@tinycloud/sdk-services 2.8.0 → 2.10.0

package/dist/index.d.cts

@@ -1,9 +1,9 @@
-import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-KCcgZiab.cjs';
-export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-KCcgZiab.cjs';
+import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-qwMmB7qB.cjs';
+export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-qwMmB7qB.cjs';
 import { z } from 'zod';
-import { B as BaseService } from './BaseService-DxSU4U-v.cjs';
+import { B as BaseService } from './BaseService-BhpVpA9b.cjs';
 import { IKVService } from './kv/index.cjs';
-export { DEFAULT_SIGNED_READ_URL_EXPIRY_MS, IPrefixedKVService, KVAction, KVActionType, KVBatchPutItem, KVBatchPutOptions, KVBatchPutResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, PrefixedKVService } from './kv/index.cjs';
+export { DEFAULT_SIGNED_READ_URL_EXPIRY_MS, IPrefixedKVService, KVAction, KVActionType, KVBatchPutItem, KVBatchPutOptions, KVBatchPutResponse, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, PrefixedKVService } from './kv/index.cjs';
 export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.cjs';
 import { IEncryptionService, DecryptCapabilityProof } from './encryption/index.cjs';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, InlineEncryptedEnvelope, Json, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, base64Decode, base64Encode, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalize as canonicalizeEncryptionJson, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, encryptionError, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, hexDecode, hexEncode, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, utf8Decode, utf8Encode, validateEnvelope, verifyDecryptResponse } from './encryption/index.cjs';
@@ -418,10 +418,16 @@ type GenericKVResponseType = z.infer<typeof GenericKVResponseSchema>;
 declare const KVListResponseSchema: z.ZodObject<{
     /** Array of keys matching the list criteria */
     keys: z.ZodArray<z.ZodString, "many">;
+    truncated: z.ZodOptional<z.ZodBoolean>;
+    nextCursor: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     keys: string[];
+    truncated?: boolean | undefined;
+    nextCursor?: string | undefined;
 }, {
     keys: string[];
+    truncated?: boolean | undefined;
+    nextCursor?: string | undefined;
 }>;
 type KVListResponseType = z.infer<typeof KVListResponseSchema>;
 /**
@@ -432,19 +438,29 @@ declare const KVListResultSchema: z.ZodDiscriminatedUnion<"ok", [z.ZodObject<{
     data: z.ZodObject<{
         /** Array of keys matching the list criteria */
         keys: z.ZodArray<z.ZodString, "many">;
+        truncated: z.ZodOptional<z.ZodBoolean>;
+        nextCursor: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         keys: string[];
+        truncated?: boolean | undefined;
+        nextCursor?: string | undefined;
     }, {
         keys: string[];
+        truncated?: boolean | undefined;
+        nextCursor?: string | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
     data: {
         keys: string[];
+        truncated?: boolean | undefined;
+        nextCursor?: string | undefined;
     };
     ok: true;
 }, {
     data: {
         keys: string[];
+        truncated?: boolean | undefined;
+        nextCursor?: string | undefined;
     };
     ok: true;
 }>, z.ZodObject<{
@@ -1595,6 +1611,15 @@ interface VaultListOptions {
     prefix?: string;
     /** Remove prefix from returned keys */
     removePrefix?: boolean;
+    /** Maximum number of keys to return. */
+    limit?: number;
+    /** Opaque cursor returned by a prior bounded page. */
+    cursor?: string;
+}
+interface VaultListPage {
+    keys: string[];
+    truncated: boolean;
+    nextCursor?: string;
 }
 /**
  * Options for vault grant (sharing) operations.
@@ -1763,6 +1788,8 @@ interface IDataVaultService extends IService {
      * @returns Result with the decrypted entry
      */
     get<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<Result<VaultEntry<T>, VaultError>>;
+    /** Read a network-encrypted value with safe, phase-classified failures. */
+    readNetworkEncrypted<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<VaultNetworkReadResult<T>>;
     /**
      * Delete an encrypted key.
      *
@@ -1776,6 +1803,8 @@ interface IDataVaultService extends IService {
      * @returns Result with array of key names
      */
     list(options?: VaultListOptions): Promise<Result<string[], VaultError>>;
+    /** List one bounded, cursor-aware page of vault keys. */
+    listPage(options?: VaultListOptions): Promise<Result<VaultListPage, VaultError>>;
     /**
      * Get envelope metadata for a key without decrypting the value.
