@tinycloud/sdk-services 3.3.0-beta.7 → 3.3.0

package/dist/index.d.cts

@@ -1,11 +1,11 @@
-import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-BjH0ZtGy.cjs';
-export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-BjH0ZtGy.cjs';
+import { a as IServiceContext, g as InvokeFunction, h as InvokeAnyFunction, f as FetchFunction, S as ServiceSession, i as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, F as FetchRequestInit, d as FetchResponse, b as ServiceError, R as Result, P as PermissionHint, j as StorageQuotaInfo } from './types-eVS1Whuf.cjs';
+export { k as ErrorCode, l as ErrorCodes, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, e as RetryStats, p as ServiceErrorEvent, c as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-eVS1Whuf.cjs';
 import { z } from 'zod';
-import { B as BaseService } from './BaseService-Cc6Ueicm.cjs';
-export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-Cc6Ueicm.cjs';
+import { B as BaseService } from './BaseService-BhfKzKke.cjs';
+export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-BhfKzKke.cjs';
 import { IKVService } from './kv/index.cjs';
 export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.cjs';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, aq as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, ar as KVAction, as as KVActionType, at as KVBatchPutItem, au as KVBatchPutOptions, av as KVBatchPutResponse, aw as KVBatchReadResponse, ax as KVChange, ay as KVChangesAuthority, az as KVChangesOptions, aA as KVChangesResponse, aB as KVCreateSignedReadUrlOptions, aC as KVDeleteOptions, aD as KVGetOptions, aE as KVHeadOptions, aF as KVListOptions, b as KVListPage, aG as KVListResponse, aH as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aI as KVResponse, aJ as KVResponseHeaders, aK as KVServiceConfig, aL as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaPageAdmission, a3 as ReplicaPartitionEraser, a4 as ReplicaPartitionIndexEntry, a5 as ReplicaPeerCommit, a6 as ReplicaPrivateGateHash, a7 as ReplicaPurgeIntent, a8 as ReplicaQuotaLedger, a9 as ReplicaQuotaSpec, aa as ReplicaSessionStamp, ab as ReplicaStampedReply, ac as ReplicaState, ad as ReplicaStatusEntry, ae as ReplicationAuthority, af as ReplicationControl, ag as ReplicationEvent, R as ReplicationIdentity, ah as ReplicationOptions, ai as ReplicationPurgeReport, aj as ReplicationReason, ak as ReplicationScheduler, al as ResolvedReplicationOptions, am as SaltedHash, an as canonicalReplicationIdentity, ao as replicationIdentityKey, ap as requiresSecretsOptIn } from './scope-B7oeKdLM.cjs';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, aq as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, ar as KVAction, as as KVActionType, at as KVBatchPutItem, au as KVBatchPutOptions, av as KVBatchPutResponse, aw as KVBatchReadResponse, ax as KVChange, ay as KVChangesAuthority, az as KVChangesOptions, aA as KVChangesResponse, aB as KVCreateSignedReadUrlOptions, aC as KVDeleteOptions, aD as KVGetOptions, aE as KVHeadOptions, aF as KVListOptions, b as KVListPage, aG as KVListResponse, aH as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aI as KVResponse, aJ as KVResponseHeaders, aK as KVServiceConfig, aL as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaPageAdmission, a3 as ReplicaPartitionEraser, a4 as ReplicaPartitionIndexEntry, a5 as ReplicaPeerCommit, a6 as ReplicaPrivateGateHash, a7 as ReplicaPurgeIntent, a8 as ReplicaQuotaLedger, a9 as ReplicaQuotaSpec, aa as ReplicaSessionStamp, ab as ReplicaStampedReply, ac as ReplicaState, ad as ReplicaStatusEntry, ae as ReplicationAuthority, af as ReplicationControl, ag as ReplicationEvent, R as ReplicationIdentity, ah as ReplicationOptions, ai as ReplicationPurgeReport, aj as ReplicationReason, ak as ReplicationScheduler, al as ResolvedReplicationOptions, am as SaltedHash, an as canonicalReplicationIdentity, ao as replicationIdentityKey, ap as requiresSecretsOptIn } from './scope-DMhalRFn.cjs';
