@tinycloud/sdk-services 3.2.0-beta.3 → 3.2.0-beta.7

package/dist/index.d.cts

@@ -1,15 +1,16 @@
-import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-7A5rHWRY.cjs';
-export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-7A5rHWRY.cjs';
+import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-D-9A3Sut.cjs';
+export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-D-9A3Sut.cjs';
 import { z } from 'zod';
-import { B as BaseService } from './BaseService-BDQXjWMx.cjs';
-export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-BDQXjWMx.cjs';
+import { B as BaseService } from './BaseService-4wwJq1Gn.cjs';
+export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-4wwJq1Gn.cjs';
 import { IKVService } from './kv/index.cjs';
 export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.cjs';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, I as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, J as KVAction, M as KVActionType, N as KVBatchPutItem, O as KVBatchPutOptions, Q as KVBatchPutResponse, S as KVBatchReadResponse, T as KVChange, U as KVChangesAuthority, V as KVChangesOptions, W as KVChangesResponse, X as KVCreateSignedReadUrlOptions, Y as KVDeleteOptions, Z as KVGetOptions, _ as KVHeadOptions, $ as KVListOptions, b as KVListPage, a0 as KVListResponse, a1 as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, a2 as KVResponse, a3 as KVResponseHeaders, a4 as KVServiceConfig, a5 as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, n as PurgeTarget, o as ReplicaAuthorityState, p as ReplicaCoverage, q as ReplicaDevice, r as ReplicaGrantInfo, s as ReplicaState, t as ReplicaStatusEntry, u as ReplicationAuthority, v as ReplicationControl, w as ReplicationEvent, R as ReplicationIdentity, x as ReplicationOptions, y as ReplicationPurgeReport, z as ReplicationReason, B as ReplicationScheduler, D as ResolvedReplicationOptions, E as canonicalReplicationIdentity, F as kvPrefixCovers, G as replicationIdentityKey, H as requiresSecretsOptIn } from './scope-D855kRDx.cjs';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, H as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, I as KVAction, J as KVActionType, M as KVBatchPutItem, N as KVBatchPutOptions, O as KVBatchPutResponse, Q as KVBatchReadResponse, S as KVChange, T as KVChangesAuthority, U as KVChangesOptions, V as KVChangesResponse, W as KVCreateSignedReadUrlOptions, X as KVDeleteOptions, Y as KVGetOptions, Z as KVHeadOptions, _ as KVListOptions, b as KVListPage, $ as KVListResponse, a0 as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, a1 as KVResponse, a2 as KVResponseHeaders, a3 as KVServiceConfig, a4 as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, n as PurgeTarget, o as ReplicaAuthorityState, p as ReplicaCoverage, q as ReplicaDevice, r as ReplicaGrantInfo, s as ReplicaState, t as ReplicaStatusEntry, u as ReplicationAuthority, v as ReplicationControl, w as ReplicationEvent, R as ReplicationIdentity, x as ReplicationOptions, y as ReplicationPurgeReport, z as ReplicationReason, B as ReplicationScheduler, D as ResolvedReplicationOptions, E as canonicalReplicationIdentity, F as replicationIdentityKey, G as requiresSecretsOptIn } from './scope-D7wmjbMH.cjs';
 export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.cjs';
 import { IEncryptionService, DecryptCapabilityProof } from './encryption/index.cjs';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, InlineEncryptedEnvelope, Json, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, base64Decode, base64Encode, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalize as canonicalizeEncryptionJson, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, encryptionError, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, hexDecode, hexEncode, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, utf8Decode, utf8Encode, validateEnvelope, verifyDecryptResponse } from './encryption/index.cjs';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
+export { kvPrefixCovers } from './kv/replication/prefix.cjs';
 
 type TinyCloudDebugLevel = "debug";
 interface TinyCloudDebugEvent {
@@ -1141,11 +1142,37 @@ declare function parseStorageQuotaBytes(responseText: string): {
     usedBytes: number;
     limitBytes: number;
 } | undefined;
+/**
+ * Account-wide storage totals the node attaches to a storage rejection when
+ * billing supplied them. `limitBytes` is the plan budget shared by all the
+ * owner's spaces, so this is the number to show the user, not the space's.