      *
@@ -2049,6 +2078,7 @@ declare class DataVaultService extends BaseService implements IDataVaultService
      * @returns Result with array of key names (vault/ prefix stripped)
      */
     list(options?: VaultListOptions): Promise<Result<string[], VaultError>>;
+    listPage(options?: VaultListOptions): Promise<Result<VaultListPage, VaultError>>;
     /**
      * Get envelope metadata for a key without decrypting the value.
      *
@@ -2200,4 +2230,4 @@ declare class SecretsService implements ISecretsService {
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
 }
 
-export { BaseService, type BaseServiceOptions, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, type SchemaInfo, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, type ServiceConstructor, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, type ServiceRegistration, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, networkError, notFoundError, parseAuthError, parsePermissionHint, parsePermissionHintFromErrorText, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, wrapError };
+export { BaseService, type BaseServiceOptions, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, type SchemaInfo, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, type ServiceConstructor, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, type ServiceRegistration, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, networkError, notFoundError, parseAuthError, parsePermissionHint, parsePermissionHintFromErrorText, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, wrapError };

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-KCcgZiab.js';
-export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-KCcgZiab.js';
+import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-qwMmB7qB.js';
+export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-qwMmB7qB.js';
 import { z } from 'zod';
-import { B as BaseService } from './BaseService-BiYeqCRT.js';
+import { B as BaseService } from './BaseService-CuV-ZVPs.js';
 import { IKVService } from './kv/index.js';
-export { DEFAULT_SIGNED_READ_URL_EXPIRY_MS, IPrefixedKVService, KVAction, KVActionType, KVBatchPutItem, KVBatchPutOptions, KVBatchPutResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, PrefixedKVService } from './kv/index.js';
+export { DEFAULT_SIGNED_READ_URL_EXPIRY_MS, IPrefixedKVService, KVAction, KVActionType, KVBatchPutItem, KVBatchPutOptions, KVBatchPutResponse, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, PrefixedKVService } from './kv/index.js';
 export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.js';
 import { IEncryptionService, DecryptCapabilityProof } from './encryption/index.js';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, InlineEncryptedEnvelope, Json, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, base64Decode, base64Encode, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalize as canonicalizeEncryptionJson, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, encryptionError, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, hexDecode, hexEncode, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, utf8Decode, utf8Encode, validateEnvelope, verifyDecryptResponse } from './encryption/index.js';
@@ -418,10 +418,16 @@ type GenericKVResponseType = z.infer<typeof GenericKVResponseSchema>;
 declare const KVListResponseSchema: z.ZodObject<{
     /** Array of keys matching the list criteria */
     keys: z.ZodArray<z.ZodString, "many">;
+    truncated: z.ZodOptional<z.ZodBoolean>;
+    nextCursor: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     keys: string[];
+    truncated?: boolean | undefined;
+    nextCursor?: string | undefined;
 }, {
     keys: string[];
+    truncated?: boolean | undefined;
+    nextCursor?: string | undefined;
 }>;
 type KVListResponseType = z.infer<typeof KVListResponseSchema>;
 /**
@@ -432,19 +438,29 @@ declare const KVListResultSchema: z.ZodDiscriminatedUnion<"ok", [z.ZodObject<{
     data: z.ZodObject<{
         /** Array of keys matching the list criteria */
         keys: z.ZodArray<z.ZodString, "many">;
+        truncated: z.ZodOptional<z.ZodBoolean>;
+        nextCursor: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         keys: string[];
+        truncated?: boolean | undefined;
+        nextCursor?: string | undefined;
     }, {
         keys: string[];
+        truncated?: boolean | undefined;
+        nextCursor?: string | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
     data: {
         keys: string[];
+        truncated?: boolean | undefined;
+        nextCursor?: string | undefined;
     };
     ok: true;
 }, {
     data: {
         keys: string[];
+        truncated?: boolean | undefined;
+        nextCursor?: string | undefined;
     };
     ok: true;
 }>, z.ZodObject<{
@@ -1595,6 +1611,15 @@ interface VaultListOptions {
     prefix?: string;
     /** Remove prefix from returned keys */
     removePrefix?: boolean;
+    /** Maximum number of keys to return. */
+    limit?: number;
+    /** Opaque cursor returned by a prior bounded page. */
+    cursor?: string;
+}
+interface VaultListPage {
+    keys: string[];
+    truncated: boolean;
+    nextCursor?: string;
 }
 /**
  * Options for vault grant (sharing) operations.
@@ -1763,6 +1788,8 @@ interface IDataVaultService extends IService {
      * @returns Result with the decrypted entry
      */
     get<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<Result<VaultEntry<T>, VaultError>>;
+    /** Read a network-encrypted value with safe, phase-classified failures. */
+    readNetworkEncrypted<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<VaultNetworkReadResult<T>>;
     /**
      * Delete an encrypted key.