 export { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.cjs';
 export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.cjs';
 import { IEncryptionService, DecryptCapabilityProof } from './encryption/index.cjs';
@@ -717,18 +717,22 @@ declare const RetryPolicySchema: z.ZodObject<{
     maxDelayMs: z.ZodNumber;
     /** Error codes that should trigger a retry */
     retryableErrors: z.ZodArray<z.ZodString, "many">;
+    /** Total time budget for all attempts and waits, in milliseconds */
+    maxTotalMs: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     maxAttempts: number;
     backoff: "none" | "linear" | "exponential";
     baseDelayMs: number;
     maxDelayMs: number;
     retryableErrors: string[];
+    maxTotalMs?: number | undefined;
 }, {
     maxAttempts: number;
     backoff: "none" | "linear" | "exponential";
     baseDelayMs: number;
     maxDelayMs: number;
     retryableErrors: string[];
+    maxTotalMs?: number | undefined;
 }>;
 type RetryPolicyType = z.infer<typeof RetryPolicySchema>;
 /**
@@ -1037,6 +1041,8 @@ declare class ServiceContext implements IServiceContext {
     private wrapInvoke;
     private assertActive;
     private wrapInvokeAny;
+    /** Retry `NODE_BUSY` / `REQUEST_TIMEOUT`; `build` must re-sign per attempt (the node 409s a repeated invocation). */
+    invokeWithRetry(url: string, build: () => FetchRequestInit | Promise<FetchRequestInit>): Promise<FetchResponse>;
     private wrapFetch;
     private combineSignals;
 }
@@ -1060,8 +1066,8 @@ declare function networkError(service: string, message: string, cause?: Error):
 /**
  * Classify a node retry signal (tinycloud-node #347, TC-1054). The node's
  * bodies are plain text led by a stable token:
- * - `503 sql_busy: <stage>: ...` and `503 unavailable_retryable: ...` are
- *   `NODE_BUSY`: nothing was applied; retry after `meta.retryAfterMs`.
+ * - `503 sql_busy: <stage>: ...` and `503 unavailable_retryable: ...` (and
+ *   `read_audit_busy`) are `NODE_BUSY`: nothing was applied; retry after `meta.retryAfterMs`.
  * - `503 request_timeout: ...` is `REQUEST_TIMEOUT`: the deadline passed before
  *   any write began, so nothing was applied.
  * - `500 outcome_unknown: ...` is `OUTCOME_UNKNOWN`: a write may have been
@@ -1069,7 +1075,8 @@ declare function networkError(service: string, message: string, cause?: Error):
  *
  * `meta.retryable` is the safe-to-retry verdict and `meta.retryAfterMs` the
  * node's `Retry-After` (the node sends whole seconds; anything else is
- * ignored). The SDK never retries on its own. Returns `undefined` for any
+ * ignored). `invokeWithRetry` retries `NODE_BUSY` and `REQUEST_TIMEOUT`;
+ * `OUTCOME_UNKNOWN` is never retried. Returns `undefined` for any
  * other response, including the bodyless 503/500 of nodes before 1.21, which
  * callers keep classifying as they always did.
  */
@@ -1777,7 +1784,7 @@ declare class StorageFullMonitor {
 }
 
 /** Where the owner frees up space or upgrades their plan. */
-declare const STORAGE_MANAGE_URL = "https://account.tinycloud.xyz/billing";
+declare const STORAGE_MANAGE_URL = "https://account.tinycloud.xyz/storage";
 /** Storage counts as nearly full from this share of the limit. */
 declare const STORAGE_NEARLY_FULL_RATIO = 0.9;
 type StorageUsageState = "ok" | "nearly_full" | "full";
@@ -1894,6 +1901,19 @@ interface VaultPutOptions {
      * fails with `ALREADY_EXISTS`; it is never overwritten.
