@tinycloud/sdk-services 3.1.0 → 3.2.0-beta.3

package/dist/index.d.ts

@@ -1,10 +1,11 @@
-import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-CVwwxqXF.js';
-export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-CVwwxqXF.js';
+import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-7A5rHWRY.js';
+export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-7A5rHWRY.js';
 import { z } from 'zod';
-import { B as BaseService } from './BaseService-B_UKhVht.js';
-export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-B_UKhVht.js';
+import { B as BaseService } from './BaseService-Di_hVfUV.js';
+export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-Di_hVfUV.js';
 import { IKVService } from './kv/index.js';
-export { DEFAULT_SIGNED_READ_URL_EXPIRY_MS, IPrefixedKVService, KVAction, KVActionType, KVBatchPutItem, KVBatchPutOptions, KVBatchPutResponse, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, PrefixedKVService } from './kv/index.js';
+export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.js';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, I as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, J as KVAction, M as KVActionType, N as KVBatchPutItem, O as KVBatchPutOptions, Q as KVBatchPutResponse, S as KVBatchReadResponse, T as KVChange, U as KVChangesAuthority, V as KVChangesOptions, W as KVChangesResponse, X as KVCreateSignedReadUrlOptions, Y as KVDeleteOptions, Z as KVGetOptions, _ as KVHeadOptions, $ as KVListOptions, b as KVListPage, a0 as KVListResponse, a1 as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, a2 as KVResponse, a3 as KVResponseHeaders, a4 as KVServiceConfig, a5 as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, n as PurgeTarget, o as ReplicaAuthorityState, p as ReplicaCoverage, q as ReplicaDevice, r as ReplicaGrantInfo, s as ReplicaState, t as ReplicaStatusEntry, u as ReplicationAuthority, v as ReplicationControl, w as ReplicationEvent, R as ReplicationIdentity, x as ReplicationOptions, y as ReplicationPurgeReport, z as ReplicationReason, B as ReplicationScheduler, D as ResolvedReplicationOptions, E as canonicalReplicationIdentity, F as kvPrefixCovers, G as replicationIdentityKey, H as requiresSecretsOptIn } from './scope-BmLxwyl-.js';
 export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.js';
 import { IEncryptionService, DecryptCapabilityProof } from './encryption/index.js';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, InlineEncryptedEnvelope, Json, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, base64Decode, base64Encode, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalize as canonicalizeEncryptionJson, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, encryptionError, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, hexDecode, hexEncode, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, utf8Decode, utf8Encode, validateEnvelope, verifyDecryptResponse } from './encryption/index.js';
@@ -92,14 +93,14 @@ declare const ServiceErrorSchema: z.ZodObject<{
     /** Additional metadata about the error - passthrough allows any object properties */
     meta: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
 }, "strip", z.ZodTypeAny, {
-    message: string;
     code: string;
+    message: string;
     service: string;
     cause?: unknown;
     meta?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
 }, {
-    message: string;
     code: string;
+    message: string;
     service: string;
     cause?: unknown;
     meta?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
@@ -177,22 +178,22 @@ declare const GenericResultSchema: z.ZodDiscriminatedUnion<"ok", [z.ZodObject<{
         /** Additional metadata about the error - passthrough allows any object properties */
         meta: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
     }, "strip", z.ZodTypeAny, {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
     }, {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
     error: {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
@@ -200,8 +201,8 @@ declare const GenericResultSchema: z.ZodDiscriminatedUnion<"ok", [z.ZodObject<{
     ok: false;
 }, {
     error: {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
@@ -488,14 +489,14 @@ declare const ServiceRequestEventSchema: z.ZodObject<{
     timestamp: number;
     service: string;
     action: string;
-    span?: string | undefined;
     key?: string | undefined;
+    span?: string | undefined;
 }, {
     timestamp: number;
     service: string;
     action: string;
-    span?: string | undefined;
     key?: string | undefined;
+    span?: string | undefined;
 }>;
 type ServiceRequestEventType = z.infer<typeof ServiceRequestEventSchema>;
 /**
@@ -545,22 +546,22 @@ declare const ServiceErrorEventSchema: z.ZodObject<{
         /** Additional metadata about the error - passthrough allows any object properties */
         meta: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
     }, "strip", z.ZodTypeAny, {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
     }, {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
     error: {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
@@ -569,8 +570,8 @@ declare const ServiceErrorEventSchema: z.ZodObject<{
     span?: string | undefined;
 }, {
     error: {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
@@ -598,22 +599,22 @@ declare const ServiceRetryEventSchema: z.ZodObject<{
         /** Additional metadata about the error - passthrough allows any object properties */
         meta: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
     }, "strip", z.ZodTypeAny, {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
     }, {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
     error: {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
@@ -623,8 +624,8 @@ declare const ServiceRetryEventSchema: z.ZodObject<{
     maxAttempts: number;
 }, {
     error: {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
@@ -656,14 +657,14 @@ declare const TelemetrySpanEventSchema: z.ZodObject<{
         /** Additional metadata about the error - passthrough allows any object properties */
         meta: z.ZodOptional<z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>;
     }, "strip", z.ZodTypeAny, {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
     }, {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
@@ -673,8 +674,8 @@ declare const TelemetrySpanEventSchema: z.ZodObject<{
     ok: boolean;
     span: string;
     error?: {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
@@ -687,8 +688,8 @@ declare const TelemetrySpanEventSchema: z.ZodObject<{
     ok: boolean;
     span: string;
     error?: {
-        message: string;
         code: string;
+        message: string;
         service: string;
         cause?: unknown;
         meta?: z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | undefined;
@@ -923,6 +924,7 @@ declare class ServiceContext implements IServiceContext {
     private _services;
     private _eventHandlers;
     private _abortController;
+    private _operationAbortSignal?;
     private _retired;
     private readonly _invoke;
     private readonly _invokeAny?;
@@ -1007,6 +1009,8 @@ declare class ServiceContext implements IServiceContext {
      * Get the abort signal for cancelling operations.