+ */
+interface StorageAccountUsage {
+    usedBytes: number;
+    limitBytes: number;
+    /** Plan tier id, e.g. `free` or `paid`. */
+    plan?: string;
+}
+/** What a node storage rejection says about the space and the account. */
+interface StorageRejectionDetails {
+    usedBytes?: number;
+    limitBytes?: number;
+    account?: StorageAccountUsage;
+}
+/**
+ * Parse a node storage rejection. The node sends a JSON body
+ * (`{error, message, space: {usedBytes, limitBytes}, account?: {usedBytes,
+ * limitBytes, plan}}`); older nodes send only the plain-text message. Returns
+ * undefined when the body is neither, e.g. a proxy's own 413 page.
+ */
+declare function parseStorageRejection(responseText: string): StorageRejectionDetails | undefined;
 /**
  * Build the error for a write the node rejected for storage: 402 when storage
  * is already full, 413 when this write is larger than what is left. KV, SQL
  * and DuckDB all report it with the same codes and message so an app can
  * detect "storage full" in one place with {@link isStorageFullError}.
+ * `meta.usedBytes`/`meta.limitBytes` describe the space; `meta.account`
+ * carries the account totals when the node sent them.
  */
 declare function storageRejectionError(service: string, status: 402 | 413, meta: Record<string, unknown>, responseText: string): ServiceError;
 /**
@@ -1651,10 +1678,129 @@ declare class HooksService extends BaseService implements IHooksService {
     private createInvokeHeaders;
 }
 
+/**
+ * The single `storage.full` event: the first write any service saw rejected
+ * because the owner's TinyCloud storage is full. Reads keep working, so an app
+ * shows a read-only banner from this one listener instead of handling the
+ * error at every write site.
+ */
+interface StorageFullEvent {
+    /** Service that saw the rejection, e.g. `kv` or `sql`. */
+    service: string;
+    /** The rejection: `STORAGE_QUOTA_EXCEEDED` or `STORAGE_LIMIT_REACHED`. */
+    error: ServiceError;
+    /** Bytes used by the rejected space, when the node sent them. */
+    usedBytes?: number;
+    /** The space's share of the account budget, when the node sent it. */
+    limitBytes?: number;
+    /** Account-wide totals, when the node had them from billing. */
+    account?: StorageAccountUsage;
+    /**
+     * Space the rejected write targeted, when the service context knew it.
+     * Storage is one budget per owner, so this says whose storage is full.
+     */
+    spaceId?: string;
+}
+type StorageFullHandler = (event: StorageFullEvent) => void;
+/**
+ * Turns the storage rejections seen by any number of service contexts into
+ * one `storage.full` event, and remembers whose storage is full so read paths
+ * can skip their best-effort writes.
+ *
+ * Storage is one budget per owner, so fullness is recorded per owner, apart
+ * from the event: a rejection on one owner's space never hides a later
+ * rejection on another's. The event fires once per episode, which lasts until
+ * no owner is known to be full.
+ *
+ * The event goes through the rejecting context's `emit` (so telemetry and the
+ * debug log see it) and then to the handlers registered with {@link on}.
+ */
+declare class StorageFullMonitor {
+    private readonly ownerOf;
+    /** The emitted event, until the episode ends. */
+    private event;
+    /** First rejection per owner key; {@link UNKNOWN_OWNER} when the space was unknown. */
+    private readonly full;
+    private readonly handlers;
+    /**
+     * @param ownerOf Owner key of a space id. Spaces with one key share one
+     * storage budget. Defaults to the space id itself.
+     */
+    constructor(ownerOf?: (spaceId: string) => string);
+    /** True while any owner's storage is known to be full. */
+    get isFull(): boolean;
+    /** The rejection `storage.full` announced, until the episode ends. */
+    get rejection(): StorageFullEvent | undefined;
+    /**
+     * True when a write to `spaceId`'s owner was rejected, or a write whose
+     * space was unknown was: that one could have been any owner's.