      */
     ifNoneMatch?: "*";
+    /**
+     * Compare-and-swap: write only when the stored envelope still has this
+     * strong ETag, passed exactly as {@link VaultEntry.etag} returned it
+     * (including the quotes). Network-encrypted vaults only; cannot be combined
+     * with `ifNoneMatch`.
+     *
+     * Failures are distinct codes: `ETAG_MISMATCH` (the value changed or was
+     * deleted: re-read, re-apply, retry), `INVALID_ETAG` (malformed; never
+     * retry), `OUTCOME_UNKNOWN` (the node may have applied the write, or a gateway
+     * answered for it: read it back before retrying, with a freshly signed request) and `NODE_BUSY`
+     * (nothing was written; retry).
+     */
+    ifMatch?: string;
 }
 /**
  * Options for vault get operations.
@@ -1903,8 +1923,25 @@ interface VaultGetOptions<T = unknown> {
     deserialize?: (data: Uint8Array) => T;
     /** Return raw decrypted bytes without deserialization */
     raw?: boolean;
-    /** Force the underlying KV read to bypass replica read-through. */
+    /**
+     * Force the underlying KV read to bypass replica read-through. Required for
+     * a usable {@link VaultEntry.etag}: only network reads return one, because
+     * a replica can serve a stale etag.
+     */
     source?: "network";
+    /**
+     * Opt-in (default off): refuse an envelope whose AAD is not bound to this
+     * vault's space and this key (`tinycloud.vault:<spaceId>:<key>`). The space
+     * id is compared after normalizing the spelling of its EVM addresses
+     * (checksummed and lowercase are the same space). An envelope with no AAD,
+     * or with a different one, fails with `AAD_MISMATCH` (`aad_mismatch` from
+     * `readNetworkEncrypted`) instead of decrypting. This stops a ciphertext
+     * copied to another key from being accepted; it does not stop a freshly
+     * encrypted forgery. A malformed stored value is a corrupt envelope, as without this
+     * option. Network-encrypted vaults only: a master-key vault and `getShared` refuse it with
+     * `STORAGE_ERROR` rather than skip the check.
+     */
+    expectAad?: boolean;
     /** Delegated KV service for reading from the grantor's space (used by getShared) */
     kv?: {
         get<V>(key: string, options?: {
@@ -1959,6 +1996,12 @@ interface VaultEntry<T> {
     metadata: Record<string, string>;
     /** Key ID used for encryption */
     keyId: string;
+    /**
+     * Strong ETag of the stored envelope, for {@link VaultPutOptions.ifMatch}.
+     * Present only for network-encrypted reads made with `source: "network"`
+     * (always for `readNetworkEncrypted`); never taken from a replica.
+     */
+    etag?: string;
 }
 /**
  * Safe classification for a network-encrypted vault read.
@@ -1985,6 +2028,10 @@ type VaultNetworkReadResult<T> = {
     status: "decrypt_failed";
 } | {
     status: "invalid_payload";
+}
+/** Only with `expectAad`: the envelope is not bound to this space and key. */
+ | {
+    status: "aad_mismatch";
 };
 /**
  * Structured error codes for vault operations.
@@ -2042,6 +2089,43 @@ type VaultErrorInput = {
     meta?: Record<string, unknown>;
     /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
     cause: ServiceError & Error;
+} | {
+    /** `expectAad` read: the envelope's AAD is missing or bound to another space/key. */
+    code: "AAD_MISMATCH";
+    key: string;
+    message: string;
+} | {
+    /** `ifMatch` write refused (HTTP 412): the value changed or no longer exists. Re-read and retry. */
+    code: "ETAG_MISMATCH";
+    key: string;
+    message: string;
+    meta?: Record<string, unknown>;
+    cause: ServiceError & Error;
+} | {
+    /** `ifMatch` is not a strong ETag (HTTP 400, or rejected before sending). Never retry. */
+    code: "INVALID_ETAG";
+    key: string;
+    message: string;
+    meta?: Record<string, unknown>;
+    cause?: ServiceError & Error;
+} | {
+    /**
+     * `ifMatch` write that may have been applied: the node's `outcome_unknown` (500), a gateway
+     * answer that can follow a commit (500, 502, 503 without the node's busy body, 504, 520,
+     * 522, 524) or a connection that failed after the request was sent. Re-read before retrying.