      *
@@ -1776,6 +1803,8 @@ interface IDataVaultService extends IService {
      * @returns Result with array of key names
      */
     list(options?: VaultListOptions): Promise<Result<string[], VaultError>>;
+    /** List one bounded, cursor-aware page of vault keys. */
+    listPage(options?: VaultListOptions): Promise<Result<VaultListPage, VaultError>>;
     /**
      * Get envelope metadata for a key without decrypting the value.
      *
@@ -2049,6 +2078,7 @@ declare class DataVaultService extends BaseService implements IDataVaultService
      * @returns Result with array of key names (vault/ prefix stripped)
      */
     list(options?: VaultListOptions): Promise<Result<string[], VaultError>>;
+    listPage(options?: VaultListOptions): Promise<Result<VaultListPage, VaultError>>;
     /**
      * Get envelope metadata for a key without decrypting the value.
      *
@@ -2200,4 +2230,4 @@ declare class SecretsService implements ISecretsService {
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
 }
 
-export { BaseService, type BaseServiceOptions, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, type SchemaInfo, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, type ServiceConstructor, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, type ServiceRegistration, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, networkError, notFoundError, parseAuthError, parsePermissionHint, parsePermissionHintFromErrorText, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, wrapError };
+export { BaseService, type BaseServiceOptions, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, type SchemaInfo, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, type ServiceConstructor, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, type ServiceRegistration, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, networkError, notFoundError, parseAuthError, parsePermissionHint, parsePermissionHintFromErrorText, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, wrapError };

package/dist/index.js

@@ -373,7 +373,9 @@ function createKVResponseSchema(dataSchema) {
 var GenericKVResponseSchema = createKVResponseSchema(z.unknown());
 var KVListResponseSchema = z.object({
   /** Array of keys matching the list criteria */
-  keys: z.array(z.string())
+  keys: z.array(z.string()),
+  truncated: z.boolean().optional(),
+  nextCursor: z.string().optional()
 });
 var KVListResultSchema = createResultSchema(KVListResponseSchema);
 var ServiceRequestEventSchema = z.object({
@@ -1277,6 +1279,20 @@ var PrefixedKVService = class _PrefixedKVService {
     const fullKey = this.getFullKey(key);
     return this._kv.get(fullKey, { ...options, prefix: "" });
   }
+  async batchGet(keys, options) {
+    const response = await this._kv.batchGet(
+      keys.map((key) => this.getFullKey(key)),
+      { ...options, prefix: "" }
+    );
+    if (!response.ok) return response;
+    return ok({
+      ...response.data,
+      results: response.data.results.map((item, index) => ({
+        ...item,
+        key: keys[index]
+      }))
+    });
+  }
   /**
    * Store a value at a key.
    */
@@ -1321,6 +1337,20 @@ var PrefixedKVService = class _PrefixedKVService {
     const fullKey = this.getFullKey(key);
     return this._kv.head(fullKey, { ...options, prefix: "" });
   }
+  async batchHead(keys, options) {
+    const response = await this._kv.batchHead(
+      keys.map((key) => this.getFullKey(key)),
+      { ...options, prefix: "" }
+    );
+    if (!response.ok) return response;
+    return ok({
+      ...response.data,
+      results: response.data.results.map((item, index) => ({
+        ...item,
+        key: keys[index]
+      }))
+    });
+  }
   /**
    * Create a short-lived signed URL for reading a KV object.