+     */
+    isFullFor(spaceId: string | undefined): boolean;
+    /** Watch a context's service errors. Returns the unsubscribe function. */
+    observe(context: IServiceContext): () => void;
+    /** Subscribe to the `storage.full` event. Returns the unsubscribe function. */
+    on(handler: StorageFullHandler): () => void;
+    /** Forget that any owner's storage is full; the next rejection emits `storage.full` again. */
+    clear(): void;
+    /**
+     * Forget that `spaceId`'s owner is full (`undefined`: the rejections whose
+     * space was unknown). Once no owner is full, the next rejection emits
+     * `storage.full` again.
+     */
+    clearFor(spaceId: string | undefined): void;
+}
+
+/** Where the owner frees up space or upgrades their plan. */
+declare const STORAGE_MANAGE_URL = "https://account.tinycloud.xyz/billing";
+/** Storage counts as nearly full from this share of the limit. */
+declare const STORAGE_NEARLY_FULL_RATIO = 0.9;
+type StorageUsageState = "ok" | "nearly_full" | "full";
+/** Byte counts as the node's usage read reports them; `null` limit means unlimited. */
+interface StorageUsage {
+    usedBytes: number;
+    limitBytes: number | null;
+}
+/**
+ * The owner's TinyCloud storage, as `tc.storage.status()` reports it.
+ * `usedBytes`/`limitBytes` describe the space that was asked about; its limit
+ * is that space's share of the account budget.
+ */
+interface StorageStatus extends StorageUsage {
+    /** Account-wide totals; storage is one budget shared by all the owner's spaces. */
+    account?: StorageUsage & {
+        plan?: string;
+    };
+    /** Plan tier id, e.g. `free` or `paid`, when known. */
+    plan?: string;
+    /** From the account totals when known, else from the space. */
+    state: StorageUsageState;
+    /** Where to free up space or upgrade. */
+    manageUrl: string;
+}
+interface StorageStatusOptions {
+    /** Space name (e.g. `secrets`) or full space id. Defaults to the session's primary space. */
+    space?: string;
+}
+/** `tc.storage.status()`: reads the owner's usage and plan from the node. */
+interface IStorageService {
+    status(options?: StorageStatusOptions): Promise<Result<StorageStatus>>;
+}
+/** `full` at or over the limit, `nearly_full` from 90% of it; never full without a limit. */
+declare function storageUsageState(usedBytes: number, limitBytes: number | null): StorageUsageState;
+/**
+ * Parse the node's usage read (`tinycloud.space/info`):
+ * `{space: {usedBytes, limitBytes}, account?: {usedBytes, limitBytes, plan?}, manageUrl}`.
+ * Returns undefined when the body lacks the space numbers, e.g. a node that
+ * predates the usage read.
+ */
+declare function parseStorageStatus(body: unknown): StorageStatus | undefined;
+
+/** @deprecated Use `tc.on("storage.full", handler)` instead. Nothing in the SDK calls `onUpgradeRequired`. */
 interface QuotaConfig {
     /** Called when a storage quota error is detected (402/413) */
     onUpgradeRequired?: (info: StorageQuotaInfo) => void;
 }
+/** @deprecated Use `StorageStatus` from `tc.storage.status()`. */
 interface QuotaStatus {
     /** Storage limit in bytes for this space */
     limitBytes: number;
@@ -1663,6 +1809,11 @@ interface QuotaStatus {
     /** Remaining storage in bytes */
     remainingBytes?: number;
 }
+/**
+ * @deprecated Use `tc.storage.status()` for usage and `tc.on("storage.full", handler)`
+ * for rejections. This class reads billing's unauthenticated quota endpoint
+ * and is not wired into the SDK; it will be removed in a future major release.