+     */
+    code: "OUTCOME_UNKNOWN";
+    key: string;
+    message: string;
+    meta?: Record<string, unknown>;
+    cause: ServiceError & Error;
+} | {
+    /** `ifMatch` write, the node's own busy/timeout answer (503 with its busy body): nothing was written. Safe to retry. */
+    code: "NODE_BUSY";
+    key: string;
+    message: string;
+    meta?: Record<string, unknown>;
+    cause: ServiceError & Error;
 } | {
     code: "STORAGE_QUOTA_EXCEEDED" | "STORAGE_LIMIT_REACHED";
     message: string;
@@ -2607,4 +2691,4 @@ declare class SecretsService implements ISecretsService {
     listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
-export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, type IStorageService, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, type StorageAccountUsage, type StorageFullEvent, type StorageFullHandler, StorageFullMonitor, StorageQuotaInfo, type StorageRejectionDetails, type StorageStatus, type StorageStatusOptions, type StorageUsage, type StorageUsageState, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, nodeRetryError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, parseStorageRejection, parseStorageStatus, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, storageUsageState, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };
+export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, FetchRequestInit, FetchResponse, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, type IStorageService, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, type StorageAccountUsage, type StorageFullEvent, type StorageFullHandler, StorageFullMonitor, StorageQuotaInfo, type StorageRejectionDetails, type StorageStatus, type StorageStatusOptions, type StorageUsage, type StorageUsageState, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, nodeRetryError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, parseStorageRejection, parseStorageStatus, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, storageUsageState, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { a as IServiceContext, c as InvokeFunction, d as InvokeAnyFunction, F as FetchFunction, S as ServiceSession, e as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, b as ServiceError, R as Result, P as PermissionHint, f as StorageQuotaInfo } from './types-BjH0ZtGy.js';
-export { g as ErrorCode, h as ErrorCodes, i as FetchRequestInit, j as FetchResponse, k as InvocationFact, l as InvocationFacts, m as InvokeAnyEntry, n as ServiceErrorEvent, o as ServiceHeaders, p as ServiceRequestEvent, q as ServiceResponseEvent, r as ServiceRetryEvent, s as TelemetryEventHandler, t as TelemetryEvents, u as TelemetrySpanEvent, v as defaultRetryPolicy, w as err, x as ok, y as serviceError } from './types-BjH0ZtGy.js';
+import { a as IServiceContext, g as InvokeFunction, h as InvokeAnyFunction, f as FetchFunction, S as ServiceSession, i as RetryPolicy, T as TelemetryConfig, I as IService, E as EventHandler, F as FetchRequestInit, d as FetchResponse, b as ServiceError, R as Result, P as PermissionHint, j as StorageQuotaInfo } from './types-eVS1Whuf.js';
+export { k as ErrorCode, l as ErrorCodes, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, e as RetryStats, p as ServiceErrorEvent, c as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-eVS1Whuf.js';
 import { z } from 'zod';
-import { B as BaseService } from './BaseService-DOdXd7sr.js';
-export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-DOdXd7sr.js';
+import { B as BaseService } from './BaseService-x4AFZiEa.js';
+export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-x4AFZiEa.js';
 import { IKVService } from './kv/index.js';