    */
@@ -1349,6 +1379,7 @@ var KVAction = {
 };
 
 // src/kv/KVService.ts
+var MAX_KV_BATCH_READ_ITEMS = 100;
 function encodeKvBatchPartName(path) {
   return encodeURIComponent(path).replace(
     /[!'()*]/g,
@@ -1583,6 +1614,173 @@ var KVService = class extends BaseService {
       get: (name) => headers.get(name)
     };
   }
+  createBatchResponseHeaders(values) {
+    const normalized = new Map(
+      Object.entries(values).map(([name, value]) => [name.toLowerCase(), value])
+    );
+    return this.createResponseHeaders({
+      get: (name) => normalized.get(name.toLowerCase()) ?? null
+    });
+  }
+  parseBatchValue(dataBase64, headers, raw = false, binary = false) {
+    const encoded = globalThis.atob(dataBase64);
+    const bytes = Uint8Array.from(encoded, (character) => character.charCodeAt(0));
+    if (binary) return bytes;
+    const text = new TextDecoder().decode(bytes);
+    if (raw) return text;
+    const contentType = Object.entries(headers).find(
+      ([name]) => name.toLowerCase() === "content-type"
+    )?.[1];
+    return contentType?.includes("application/json") ? JSON.parse(text) : text;
+  }
+  normalizeBatchReadResponse(data, paths, requireData) {
+    if (!data || typeof data !== "object") return void 0;
+    const response = data;
+    if (!Array.isArray(response.results) || response.results.length !== paths.length) {
+      return void 0;
+    }
+    for (let index = 0; index < response.results.length; index++) {
+      const item = response.results[index];
+      if (!item || typeof item !== "object" || item.key !== paths[index] || typeof item.ok !== "boolean") {
+        return void 0;
+      }
+      if (item.ok && (!item.headers || typeof item.headers !== "object" || Object.values(item.headers).some((value) => typeof value !== "string") || requireData && typeof item.dataBase64 !== "string")) {
+        return void 0;
+      }
+      if (!item.ok && (!item.error || typeof item.error.code !== "string" || typeof item.error.message !== "string")) {
+        return void 0;
+      }
+    }
+    return response;
+  }
+  async batchRead(keys, action, options) {
+    if (!this.requireAuth()) return err(authRequiredError("kv"));
+    if (keys.length === 0) return ok({ results: [], count: 0 });
+    if (keys.length > MAX_KV_BATCH_READ_ITEMS) {
+      return err(serviceError(
+        ErrorCodes.INVALID_INPUT,
+        `KV batch reads accept at most ${MAX_KV_BATCH_READ_ITEMS} keys`,
+        "kv"
+      ));
+    }
+    if (keys.length === 1) {
+      const key = keys[0];
+      const result = action === KVAction.GET ? await this.get(key, options) : await this.head(key, options);
+      return ok({
+        results: [{ key, result }],
+        count: 1
+      });
+    }
+    if (!this.context.invokeAny) {
+      return err(serviceError(
+        ErrorCodes.INVALID_INPUT,
+        "KV batch reads require SDK runtime support for multi-resource invocations",
+        "kv"
+      ));
+    }
+    const getOptions = action === KVAction.GET ? options : void 0;
+    if (getOptions?.maxResponseBytes !== void 0 && (!Number.isSafeInteger(getOptions.maxResponseBytes) || getOptions.maxResponseBytes <= 0)) {
+      return err(serviceError(
+        ErrorCodes.INVALID_INPUT,
+        "KV maxResponseBytes must be a positive safe integer",
+        "kv"
+      ));
+    }
+    const paths = keys.map((key) => this.getFullPath(key, options?.prefix));
+    if (new Set(paths).size !== paths.length) {
+      return err(serviceError(
+        ErrorCodes.INVALID_INPUT,
+        "KV batch read received duplicate keys after prefix resolution",
+        "kv"
+      ));
+    }
+    try {
+      const session = this.context.session;
+      const invocationHeaders = this.context.invokeAny(
+        session,
+        paths.map((path) => ({
+          spaceId: session.spaceId,
+          service: "kv",
+          path,
+          action
+        }))
+      );
+      const limitHeaders = {};
+      if (getOptions?.maxResponseBytes !== void 0) {
+        limitHeaders["x-tinycloud-max-response-bytes"] = String(
+          getOptions.maxResponseBytes
+        );
+      }
+      const headers = Array.isArray(invocationHeaders) ? [...invocationHeaders, ...Object.entries(limitHeaders)] : { ...invocationHeaders, ...limitHeaders };
+      const response = await this.context.fetch(`${this.host}/invoke`, {
+        method: "POST",
+        headers,
+        signal: this.combineSignals(options?.signal)
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        if (response.status === 401 || response.status === 403) {
+          const { resource, action: requiredAction } = parseAuthError(errorText);
+          return err(authUnauthorizedError("kv", errorText, {
+            status: response.status,
+            ...requiredAction && { requiredAction },
+            ...resource && { resource }
+          }));
+        }
+        if (response.status === 413) {
+          return err(serviceError(
+            ErrorCodes.KV_RESPONSE_TOO_LARGE,
+            "A KV batch value exceeds the requested response limit",
+            "kv",
+            { meta: { status: response.status, statusText: response.statusText } }
+          ));
+        }
+        return err(serviceError(
+          ErrorCodes.NETWORK_ERROR,
+          `Failed to batch read ${keys.length} key(s): ${response.status} - ${errorText}`,
+          "kv",
+          { meta: { status: response.status, statusText: response.statusText } }
+        ));
+      }
+      const payload = this.normalizeBatchReadResponse(
+        await response.json(),
+        paths,
+        action === KVAction.GET
+      );
+      if (!payload) {
+        return err(serviceError(
+          ErrorCodes.NETWORK_ERROR,
+          "KV batch read response did not match the requested keys",
+          "kv"
+        ));
+      }
+      const results = payload.results.map((item, index) => {
+        if (!item.ok) {
+          return {
+            key: keys[index],
+            result: err(serviceError(item.error.code, item.error.message, "kv"))
+          };
+        }
+        const headers2 = item.headers;
+        const data = action === KVAction.HEAD ? void 0 : this.parseBatchValue(
+          item.dataBase64,
+          headers2,
+          getOptions?.raw,
+          getOptions?.binary
+        );
+        return {
+          key: keys[index],
+          result: ok({
+            data,
+            headers: this.createBatchResponseHeaders(headers2)
+          })
+        };
+      });
+      return ok({ results, count: results.length });
+    } catch (error) {
+      return err(wrapError("kv", error));
+    }
+  }
   /**
    * Parse response body based on content type.