+ */
 declare class TinyCloudQuota {
     private config;
     private quotaUrl;
@@ -2430,4 +2581,4 @@ declare class SecretsService implements ISecretsService {
     listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
-export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };
+export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, type IStorageService, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, type StorageAccountUsage, type StorageFullEvent, type StorageFullHandler, StorageFullMonitor, StorageQuotaInfo, type StorageRejectionDetails, type StorageStatus, type StorageStatusOptions, type StorageUsage, type StorageUsageState, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, parseStorageRejection, parseStorageStatus, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, storageUsageState, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };

package/dist/index.d.ts

@@ -1,15 +1,16 @@
-import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-7A5rHWRY.js';
-export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-7A5rHWRY.js';
+import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-D-9A3Sut.js';
+export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-D-9A3Sut.js';
 import { z } from 'zod';
-import { B as BaseService } from './BaseService-Di_hVfUV.js';
-export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-Di_hVfUV.js';
+import { B as BaseService } from './BaseService-BGr2slUz.js';
+export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-BGr2slUz.js';
 import { IKVService } from './kv/index.js';
 export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.js';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, I as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, J as KVAction, M as KVActionType, N as KVBatchPutItem, O as KVBatchPutOptions, Q as KVBatchPutResponse, S as KVBatchReadResponse, T as KVChange, U as KVChangesAuthority, V as KVChangesOptions, W as KVChangesResponse, X as KVCreateSignedReadUrlOptions, Y as KVDeleteOptions, Z as KVGetOptions, _ as KVHeadOptions, $ as KVListOptions, b as KVListPage, a0 as KVListResponse, a1 as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, a2 as KVResponse, a3 as KVResponseHeaders, a4 as KVServiceConfig, a5 as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, n as PurgeTarget, o as ReplicaAuthorityState, p as ReplicaCoverage, q as ReplicaDevice, r as ReplicaGrantInfo, s as ReplicaState, t as ReplicaStatusEntry, u as ReplicationAuthority, v as ReplicationControl, w as ReplicationEvent, R as ReplicationIdentity, x as ReplicationOptions, y as ReplicationPurgeReport, z as ReplicationReason, B as ReplicationScheduler, D as ResolvedReplicationOptions, E as canonicalReplicationIdentity, F as kvPrefixCovers, G as replicationIdentityKey, H as requiresSecretsOptIn } from './scope-BmLxwyl-.js';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, H as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, I as KVAction, J as KVActionType, M as KVBatchPutItem, N as KVBatchPutOptions, O as KVBatchPutResponse, Q as KVBatchReadResponse, S as KVChange, T as KVChangesAuthority, U as KVChangesOptions, V as KVChangesResponse, W as KVCreateSignedReadUrlOptions, X as KVDeleteOptions, Y as KVGetOptions, Z as KVHeadOptions, _ as KVListOptions, b as KVListPage, $ as KVListResponse, a0 as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, a1 as KVResponse, a2 as KVResponseHeaders, a3 as KVServiceConfig, a4 as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, n as PurgeTarget, o as ReplicaAuthorityState, p as ReplicaCoverage, q as ReplicaDevice, r as ReplicaGrantInfo, s as ReplicaState, t as ReplicaStatusEntry, u as ReplicationAuthority, v as ReplicationControl, w as ReplicationEvent, R as ReplicationIdentity, x as ReplicationOptions, y as ReplicationPurgeReport, z as ReplicationReason, B as ReplicationScheduler, D as ResolvedReplicationOptions, E as canonicalReplicationIdentity, F as replicationIdentityKey, G as requiresSecretsOptIn } from './scope-CoKKmMiI.js';
 export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.js';
 import { IEncryptionService, DecryptCapabilityProof } from './encryption/index.js';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, InlineEncryptedEnvelope, Json, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, base64Decode, base64Encode, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalize as canonicalizeEncryptionJson, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, encryptionError, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, hexDecode, hexEncode, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, utf8Decode, utf8Encode, validateEnvelope, verifyDecryptResponse } from './encryption/index.js';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
+export { kvPrefixCovers } from './kv/replication/prefix.js';
 
 type TinyCloudDebugLevel = "debug";
 interface TinyCloudDebugEvent {
@@ -1141,11 +1142,37 @@ declare function parseStorageQuotaBytes(responseText: string): {
     usedBytes: number;
     limitBytes: number;
 } | undefined;
+/**
+ * Account-wide storage totals the node attaches to a storage rejection when
+ * billing supplied them. `limitBytes` is the plan budget shared by all the
+ * owner's spaces, so this is the number to show the user, not the space's.