 export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.js';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, aq as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, ar as KVAction, as as KVActionType, at as KVBatchPutItem, au as KVBatchPutOptions, av as KVBatchPutResponse, aw as KVBatchReadResponse, ax as KVChange, ay as KVChangesAuthority, az as KVChangesOptions, aA as KVChangesResponse, aB as KVCreateSignedReadUrlOptions, aC as KVDeleteOptions, aD as KVGetOptions, aE as KVHeadOptions, aF as KVListOptions, b as KVListPage, aG as KVListResponse, aH as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aI as KVResponse, aJ as KVResponseHeaders, aK as KVServiceConfig, aL as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaPageAdmission, a3 as ReplicaPartitionEraser, a4 as ReplicaPartitionIndexEntry, a5 as ReplicaPeerCommit, a6 as ReplicaPrivateGateHash, a7 as ReplicaPurgeIntent, a8 as ReplicaQuotaLedger, a9 as ReplicaQuotaSpec, aa as ReplicaSessionStamp, ab as ReplicaStampedReply, ac as ReplicaState, ad as ReplicaStatusEntry, ae as ReplicationAuthority, af as ReplicationControl, ag as ReplicationEvent, R as ReplicationIdentity, ah as ReplicationOptions, ai as ReplicationPurgeReport, aj as ReplicationReason, ak as ReplicationScheduler, al as ResolvedReplicationOptions, am as SaltedHash, an as canonicalReplicationIdentity, ao as replicationIdentityKey, ap as requiresSecretsOptIn } from './scope-B-m6cKH-.js';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, aq as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, ar as KVAction, as as KVActionType, at as KVBatchPutItem, au as KVBatchPutOptions, av as KVBatchPutResponse, aw as KVBatchReadResponse, ax as KVChange, ay as KVChangesAuthority, az as KVChangesOptions, aA as KVChangesResponse, aB as KVCreateSignedReadUrlOptions, aC as KVDeleteOptions, aD as KVGetOptions, aE as KVHeadOptions, aF as KVListOptions, b as KVListPage, aG as KVListResponse, aH as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aI as KVResponse, aJ as KVResponseHeaders, aK as KVServiceConfig, aL as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaPageAdmission, a3 as ReplicaPartitionEraser, a4 as ReplicaPartitionIndexEntry, a5 as ReplicaPeerCommit, a6 as ReplicaPrivateGateHash, a7 as ReplicaPurgeIntent, a8 as ReplicaQuotaLedger, a9 as ReplicaQuotaSpec, aa as ReplicaSessionStamp, ab as ReplicaStampedReply, ac as ReplicaState, ad as ReplicaStatusEntry, ae as ReplicationAuthority, af as ReplicationControl, ag as ReplicationEvent, R as ReplicationIdentity, ah as ReplicationOptions, ai as ReplicationPurgeReport, aj as ReplicationReason, ak as ReplicationScheduler, al as ResolvedReplicationOptions, am as SaltedHash, an as canonicalReplicationIdentity, ao as replicationIdentityKey, ap as requiresSecretsOptIn } from './scope-BHTkk5Yk.js';
 export { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.js';
 export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.js';
 import { IEncryptionService, DecryptCapabilityProof } from './encryption/index.js';
@@ -717,18 +717,22 @@ declare const RetryPolicySchema: z.ZodObject<{
     maxDelayMs: z.ZodNumber;
     /** Error codes that should trigger a retry */
     retryableErrors: z.ZodArray<z.ZodString, "many">;
+    /** Total time budget for all attempts and waits, in milliseconds */
+    maxTotalMs: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     maxAttempts: number;
     backoff: "none" | "linear" | "exponential";
     baseDelayMs: number;
     maxDelayMs: number;
     retryableErrors: string[];
+    maxTotalMs?: number | undefined;
 }, {
     maxAttempts: number;
     backoff: "none" | "linear" | "exponential";
     baseDelayMs: number;
     maxDelayMs: number;
     retryableErrors: string[];
+    maxTotalMs?: number | undefined;
 }>;
 type RetryPolicyType = z.infer<typeof RetryPolicySchema>;
 /**
@@ -1037,6 +1041,8 @@ declare class ServiceContext implements IServiceContext {
     private wrapInvoke;
     private assertActive;
     private wrapInvokeAny;
+    /** Retry `NODE_BUSY` / `REQUEST_TIMEOUT`; `build` must re-sign per attempt (the node 409s a repeated invocation). */
+    invokeWithRetry(url: string, build: () => FetchRequestInit | Promise<FetchRequestInit>): Promise<FetchResponse>;
     private wrapFetch;
     private combineSignals;
 }
@@ -1060,8 +1066,8 @@ declare function networkError(service: string, message: string, cause?: Error):
 /**
  * Classify a node retry signal (tinycloud-node #347, TC-1054). The node's
  * bodies are plain text led by a stable token:
- * - `503 sql_busy: <stage>: ...` and `503 unavailable_retryable: ...` are
- *   `NODE_BUSY`: nothing was applied; retry after `meta.retryAfterMs`.
+ * - `503 sql_busy: <stage>: ...` and `503 unavailable_retryable: ...` (and
+ *   `read_audit_busy`) are `NODE_BUSY`: nothing was applied; retry after `meta.retryAfterMs`.
  * - `503 request_timeout: ...` is `REQUEST_TIMEOUT`: the deadline passed before
  *   any write began, so nothing was applied.
  * - `500 outcome_unknown: ...` is `OUTCOME_UNKNOWN`: a write may have been
@@ -1069,7 +1075,8 @@ declare function networkError(service: string, message: string, cause?: Error):
  *
  * `meta.retryable` is the safe-to-retry verdict and `meta.retryAfterMs` the
  * node's `Retry-After` (the node sends whole seconds; anything else is
- * ignored). The SDK never retries on its own. Returns `undefined` for any
+ * ignored). `invokeWithRetry` retries `NODE_BUSY` and `REQUEST_TIMEOUT`;
+ * `OUTCOME_UNKNOWN` is never retried. Returns `undefined` for any
  * other response, including the bodyless 503/500 of nodes before 1.21, which
  * callers keep classifying as they always did.
  */
@@ -1777,7 +1784,7 @@ declare class StorageFullMonitor {
 }
 
 /** Where the owner frees up space or upgrades their plan. */
-declare const STORAGE_MANAGE_URL = "https://account.tinycloud.xyz/billing";
+declare const STORAGE_MANAGE_URL = "https://account.tinycloud.xyz/storage";
 /** Storage counts as nearly full from this share of the limit. */
 declare const STORAGE_NEARLY_FULL_RATIO = 0.9;
 type StorageUsageState = "ok" | "nearly_full" | "full";
@@ -1894,6 +1901,19 @@ interface VaultPutOptions {
      * fails with `ALREADY_EXISTS`; it is never overwritten.
      */
     ifNoneMatch?: "*";
+    /**
+     * Compare-and-swap: write only when the stored envelope still has this
+     * strong ETag, passed exactly as {@link VaultEntry.etag} returned it
+     * (including the quotes). Network-encrypted vaults only; cannot be combined
+     * with `ifNoneMatch`.
+     *
+     * Failures are distinct codes: `ETAG_MISMATCH` (the value changed or was
+     * deleted: re-read, re-apply, retry), `INVALID_ETAG` (malformed; never
+     * retry), `OUTCOME_UNKNOWN` (the node may have applied the write, or a gateway
+     * answered for it: read it back before retrying, with a freshly signed request) and `NODE_BUSY`
+     * (nothing was written; retry).
+     */
+    ifMatch?: string;
 }
 /**
  * Options for vault get operations.
@@ -1903,8 +1923,25 @@ interface VaultGetOptions<T = unknown> {
     deserialize?: (data: Uint8Array) => T;
     /** Return raw decrypted bytes without deserialization */
     raw?: boolean;
-    /** Force the underlying KV read to bypass replica read-through. */
+    /**
+     * Force the underlying KV read to bypass replica read-through. Required for
+     * a usable {@link VaultEntry.etag}: only network reads return one, because
+     * a replica can serve a stale etag.
+     */
     source?: "network";
+    /**
+     * Opt-in (default off): refuse an envelope whose AAD is not bound to this
+     * vault's space and this key (`tinycloud.vault:<spaceId>:<key>`). The space
+     * id is compared after normalizing the spelling of its EVM addresses
+     * (checksummed and lowercase are the same space). An envelope with no AAD,
+     * or with a different one, fails with `AAD_MISMATCH` (`aad_mismatch` from
+     * `readNetworkEncrypted`) instead of decrypting. This stops a ciphertext
+     * copied to another key from being accepted; it does not stop a freshly
+     * encrypted forgery. A malformed stored value is a corrupt envelope, as without this
+     * option. Network-encrypted vaults only: a master-key vault and `getShared` refuse it with
+     * `STORAGE_ERROR` rather than skip the check.
+     */
+    expectAad?: boolean;
     /** Delegated KV service for reading from the grantor's space (used by getShared) */
     kv?: {
         get<V>(key: string, options?: {
@@ -1959,6 +1996,12 @@ interface VaultEntry<T> {
     metadata: Record<string, string>;
     /** Key ID used for encryption */
     keyId: string;
+    /**
+     * Strong ETag of the stored envelope, for {@link VaultPutOptions.ifMatch}.
+     * Present only for network-encrypted reads made with `source: "network"`
+     * (always for `readNetworkEncrypted`); never taken from a replica.
+     */
+    etag?: string;
 }
 /**
  * Safe classification for a network-encrypted vault read.
@@ -1985,6 +2028,10 @@ type VaultNetworkReadResult<T> = {
     status: "decrypt_failed";
 } | {
     status: "invalid_payload";
+}
+/** Only with `expectAad`: the envelope is not bound to this space and key. */
+ | {
+    status: "aad_mismatch";
 };
 /**
  * Structured error codes for vault operations.
@@ -2042,6 +2089,43 @@ type VaultErrorInput = {
     meta?: Record<string, unknown>;
     /** The typed KV error that refused the write (an `Error` carrying its `code`, `service` and `meta`). */
     cause: ServiceError & Error;
+} | {
+    /** `expectAad` read: the envelope's AAD is missing or bound to another space/key. */
+    code: "AAD_MISMATCH";
+    key: string;
+    message: string;
+} | {
+    /** `ifMatch` write refused (HTTP 412): the value changed or no longer exists. Re-read and retry. */
+    code: "ETAG_MISMATCH";
+    key: string;
+    message: string;
+    meta?: Record<string, unknown>;
+    cause: ServiceError & Error;
+} | {
+    /** `ifMatch` is not a strong ETag (HTTP 400, or rejected before sending). Never retry. */
+    code: "INVALID_ETAG";
+    key: string;
+    message: string;
+    meta?: Record<string, unknown>;
+    cause?: ServiceError & Error;
+} | {
+    /**
+     * `ifMatch` write that may have been applied: the node's `outcome_unknown` (500), a gateway
+     * answer that can follow a commit (500, 502, 503 without the node's busy body, 504, 520,
+     * 522, 524) or a connection that failed after the request was sent. Re-read before retrying.
+     */
+    code: "OUTCOME_UNKNOWN";
+    key: string;
+    message: string;
+    meta?: Record<string, unknown>;
+    cause: ServiceError & Error;
+} | {
+    /** `ifMatch` write, the node's own busy/timeout answer (503 with its busy body): nothing was written. Safe to retry. */
+    code: "NODE_BUSY";
+    key: string;
+    message: string;
+    meta?: Record<string, unknown>;
+    cause: ServiceError & Error;
 } | {
     code: "STORAGE_QUOTA_EXCEEDED" | "STORAGE_LIMIT_REACHED";
     message: string;
@@ -2607,4 +2691,4 @@ declare class SecretsService implements ISecretsService {
     listAll(): Promise<Result<SecretCatalogEntry[], SecretsError>>;
 }
 
-export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, type IStorageService, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, type StorageAccountUsage, type StorageFullEvent, type StorageFullHandler, StorageFullMonitor, StorageQuotaInfo, type StorageRejectionDetails, type StorageStatus, type StorageStatusOptions, type StorageUsage, type StorageUsageState, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, nodeRetryError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, parseStorageRejection, parseStorageStatus, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, storageUsageState, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };
+export { type AuthorizationVerdict, BaseService, type ColumnInfo, type DataVaultConfig, DataVaultService, DecryptCapabilityProof, DuckDbAction, type DuckDbActionType, type DuckDbBatchOptions, type BatchResponse as DuckDbBatchResponse, DuckDbDatabaseHandle, type DuckDbExecuteOptions, type ExecuteResponse as DuckDbExecuteResponse, type DuckDbOptions, type DuckDbQueryOptions, type QueryResponse as DuckDbQueryResponse, DuckDbService, type DuckDbServiceConfig, type DuckDbStatement, type DuckDbValue, EventHandler, FetchFunction, FetchRequestInit, FetchResponse, GenericKVResponseSchema, type GenericKVResponseType, GenericResultSchema, type HookEvent, type HookServiceName, type HookStreamEvent, type HookStreamRetryConfig, type HookSubscription, type HookWebhookListOptions, type HookWebhookRecord, type HookWebhookRegistration, type HookWebhookScope, type HookWebhookUnregisterOptions, HooksService, type HooksServiceConfig, type IDataVaultService, type IDuckDbDatabaseHandle, type IDuckDbService, IEncryptionService, type IHooksService, IKVService, type ISecretsService, IService, IServiceContext, type IStorageService, InvokeAnyFunction, InvokeFunction, KVListResponseSchema, type KVListResponseType, KVListResultSchema, type KVListResultType, KVResponseHeadersSchema, type KVResponseHeadersType, MAX_SECRET_SCOPE_LENGTH, type ParsedSecretCatalogKey, PermissionHint, type QuotaConfig, type QuotaStatus, type ResolvedSecretPath, Result, RetryPolicy, RetryPolicySchema, type RetryPolicyType, SECRET_NAME_RE, SECRET_SCOPE_RE, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, type SchemaInfo, type SecretCatalogEntry, type SecretPayload, type SecretPutOptions, type SecretScopeOptions, type SecretsError, SecretsService, ServiceContext, type ServiceContextConfig, ServiceError, ServiceErrorEventSchema, type ServiceErrorEventType, ServiceErrorSchema, type ServiceErrorType, ServiceRequestEventSchema, type ServiceRequestEventType, ServiceResponseEventSchema, type ServiceResponseEventType, ServiceRetryEventSchema, type ServiceRetryEventType, ServiceSession, ServiceSessionSchema, type ServiceSessionType, type StorageAccountUsage, type StorageFullEvent, type StorageFullHandler, StorageFullMonitor, StorageQuotaInfo, type StorageRejectionDetails, type StorageStatus, type StorageStatusOptions, type StorageUsage, type StorageUsageState, type SubscribeOptions, TC832_RESERVED_SCOPES, type TableInfo, TelemetryConfig, TelemetrySpanEventSchema, type TelemetrySpanEventType, type TinyCloudDebugEnableOptions, type TinyCloudDebugEvent, type TinyCloudDebugLevel, TinyCloudDebugLogger, type TinyCloudDebugTimer, TinyCloudQuota, type ValidationError, type VaultCrypto, type VaultEntry, type VaultError, type VaultGetOptions, type VaultGrantOptions, VaultHeaders, type VaultListOptions, type VaultListPage, type VaultNetworkReadResult, VaultPublicSpaceKVActions, type VaultPutOptions, type ViewInfo, type WasmVaultFunctions, abortedError, appSecretScope, authExpiredError, authRequiredError, authUnauthorizedError, authorizationVerdictOf, canonicalizeSecretScope, clearTinyCloudDebugLogs, createKVResponseSchema, createResultSchema, createVaultCrypto, disableTinyCloudDebug, enableTinyCloudDebug, errorResult, getTinyCloudDebugLogs, installTinyCloudDebugGlobals, isStorageFullError, networkError, nodeRetryError, notFoundError, parseAuthError, parseCapabilityResource, parsePermissionHint, parsePermissionHintFromErrorText, parseSecretCatalogKey, parseStorageQuotaBytes, parseStorageRejection, parseStorageStatus, permissionDeniedError, resolveSecretListPrefix, resolveSecretPath, storageLimitReachedError, storageQuotaExceededError, storageRejectionError, storageUsageState, timeoutError, tinyCloudDebugLogger, validateKVListResponse, validateKVResponseHeaders, validateRetryPolicy, validateServiceError, validateServiceRequestEvent, validateServiceResponseEvent, validateServiceSession, validateTelemetrySpanEvent, validatedCapabilityOf, wrapError };