    *
@@ -1729,6 +1927,13 @@ var KVService = class extends BaseService {
       }
     });
   }
+  async batchGet(keys, options) {
+    return this.withTelemetry(
+      "batchGet",
+      String(keys.length),
+      () => this.batchRead(keys, KVAction.GET, options)
+    );
+  }
   /**
    * Store a value at a key.
    */
@@ -1936,7 +2141,10 @@ var KVService = class extends BaseService {
           KVAction.LIST,
           void 0,
           options?.signal,
-          options?.limit === void 0 ? void 0 : { "x-tinycloud-limit": String(options.limit) }
+          options?.limit === void 0 && options?.cursor === void 0 ? void 0 : {
+            ...options?.limit === void 0 ? {} : { "x-tinycloud-limit": String(options.limit) },
+            ...options?.cursor === void 0 ? {} : { "x-tinycloud-cursor": options.cursor }
+          }
         );
         if (!response.ok) {
           if (response.status === 401) {
@@ -1968,7 +2176,8 @@ var KVService = class extends BaseService {
         }
         return ok({
           keys,
-          ...response.headers.get("x-tinycloud-truncated") === null ? {} : { truncated: response.headers.get("x-tinycloud-truncated") === "true" }
+          ...response.headers.get("x-tinycloud-truncated") === null ? {} : { truncated: response.headers.get("x-tinycloud-truncated") === "true" },
+          ...response.headers.get("x-tinycloud-next-cursor") === null ? {} : { nextCursor: response.headers.get("x-tinycloud-next-cursor") ?? void 0 }
         });
       } catch (error) {
         return err(wrapError("kv", error));
@@ -2088,6 +2297,13 @@ var KVService = class extends BaseService {
       }
     });
   }
+  async batchHead(keys, options) {
+    return this.withTelemetry(
+      "batchHead",
+      String(keys.length),
+      () => this.batchRead(keys, KVAction.HEAD, options)
+    );
+  }
   /**
    * Create a short-lived signed URL for reading a KV object.
    */
@@ -4686,6 +4902,10 @@ var DataVaultService = class extends BaseService {
    * @returns Result with array of key names (vault/ prefix stripped)
    */
   async list(options) {
+    const page = await this.listPage(options);
+    return page.ok ? { ok: true, data: page.data.keys } : page;
+  }
+  async listPage(options) {
     return this.withTelemetry("list", options?.prefix, async () => {
       if (!this.isUnlocked) {
         return vaultError({
@@ -4703,7 +4923,9 @@ var DataVaultService = class extends BaseService {
         const listPrefix = options?.prefix ? `vault/${options.prefix}` : "vault/";
         const listResult = await this.tc.kv.list({
           prefix: listPrefix,
-          removePrefix: true
+          removePrefix: true,
+          ...options?.limit === void 0 ? {} : { limit: options.limit },
+          ...options?.cursor === void 0 ? {} : { cursor: options.cursor }
         });
         if (!listResult.ok) {
           return vaultError({
@@ -4720,7 +4942,11 @@ var DataVaultService = class extends BaseService {
             (k) => k.startsWith(userPrefix) ? k.slice(userPrefix.length) : k
           );
         }
-        return ok(keys);
+        return ok({
+          keys,
+          truncated: listResult.data.truncated === true,
+          ...listResult.data.nextCursor === void 0 ? {} : { nextCursor: listResult.data.nextCursor }
+        });
       } catch (error) {
         return vaultError({
           code: "STORAGE_ERROR",