      */
     get abortSignal(): AbortSignal;
+    get operationAbortSignal(): AbortSignal | undefined;
+    setOperationAbortSignal(signal: AbortSignal | undefined): void;
     /**
      * Permanently retire this graph after its owner installs a replacement.
      * Unlike `abort()`, retirement never creates a fresh controller, so captured
@@ -1708,6 +1712,11 @@ interface VaultPutOptions {
     contentType?: string;
     /** Custom serializer (default: JSON.stringify for objects) */
     serialize?: (value: unknown) => Uint8Array;
+    /**
+     * `"*"` writes only when no value exists at the key. An existing value
+     * fails with `ALREADY_EXISTS`; it is never overwritten.
+     */
+    ifNoneMatch?: "*";
 }
 /**
  * Options for vault get operations.
@@ -1717,10 +1726,13 @@ interface VaultGetOptions<T = unknown> {
     deserialize?: (data: Uint8Array) => T;
     /** Return raw decrypted bytes without deserialization */
     raw?: boolean;
+    /** Force the underlying KV read to bypass replica read-through. */
+    source?: "network";
     /** Delegated KV service for reading from the grantor's space (used by getShared) */
     kv?: {
         get<V>(key: string, options?: {
             raw?: boolean;
+            source?: "network";
         }): Promise<{
             ok: boolean;
             data?: {
@@ -1738,8 +1750,9 @@ interface VaultGetOptions<T = unknown> {
 interface VaultListOptions {
     /** Prefix filter for key names */
     prefix?: string;
-    /** Remove prefix from returned keys */
     removePrefix?: boolean;
+    /** Force the underlying KV list to bypass replica read-through. */
+    source?: "network";
     /** Maximum number of keys to return. */
     limit?: number;
     /** Opaque cursor returned by a prior bounded page. */
@@ -1830,6 +1843,28 @@ type VaultErrorInput = {
     code: "STORAGE_ERROR";
     cause: Error;
     message?: string;
+    meta?: Record<string, unknown>;
+} | {
+    code: "ALREADY_EXISTS";
+    key: string;
+    message?: string;
+    meta?: Record<string, unknown>;
+    /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
+    cause: ServiceError & Error;
+} | {
+    /** HTTP 401 only: the session must sign in again. */
+    code: "AUTH_UNAUTHORIZED";
+    message: string;
+    meta?: Record<string, unknown>;
+    /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
+    cause: ServiceError & Error;
+} | {
+    /** A 403, or an authorization refusal without a status: signing in again does not help. */
+    code: "PERMISSION_DENIED";
+    message: string;
+    meta?: Record<string, unknown>;
+    /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
+    cause: ServiceError & Error;
 } | {
     code: "STORAGE_QUOTA_EXCEEDED" | "STORAGE_LIMIT_REACHED";
     message: string;
@@ -2316,7 +2351,24 @@ declare const SECRET_NAME_RE: RegExp;
 interface SecretScopeOptions {
     /** Optional logical scope. Omit for the global secret namespace. */
     scope?: string;
+    /** Bypass replication for existence-sensitive reads. */
+    source?: "network";
 }
+/** Canonical secret scope grammar shared with the TC-832 `/request` link. */
+declare const SECRET_SCOPE_RE: RegExp;
+/** Longest scope the TC-832 `/request` link accepts. */
+declare const MAX_SECRET_SCOPE_LENGTH = 64;
+/** Scopes the TC-832 `/request` link refuses. */
+declare const TC832_RESERVED_SCOPES: readonly string[];
+interface SecretPutOptions extends SecretScopeOptions {
+    /** Write only when no secret exists under this name; never overwrite. */
+    ifAbsent?: boolean;
+}
+/**
+ * Derive the canonical secret scope for an app id such as
+ * `xyz.tinycloud.feed-workflows` → `xyz-tinycloud-feed-workflows`.
+ */
+declare function appSecretScope(appId: string): string;
 interface ResolvedSecretPath {
     /** Canonical env-style secret name. */
     name: string;
@@ -2357,7 +2409,7 @@ interface ISecretsService {
     lock(): void;
     readonly isUnlocked: boolean;
     get(name: string, options?: SecretScopeOptions): Promise<Result<string, SecretsError>>;
-    put(name: string, value: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
+    put(name: string, value: string, options?: SecretPutOptions): Promise<Result<void, SecretsError>>;
     delete(name: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
     /** List global and scoped secrets without decrypting their values. */
@@ -2372,10 +2424,10 @@ declare class SecretsService implements ISecretsService {
     unlock(signer?: unknown): Promise<Result<void, VaultError>>;
     lock(): void;
     get(name: string, options?: SecretScopeOptions): Promise<Result<string, SecretsError>>;
-    put(name: string, value: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
+    put(name: string, value: string, options?: SecretPutOptions): Promise<Result<void, SecretsError>>;
     delete(name: string, options?: SecretScopeOptions): Promise<Result<void, SecretsError>>;
     list(options?: SecretScopeOptions): Promise<Result<string[], SecretsError>>;
     listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
-export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };
+export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };