sdk_services8.ok)(void 0);
   }
 };
 function applicationKey(appId) {
@@ -15457,17 +15626,17 @@ function mapDelegation(delegation, space, direction) {
   };
 }
 function accountErr(error) {
-  return (0, import_sdk_services7.err)((0, import_sdk_services7.serviceError)(error.code, error.message, SERVICE_NAME2, { cause: error.cause, meta: error.meta }));
+  return (0, import_sdk_services8.err)((0, import_sdk_services8.serviceError)(error.code, error.message, SERVICE_NAME2, { cause: error.cause, meta: error.meta }));
 }
 function isMissingIndexError(error) {
   return /no such table:/i.test(error.message);
 }
 var AMBIGUOUS_WRITE_STATUSES = /* @__PURE__ */ new Set([500, 502, 503, 504, 520, 522, 524]);
 function isAmbiguousBatchFailure(error) {
-  if (error.code === import_sdk_services7.ErrorCodes.NETWORK_ERROR || error.code === import_sdk_services7.ErrorCodes.TIMEOUT) {
+  if (error.code === import_sdk_services8.ErrorCodes.NETWORK_ERROR || error.code === import_sdk_services8.ErrorCodes.TIMEOUT) {
     return error.meta?.requestMayHaveDispatched === true;
   }
-  if (error.code === import_sdk_services7.ErrorCodes.KV_WRITE_FAILED) {
+  if (error.code === import_sdk_services8.ErrorCodes.KV_WRITE_FAILED) {
     const status = error.meta?.status;
     return typeof status === "number" && AMBIGUOUS_WRITE_STATUSES.has(status);
   }
@@ -15481,7 +15650,7 @@ async function ignoreIndexFailure(task) {
 }
 
 // src/index.ts
-var import_sdk_services9 = require("@tinycloud/sdk-services");
+var import_sdk_services10 = require("@tinycloud/sdk-services");
 
 // src/space.ts
 async function fetchPeerId(host, spaceId, signal) {
@@ -15586,7 +15755,7 @@ async function postSessionActivation(host, delegationHeader, signal) {
 }
 
 // src/authorization/CapabilityKeyRegistry.ts
-var import_sdk_services8 = require("@tinycloud/sdk-services");
+var import_sdk_services9 = require("@tinycloud/sdk-services");
 var SERVICE_NAME3 = "capability-key-registry";
 var CapabilityKeyRegistryErrorCodes = {
   /** Key not found in registry */
@@ -15811,8 +15980,8 @@ var CapabilityKeyRegistry = class {
   revokeDelegation(cid2) {
     const stored = this.store.byCid.get(cid2);
     if (!stored || stored.length === 0) {
-      return (0, import_sdk_services8.err)(
-        (0, import_sdk_services8.serviceError)(
+      return (0, import_sdk_services9.err)(
+        (0, import_sdk_services9.serviceError)(
           CapabilityKeyRegistryErrorCodes.KEY_NOT_FOUND,
           `Delegation not found: ${cid2}`,
           SERVICE_NAME3
@@ -15832,7 +16001,7 @@ var CapabilityKeyRegistry = class {
         }
       }
     }
-    return (0, import_sdk_services8.ok)(void 0);
+    return (0, import_sdk_services9.ok)(void 0);
   }
   // ===========================================================================
   // Search
@@ -16496,8 +16665,14 @@ function diffImmutableSiweFields(original, signed, options2) {
 function extractRecapAttenuations(siwe) {
   const merged = {};
   const lines = siwe.split(/\r?\n/);
+  let resources = false;
   for (const line of lines) {
-    const match = line.match(/urn:recap:([A-Za-z0-9_-]+=*)/);
+    if (line === "Resources:") {
+      resources = true;
+      continue;
+    }
+    if (!resources) continue;
+    const match = line.match(/^- urn:recap:([A-Za-z0-9_-]+=*)$/);
     if (!match) continue;
     const encoded = match[1];
     let decodedJson;