+ */
+interface StorageAccountUsage {
+    usedBytes: number;
+    limitBytes: number;
+    /** Plan tier id, e.g. `free` or `paid`. */
+    plan?: string;
+}
+/** What a node storage rejection says about the space and the account. */
+interface StorageRejectionDetails {
+    usedBytes?: number;
+    limitBytes?: number;
+    account?: StorageAccountUsage;
+}
+/**
+ * Parse a node storage rejection. The node sends a JSON body
+ * (`{error, message, space: {usedBytes, limitBytes}, account?: {usedBytes,
+ * limitBytes, plan}}`); older nodes send only the plain-text message. Returns
+ * undefined when the body is neither, e.g. a proxy's own 413 page.
+ */
+declare function parseStorageRejection(responseText: string): StorageRejectionDetails | undefined;
 /**
  * Build the error for a write the node rejected for storage: 402 when storage
  * is already full, 413 when this write is larger than what is left. KV, SQL
  * and DuckDB all report it with the same codes and message so an app can
  * detect "storage full" in one place with {@link isStorageFullError}.
+ * `meta.usedBytes`/`meta.limitBytes` describe the space; `meta.account`
+ * carries the account totals when the node sent them.
  */
 declare function storageRejectionError(service: string, status: 402 | 413, meta: Record<string, unknown>, responseText: string): ServiceError;
 /**
@@ -1651,10 +1678,129 @@ declare class HooksService extends BaseService implements IHooksService {
     private createInvokeHeaders;
 }
 
+/**
+ * The single `storage.full` event: the first write any service saw rejected
+ * because the owner's TinyCloud storage is full. Reads keep working, so an app
+ * shows a read-only banner from this one listener instead of handling the
+ * error at every write site.
+ */
+interface StorageFullEvent {
+    /** Service that saw the rejection, e.g. `kv` or `sql`. */
+    service: string;
+    /** The rejection: `STORAGE_QUOTA_EXCEEDED` or `STORAGE_LIMIT_REACHED`. */
+    error: ServiceError;
+    /** Bytes used by the rejected space, when the node sent them. */
+    usedBytes?: number;
+    /** The space's share of the account budget, when the node sent it. */
+    limitBytes?: number;
+    /** Account-wide totals, when the node had them from billing. */
+    account?: StorageAccountUsage;
+    /**
+     * Space the rejected write targeted, when the service context knew it.
+     * Storage is one budget per owner, so this says whose storage is full.
+     */
+    spaceId?: string;
+}
+type StorageFullHandler = (event: StorageFullEvent) => void;
+/**
+ * Turns the storage rejections seen by any number of service contexts into
+ * one `storage.full` event, and remembers whose storage is full so read paths
+ * can skip their best-effort writes.
+ *
+ * Storage is one budget per owner, so fullness is recorded per owner, apart
+ * from the event: a rejection on one owner's space never hides a later
+ * rejection on another's. The event fires once per episode, which lasts until
+ * no owner is known to be full.
+ *
+ * The event goes through the rejecting context's `emit` (so telemetry and the
+ * debug log see it) and then to the handlers registered with {@link on}.
+ */
+declare class StorageFullMonitor {
+    private readonly ownerOf;
+    /** The emitted event, until the episode ends. */
+    private event;
+    /** First rejection per owner key; {@link UNKNOWN_OWNER} when the space was unknown. */
+    private readonly full;
+    private readonly handlers;
+    /**
+     * @param ownerOf Owner key of a space id. Spaces with one key share one
+     * storage budget. Defaults to the space id itself.
+     */
+    constructor(ownerOf?: (spaceId: string) => string);
+    /** True while any owner's storage is known to be full. */
+    get isFull(): boolean;
+    /** The rejection `storage.full` announced, until the episode ends. */
+    get rejection(): StorageFullEvent | undefined;
+    /**
+     * True when a write to `spaceId`'s owner was rejected, or a write whose
+     * space was unknown was: that one could have been any owner's.
+     */
+    isFullFor(spaceId: string | undefined): boolean;
+    /** Watch a context's service errors. Returns the unsubscribe function. */
+    observe(context: IServiceContext): () => void;
+    /** Subscribe to the `storage.full` event. Returns the unsubscribe function. */
+    on(handler: StorageFullHandler): () => void;
+    /** Forget that any owner's storage is full; the next rejection emits `storage.full` again. */
+    clear(): void;
+    /**
+     * Forget that `spaceId`'s owner is full (`undefined`: the rejections whose
+     * space was unknown). Once no owner is full, the next rejection emits
+     * `storage.full` again.
+     */
+    clearFor(spaceId: string | undefined): void;
+}
+
+/** Where the owner frees up space or upgrades their plan. */
+declare const STORAGE_MANAGE_URL = "https://account.tinycloud.xyz/billing";
+/** Storage counts as nearly full from this share of the limit. */
+declare const STORAGE_NEARLY_FULL_RATIO = 0.9;
+type StorageUsageState = "ok" | "nearly_full" | "full";
+/** Byte counts as the node's usage read reports them; `null` limit means unlimited. */
+interface StorageUsage {
+    usedBytes: number;
+    limitBytes: number | null;
+}
+/**
+ * The owner's TinyCloud storage, as `tc.storage.status()` reports it.
+ * `usedBytes`/`limitBytes` describe the space that was asked about; its limit
+ * is that space's share of the account budget.
+ */
+interface StorageStatus extends StorageUsage {
+    /** Account-wide totals; storage is one budget shared by all the owner's spaces. */
+    account?: StorageUsage & {
+        plan?: string;
+    };
+    /** Plan tier id, e.g. `free` or `paid`, when known. */
+    plan?: string;
+    /** From the account totals when known, else from the space. */
+    state: StorageUsageState;
+    /** Where to free up space or upgrade. */
+    manageUrl: string;
+}
+interface StorageStatusOptions {
+    /** Space name (e.g. `secrets`) or full space id. Defaults to the session's primary space. */
+    space?: string;
+}
+/** `tc.storage.status()`: reads the owner's usage and plan from the node. */
+interface IStorageService {
+    status(options?: StorageStatusOptions): Promise<Result<StorageStatus>>;
+}
+/** `full` at or over the limit, `nearly_full` from 90% of it; never full without a limit. */
+declare function storageUsageState(usedBytes: number, limitBytes: number | null): StorageUsageState;
+/**
+ * Parse the node's usage read (`tinycloud.space/info`):
+ * `{space: {usedBytes, limitBytes}, account?: {usedBytes, limitBytes, plan?}, manageUrl}`.
+ * Returns undefined when the body lacks the space numbers, e.g. a node that
+ * predates the usage read.
+ */
+declare function parseStorageStatus(body: unknown): StorageStatus | undefined;
+
+/** @deprecated Use `tc.on("storage.full", handler)` instead. Nothing in the SDK calls `onUpgradeRequired`. */
 interface QuotaConfig {
     /** Called when a storage quota error is detected (402/413) */
     onUpgradeRequired?: (info: StorageQuotaInfo) => void;
 }
+/** @deprecated Use `StorageStatus` from `tc.storage.status()`. */
 interface QuotaStatus {
     /** Storage limit in bytes for this space */
     limitBytes: number;
@@ -1663,6 +1809,11 @@ interface QuotaStatus {
     /** Remaining storage in bytes */
     remainingBytes?: number;
 }
+/**
+ * @deprecated Use `tc.storage.status()` for usage and `tc.on("storage.full", handler)`
+ * for rejections. This class reads billing's unauthenticated quota endpoint
+ * and is not wired into the SDK; it will be removed in a future major release.
+ */
 declare class TinyCloudQuota {
     private config;
     private quotaUrl;
@@ -2430,4 +2581,4 @@ declare class SecretsService implements ISecretsService {
     listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
-export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, StorageQuotaInfo, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };
+export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, type IStorageService, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, type StorageAccountUsage, type StorageFullEvent, type StorageFullHandler, StorageFullMonitor, StorageQuotaInfo, type StorageRejectionDetails, type StorageStatus, type StorageStatusOptions, type StorageUsage, type StorageUsageState, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, parseStorageRejection, parseStorageStatus, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, storageUsageState, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };