@tinycloud/cli 0.7.0-beta.22 → 0.7.0-beta.23

package/dist/index.js

@@ -1,5 +1,5 @@
-import "./chunk-5CWOI54E.js";
-import "./chunk-43OSAOIQ.js";
+import "./chunk-TWMXCCSD.js";
+import "./chunk-725HE3UG.js";
 import {
   __commonJS,
   __esm,
@@ -5988,9 +5988,9 @@ var require_node_exports = __commonJS({
   }
 });
 
-// ../../node_modules/@spruceid/siwe-parser/node_modules/@noble/hashes/_u64.js
+// ../../node_modules/@noble/hashes/_u64.js
 var require_u64 = __commonJS({
-  "../../node_modules/@spruceid/siwe-parser/node_modules/@noble/hashes/_u64.js"(exports) {
+  "../../node_modules/@noble/hashes/_u64.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.toBig = exports.shrSL = exports.shrSH = exports.rotrSL = exports.rotrSH = exports.rotrBL = exports.rotrBH = exports.rotr32L = exports.rotr32H = exports.rotlSL = exports.rotlSH = exports.rotlBL = exports.rotlBH = exports.add5L = exports.add5H = exports.add4L = exports.add4H = exports.add3L = exports.add3H = void 0;
@@ -6084,9 +6084,9 @@ var require_u64 = __commonJS({
   }
 });
 
-// ../../node_modules/@spruceid/siwe-parser/node_modules/@noble/hashes/cryptoNode.js
+// ../../node_modules/@noble/hashes/cryptoNode.js
 var require_cryptoNode = __commonJS({
-  "../../node_modules/@spruceid/siwe-parser/node_modules/@noble/hashes/cryptoNode.js"(exports) {
+  "../../node_modules/@noble/hashes/cryptoNode.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.crypto = void 0;
@@ -6095,9 +6095,9 @@ var require_cryptoNode = __commonJS({
   }
 });
 
-// ../../node_modules/@spruceid/siwe-parser/node_modules/@noble/hashes/utils.js
+// ../../node_modules/@noble/hashes/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/@spruceid/siwe-parser/node_modules/@noble/hashes/utils.js"(exports) {
+  "../../node_modules/@noble/hashes/utils.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.wrapXOFConstructorWithOpts = exports.wrapConstructorWithOpts = exports.wrapConstructor = exports.Hash = exports.nextTick = exports.swap32IfBE = exports.byteSwapIfBE = exports.swap8IfBE = exports.isLE = void 0;
@@ -6337,9 +6337,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/@spruceid/siwe-parser/node_modules/@noble/hashes/sha3.js
+// ../../node_modules/@noble/hashes/sha3.js
 var require_sha3 = __commonJS({
-  "../../node_modules/@spruceid/siwe-parser/node_modules/@noble/hashes/sha3.js"(exports) {
+  "../../node_modules/@noble/hashes/sha3.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.shake256 = exports.shake128 = exports.keccak_512 = exports.keccak_384 = exports.keccak_256 = exports.keccak_224 = exports.sha3_512 = exports.sha3_384 = exports.sha3_256 = exports.sha3_224 = exports.Keccak = void 0;
@@ -32317,81 +32317,6 @@ Open this URL in a browser to authenticate:
   });
 }
 
-// src/commands/init.ts
-function registerInitCommand(program2) {
-  program2.command("init").description("Initialize a new TinyCloud profile").option("--name <profile>", "Profile name", "default").option("--key-only", "Only generate key, skip authentication").option("--host <url>", "TinyCloud node URL").option("--paste", "Use manual paste mode for authentication").option("--no-popup", "Print the OpenKey URL without opening a browser").option("--default-space <name>", "Default space used when --space is omitted (e.g. applications)").action(async (options, cmd) => {
-    try {
-      const globalOpts = cmd.optsWithGlobals();
-      const profileName = options.name;
-      const host = options.host ?? globalOpts.host ?? DEFAULT_HOST;
-      const defaultSpace = options.defaultSpace;
-      if (defaultSpace !== void 0 && !/^[A-Za-z0-9_-]+$/.test(defaultSpace)) {
-        throw new CLIError(
-          "INVALID_SPACE",
-          `Invalid --default-space "${defaultSpace}". Use a short name ([A-Za-z0-9_-]).`,
-          ExitCode.USAGE_ERROR
-        );
-      }
-      if (await ProfileManager.profileExists(profileName)) {
-        throw new CLIError(
-          "PROFILE_EXISTS",
-          `Profile "${profileName}" already exists. Use \`tc profile delete ${profileName}\` first or choose a different name.`,
-          ExitCode.ERROR
-        );
-      }
-      await ProfileManager.ensureConfigDir();
-      const { jwk, did } = await withSpinner("Generating key...", async () => {
-        return generateKey();
-      });
-      await ProfileManager.setKey(profileName, jwk);
-      const profileConfig = {
-        name: profileName,
-        host,
-        chainId: DEFAULT_CHAIN_ID,
-        spaceName: "default",
-        did,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        ...defaultSpace ? { defaultSpace } : {}
-      };
-      await ProfileManager.setProfile(profileName, profileConfig);
-      const config = await ProfileManager.getConfig();
-      if (profileName === "default" || !await ProfileManager.profileExists(config.defaultProfile)) {
-        await ProfileManager.setConfig({ ...config, defaultProfile: profileName });
-      }
-      if (options.keyOnly) {
-        outputJson({
-          profile: profileName,
-          did,
-          host,
-          authenticated: false
-        });
-        return;
-      }
-      const delegationData = await startAuthFlow(did, {
-        paste: options.paste,
-        noPopup: options.popup === false,
-        jwk,
-        host
-      });
-      await ProfileManager.setSession(profileName, delegationData);
-      await ProfileManager.setProfile(profileName, {
-        ...profileConfig,
-        spaceId: delegationData.spaceId,
-        ownerDid: delegationData.ownerDid
-      });
-      outputJson({
-        profile: profileName,
-        did,
-        host,
-        spaceId: delegationData.spaceId,
-        authenticated: true
-      });
-    } catch (error) {
-      handleError(error);
-    }
-  });
-}
-
 // src/commands/auth.ts
 import { get as httpGet } from "http";
 import { get as httpsGet } from "https";
@@ -42923,6 +42848,17 @@ function serviceFromActions(actions) {
 }
 
 // src/lib/sdk.ts
+function jwkHasPrivateParameter(jwk) {
+  if (!jwk || typeof jwk !== "object") return false;
+  const d = jwk.d;
+  return typeof d === "string" && d.length > 0;
+}
+function selectSignerJwk(sessionJwk, key2) {
+  if (jwkHasPrivateParameter(sessionJwk)) {
+    return sessionJwk;
+  }
+  return key2 ?? void 0;
+}
 async function createSDKInstance(ctx, options) {
   const profile = options?.privateKey ? await ProfileManager.getProfile(ctx.profile).catch(() => null) : await ProfileManager.getProfile(ctx.profile);
   const session = await ProfileManager.getSession(ctx.profile);
@@ -42945,7 +42881,7 @@ async function createSDKInstance(ctx, options) {
         delegationHeader: session.delegationHeader,
         delegationCid: session.delegationCid,
         spaceId: session.spaceId,
-        jwk: session.jwk ?? key2,
+        jwk: selectSignerJwk(session.jwk, key2),
         verificationMethod: session.verificationMethod ?? profile?.sessionDid ?? profile?.did,
         address: session.address,
         chainId: session.chainId,
@@ -42969,7 +42905,7 @@ async function createSDKInstance(ctx, options) {
       delegationHeader: session.delegationHeader,
       delegationCid: session.delegationCid,
       spaceId: session.spaceId,
-      jwk: session.jwk ?? key2,
+      jwk: selectSignerJwk(session.jwk, key2),
       verificationMethod: session.verificationMethod ?? profile?.did,
       address: session.address,
       chainId: session.chainId,
@@ -43982,6 +43918,25 @@ async function handleOpenKeyAuth(profileName, host, options = {}) {
     authMethod: "openkey"
   });
 }
+function mergePrivateJwkIntoSession(session, key2) {
+  const sessionJwk = session.jwk;
+  if (!sessionJwk || typeof sessionJwk !== "object") {
+    return session;
+  }
+  const sessionJwkRecord = sessionJwk;
+  const sessionD = sessionJwkRecord.d;
+  if (typeof sessionD === "string" && sessionD.length > 0) {
+    return session;
+  }
+  const keyD = key2.d;
+  if (typeof keyD !== "string" || keyD.length === 0) {
+    return session;
+  }
+  return {
+    ...session,
+    jwk: { ...sessionJwkRecord, d: keyD }
+  };
+}
 async function refreshOpenKeySession(profileName, host, options = {}) {
   const key2 = await ProfileManager.getKey(profileName);
   if (!key2) {
@@ -43999,7 +43954,8 @@ async function refreshOpenKeySession(profileName, host, options = {}) {
     host,
     openkeyHost: resolveOpenKeyHost(profile)
   });
-  await ProfileManager.setSession(profileName, delegationData);
+  const sanitizedSession = mergePrivateJwkIntoSession(delegationData, key2);
+  await ProfileManager.setSession(profileName, sanitizedSession);
   const updatedProfile = {
     ...profile,
     sessionDid: profile.sessionDid ?? profile.did,
@@ -44007,12 +43963,88 @@ async function refreshOpenKeySession(profileName, host, options = {}) {
     operatorType: profile.operatorType ?? "human",
     authMethod: "openkey"
   };
-  if (delegationData.spaceId) {
-    updatedProfile.spaceId = delegationData.spaceId;
-    updatedProfile.ownerDid = delegationData.ownerDid;
+  if (sanitizedSession.spaceId) {
+    updatedProfile.spaceId = sanitizedSession.spaceId;
+    updatedProfile.ownerDid = sanitizedSession.ownerDid;
   }
   await ProfileManager.setProfile(profileName, updatedProfile);
-  return { profile: updatedProfile, delegationData };
+  return { profile: updatedProfile, delegationData: sanitizedSession };
+}
+
+// src/commands/init.ts
+function registerInitCommand(program2) {
+  program2.command("init").description("Initialize a new TinyCloud profile").option("--name <profile>", "Profile name", "default").option("--key-only", "Only generate key, skip authentication").option("--host <url>", "TinyCloud node URL").option("--paste", "Use manual paste mode for authentication").option("--no-popup", "Print the OpenKey URL without opening a browser").option("--default-space <name>", "Default space used when --space is omitted (e.g. applications)").action(async (options, cmd) => {
+    try {
+      const globalOpts = cmd.optsWithGlobals();
+      const profileName = options.name;
+      const host = options.host ?? globalOpts.host ?? DEFAULT_HOST;
+      const defaultSpace = options.defaultSpace;
+      if (defaultSpace !== void 0 && !/^[A-Za-z0-9_-]+$/.test(defaultSpace)) {
+        throw new CLIError(
+          "INVALID_SPACE",
+          `Invalid --default-space "${defaultSpace}". Use a short name ([A-Za-z0-9_-]).`,
+          ExitCode.USAGE_ERROR
+        );
+      }
+      if (await ProfileManager.profileExists(profileName)) {
+        throw new CLIError(
+          "PROFILE_EXISTS",
+          `Profile "${profileName}" already exists. Use \`tc profile delete ${profileName}\` first or choose a different name.`,
+          ExitCode.ERROR
+        );
+      }
+      await ProfileManager.ensureConfigDir();
+      const { jwk, did } = await withSpinner("Generating key...", async () => {
+        return generateKey();
+      });
+      await ProfileManager.setKey(profileName, jwk);
+      const profileConfig = {
+        name: profileName,
+        host,
+        chainId: DEFAULT_CHAIN_ID,
+        spaceName: "default",
+        did,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...defaultSpace ? { defaultSpace } : {}
+      };
+      await ProfileManager.setProfile(profileName, profileConfig);
+      const config = await ProfileManager.getConfig();
+      if (profileName === "default" || !await ProfileManager.profileExists(config.defaultProfile)) {
+        await ProfileManager.setConfig({ ...config, defaultProfile: profileName });
+      }
+      if (options.keyOnly) {
+        outputJson({
+          profile: profileName,
+          did,
+          host,
+          authenticated: false
+        });
+        return;
+      }
+      const delegationData = await startAuthFlow(did, {
+        paste: options.paste,
+        noPopup: options.popup === false,
+        jwk,
+        host
+      });
+      const sanitizedSession = mergePrivateJwkIntoSession(delegationData, jwk);
+      await ProfileManager.setSession(profileName, sanitizedSession);
+      await ProfileManager.setProfile(profileName, {
+        ...profileConfig,
+        spaceId: sanitizedSession.spaceId,
+        ownerDid: sanitizedSession.ownerDid
+      });
+      outputJson({
+        profile: profileName,
+        did,
+        host,
+        spaceId: sanitizedSession.spaceId,
+        authenticated: true
+      });
+    } catch (error) {
+      handleError(error);
+    }
+  });
 }
 
 // src/commands/kv.ts
@@ -45245,8 +45277,11 @@ function authOptions(options) {
   return privateKey ? { privateKey } : void 0;
 }
 function resolveSecretScope(options) {
-  const scope = options.scope ?? options.space;
-  return scope ? { scope } : void 0;
+  return options.scope ? { scope: options.scope } : void 0;
+}
+function resolveSecretsSpace(options) {
+  const space = options.space?.trim();
+  return space && space.length > 0 ? space : SECRETS_SPACE2;
 }
 var SECRET_NAME_RE2 = /^[A-Z][A-Z0-9_]*$/;
 var RESERVED_SECRET_SCOPES2 = /* @__PURE__ */ new Set(["default", "global"]);
@@ -45335,6 +45370,7 @@ async function runSecretOperation(params) {
     action: params.action,
     name: params.name,
     options: params.scopeOptions,
+    space: params.space,
     node: params.node
   });
   await withSpinner(
@@ -45712,7 +45748,7 @@ function secretPermissionEntries(params) {
   const path = params.action === "list" ? resolveSecretListPrefix(params.options) : resolveSecretPath2(params.name ?? "", params.options).permissionPaths.vault;
   const permissions = [{
     service: "tinycloud.kv",
-    space: SECRETS_SPACE2,
+    space: params.space ?? SECRETS_SPACE2,
     path,
     actions: [secretKvAbility(params.action)],
     skipPrefix: true
@@ -45792,7 +45828,7 @@ function registerSecretsCommand(program2) {
       handleError(error);
     }
   });
-  secrets.command("doctor [name]").description("Check secrets setup and optional secret access").option("--scope <scope>", "Logical secret scope").option("--space <scope>", "Deprecated alias for --scope").option("--network <name>", "Encryption network name", "default").option("--private-key <hex>", "Ethereum private key (or set TC_PRIVATE_KEY)").action(async (name2, options, cmd) => {
+  secrets.command("doctor [name]").description("Check secrets setup and optional secret access").option("--scope <scope>", "Logical secret scope").option("--space <space>", 'Override the secrets space (defaults to "secrets")').option("--network <name>", "Encryption network name", "default").option("--private-key <hex>", "Ethereum private key (or set TC_PRIVATE_KEY)").action(async (name2, options, cmd) => {
     try {
       const globalOpts = cmd.optsWithGlobals();
       const ctx = await ProfileManager.resolveContext(globalOpts);
@@ -45818,6 +45854,7 @@ function registerSecretsCommand(program2) {
       let secret;
       if (name2) {
         const scopeOptions = resolveSecretScope(options);
+        const space = resolveSecretsSpace(options);
         const resolved = resolveSecretPath2(name2, scopeOptions);
         const result = await runSecretOperation({
           ctx,
@@ -45825,6 +45862,7 @@ function registerSecretsCommand(program2) {
           action: "get",
           name: name2,
           scopeOptions,
+          space,
           label: `Checking secret ${name2}...`,
           operation: () => node.secrets.get(name2, scopeOptions)
         });
@@ -45879,17 +45917,19 @@ function registerSecretsCommand(program2) {
       handleError(error);
     }
   });
-  secrets.command("list").description("List secrets").option("--scope <scope>", "Logical secret scope").option("--space <scope>", "Deprecated alias for --scope").option("--private-key <hex>", "Ethereum private key (or set TC_PRIVATE_KEY)").action(async (options, cmd) => {
+  secrets.command("list").description("List secrets").option("--scope <scope>", "Logical secret scope").option("--space <space>", 'Override the secrets space (defaults to "secrets")').option("--private-key <hex>", "Ethereum private key (or set TC_PRIVATE_KEY)").action(async (options, cmd) => {
     try {
       const globalOpts = cmd.optsWithGlobals();
       const ctx = await ProfileManager.resolveContext(globalOpts);
       const node = await ensureSecretsNode(ctx, options);
       const scopeOptions = resolveSecretScope(options);
+      const space = resolveSecretsSpace(options);
       const result = await runSecretOperation({
         ctx,
         node,
         action: "list",
         scopeOptions,
+        space,
         label: "Listing secrets...",
         operation: () => node.secrets.list(scopeOptions)
       });
@@ -45897,21 +45937,21 @@ function registerSecretsCommand(program2) {
         throw new CLIError(result.error.code, result.error.message, ExitCode.ERROR);
       }
       const secretNames = Array.isArray(result.data) ? result.data : [];
-      const scope = options.scope ?? options.space;
       outputJson({
         secrets: secretNames,
         count: secretNames.length,
-        ...scope ? { scope } : {}
+        ...options.scope ? { scope: options.scope } : {}
       });
     } catch (error) {
       handleError(error);
     }
   });
-  secrets.command("get <name>").description("Get a secret value").option("--scope <scope>", "Logical secret scope").option("--space <scope>", "Deprecated alias for --scope").option("--raw", "Output raw value (no JSON wrapping)").option("--value-only", "Output only the secret value (alias for --raw)").option("-o, --output <file>", "Write value to file").option("--delegation <source>", "Delegation file path or imported profile name").option("--private-key <hex>", "Ethereum private key (or set TC_PRIVATE_KEY)").action(async (name2, options, cmd) => {
+  secrets.command("get <name>").description("Get a secret value").option("--scope <scope>", "Logical secret scope").option("--space <space>", 'Override the secrets space (defaults to "secrets")').option("--raw", "Output raw value (no JSON wrapping)").option("--value-only", "Output only the secret value (alias for --raw)").option("-o, --output <file>", "Write value to file").option("--delegation <source>", "Delegation file path or imported profile name").option("--private-key <hex>", "Ethereum private key (or set TC_PRIVATE_KEY)").action(async (name2, options, cmd) => {
     try {
       const globalOpts = cmd.optsWithGlobals();
       const ctx = await ProfileManager.resolveContext(globalOpts);
       const scopeOptions = resolveSecretScope(options);
+      const space = resolveSecretsSpace(options);
       const secretPath = resolveSecretPath2(name2, scopeOptions).permissionPaths.vault;
       if (options.delegation) {
         const delegated = await resolveDelegatedSecretSource(options.delegation, secretPath);
@@ -45948,6 +45988,7 @@ function registerSecretsCommand(program2) {
         action: "get",
         name: name2,
         scopeOptions,
+        space,
         label: `Getting secret ${name2}...`,
         operation: () => node.secrets.get(name2, scopeOptions)
       });
@@ -45972,7 +46013,7 @@ function registerSecretsCommand(program2) {
       handleError(error);
     }
   });
-  secrets.command("put <name> [value]").description("Store a secret").option("--scope <scope>", "Logical secret scope").option("--space <scope>", "Deprecated alias for --scope").option("--file <path>", "Read value from file").option("--stdin", "Read value from stdin").option("--private-key <hex>", "Ethereum private key (or set TC_PRIVATE_KEY)").action(async (name2, value, options, cmd) => {
+  secrets.command("put <name> [value]").description("Store a secret").option("--scope <scope>", "Logical secret scope").option("--space <space>", 'Override the secrets space (defaults to "secrets")').option("--file <path>", "Read value from file").option("--stdin", "Read value from stdin").option("--private-key <hex>", "Ethereum private key (or set TC_PRIVATE_KEY)").action(async (name2, value, options, cmd) => {
     try {
       const globalOpts = cmd.optsWithGlobals();
       const ctx = await ProfileManager.resolveContext(globalOpts);
@@ -45993,12 +46034,14 @@ function registerSecretsCommand(program2) {
         secretValue = value;
       }
       const scopeOptions = resolveSecretScope(options);
+      const space = resolveSecretsSpace(options);
       const result = await runSecretOperation({
         ctx,
         node,
         action: "put",
         name: name2,
         scopeOptions,
+        space,
         label: `Storing secret ${name2}...`,
         operation: () => node.secrets.put(name2, secretValue, scopeOptions)
       });
@@ -46010,18 +46053,20 @@ function registerSecretsCommand(program2) {
       handleError(error);
     }
   });
-  secrets.command("delete <name>").description("Delete a secret").option("--scope <scope>", "Logical secret scope").option("--space <scope>", "Deprecated alias for --scope").option("--private-key <hex>", "Ethereum private key (or set TC_PRIVATE_KEY)").action(async (name2, options, cmd) => {
+  secrets.command("delete <name>").description("Delete a secret").option("--scope <scope>", "Logical secret scope").option("--space <space>", 'Override the secrets space (defaults to "secrets")').option("--private-key <hex>", "Ethereum private key (or set TC_PRIVATE_KEY)").action(async (name2, options, cmd) => {
     try {
       const globalOpts = cmd.optsWithGlobals();
       const ctx = await ProfileManager.resolveContext(globalOpts);
       const node = await ensureSecretsNode(ctx, options);
       const scopeOptions = resolveSecretScope(options);
+      const space = resolveSecretsSpace(options);
       const result = await runSecretOperation({
         ctx,
         node,
         action: "del",
         name: name2,
         scopeOptions,
+        space,
         label: `Deleting secret ${name2}...`,
         operation: () => node.secrets.delete(name2, scopeOptions)
       });
@@ -46738,6 +46783,432 @@ ${rowCount} row${rowCount === 1 ? "" : "s"} returned`) + "\n");
 var import_siwe = __toESM(require_siwe(), 1);
 var import_ms2 = __toESM(require_ms(), 1);
 
+// ../bootstrap/dist/index.js
+var DEFAULT_MANIFEST_SPACE2 = "applications";
+var ACCOUNT_REGISTRY_SPACE = "account";
+var ACCOUNT_REGISTRY_PATH = "applications/";
+var SECRETS_SPACE3 = "secrets";
+var BOOTSTRAP_DEFAULT_SPACE = "default";
+var BOOTSTRAP_PUBLIC_SPACE = "public";
+var BOOTSTRAP_ENCRYPTION_NETWORK_NAME = "default";
+var BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE = `urn:tinycloud:encryption:{ownerDid}:${BOOTSTRAP_ENCRYPTION_NETWORK_NAME}`;
+var DEFAULT_EXPIRY_MS = 30 * 24 * 60 * 60 * 1e3;
+var VAULT_PERMISSION_SERVICE2 = "tinycloud.vault";
+var ENCRYPTION_PERMISSION_SERVICE2 = "tinycloud.encryption";
+var ENCRYPTION_MANIFEST_SPACE2 = "encryption";
+var NETWORK_CREATE_ACTION = "tinycloud.encryption/network.create";
+var BOOTSTRAP_SPACE_NAMES = [
+  BOOTSTRAP_DEFAULT_SPACE,
+  DEFAULT_MANIFEST_SPACE2,
+  ACCOUNT_REGISTRY_SPACE,
+  SECRETS_SPACE3,
+  BOOTSTRAP_PUBLIC_SPACE
+];
+var TINYCLOUD_DEFAULT_SPACE_MANIFEST = {
+  app_id: "xyz.tinycloud.default",
+  name: "TinyCloud Default Space",
+  space: BOOTSTRAP_DEFAULT_SPACE,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.kv",
+      space: BOOTSTRAP_DEFAULT_SPACE,
+      path: "/",
+      actions: ["get", "put", "del", "list", "metadata"]
+    },
+    {
+      service: "tinycloud.sql",
+      space: BOOTSTRAP_DEFAULT_SPACE,
+      path: "/",
+      actions: ["read", "write"]
+    }
+  ]
+};
+var TINYCLOUD_APPLICATIONS_SPACE_MANIFEST = {
+  app_id: "xyz.tinycloud.applications",
+  name: "TinyCloud Applications Space",
+  space: DEFAULT_MANIFEST_SPACE2,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.kv",
+      space: DEFAULT_MANIFEST_SPACE2,
+      path: "/",
+      actions: ["get", "put", "del", "list", "metadata"]
+    },
+    {
+      service: "tinycloud.sql",
+      space: DEFAULT_MANIFEST_SPACE2,
+      path: "/",
+      actions: ["read", "write"]
+    }
+  ]
+};
+var TINYCLOUD_ACCOUNT_SPACE_MANIFEST = {
+  app_id: "xyz.tinycloud.account",
+  name: "TinyCloud Account Registry",
+  space: ACCOUNT_REGISTRY_SPACE,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.kv",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: "applications/",
+      actions: ["get", "put", "list"]
+    },
+    {
+      service: "tinycloud.kv",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: "spaces/",
+      actions: ["get", "put", "list"]
+    },
+    {
+      service: "tinycloud.sql",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: "account",
+      actions: ["read", "write", "schema"]
+    }
+  ]
+};
+var TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST = {
+  app_id: "xyz.tinycloud.secrets",
+  name: "TinyCloud Secrets",
+  space: SECRETS_SPACE3,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.vault",
+      space: SECRETS_SPACE3,
+      path: "secrets/",
+      actions: ["read"],
+      skipPrefix: true
+    },
+    {
+      service: "tinycloud.kv",
+      space: SECRETS_SPACE3,
+      path: "variables",
+      actions: ["list", "metadata"],
+      skipPrefix: true
+    },
+    {
+      service: "tinycloud.kv",
+      space: SECRETS_SPACE3,
+      path: "variables/",
+      actions: ["get", "put", "del", "list", "metadata"],
+      skipPrefix: true
+    },
+    {
+      service: "tinycloud.sql",
+      space: SECRETS_SPACE3,
+      path: "default",
+      actions: ["read", "write", "schema"],
+      skipPrefix: true
+    },
+    {
+      service: "tinycloud.capabilities",
+      space: SECRETS_SPACE3,
+      path: "",
+      actions: ["read"],
+      skipPrefix: true
+    }
+  ]
+};
+var TINYCLOUD_PUBLIC_SPACE_MANIFEST = {
+  app_id: "xyz.tinycloud.public",
+  name: "TinyCloud Public Space",
+  space: BOOTSTRAP_PUBLIC_SPACE,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.kv",
+      space: BOOTSTRAP_PUBLIC_SPACE,
+      path: "/",
+      actions: ["get", "list", "metadata"]
+    }
+  ]
+};
+var BOOTSTRAP_SPACE_MANIFESTS = {
+  [BOOTSTRAP_DEFAULT_SPACE]: TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  [DEFAULT_MANIFEST_SPACE2]: TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  [ACCOUNT_REGISTRY_SPACE]: TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  [SECRETS_SPACE3]: TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+  [BOOTSTRAP_PUBLIC_SPACE]: TINYCLOUD_PUBLIC_SPACE_MANIFEST
+};
+var BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS = [
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST
+];
+var ACCOUNT_INDEX_SCHEMA = [
+  `CREATE TABLE IF NOT EXISTS applications (
+    app_id TEXT PRIMARY KEY,
+    name TEXT,
+    description TEXT,
+    updated_at TEXT,
+    manifest_json TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS application_state (
+    app_id TEXT PRIMARY KEY,
+    manifest_hash TEXT NOT NULL,
+    indexed_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS spaces (
+    space_id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    owner_did TEXT NOT NULL,
+    type TEXT NOT NULL,
+    permissions_json TEXT NOT NULL,
+    status TEXT NOT NULL,
+    registered_at TEXT,
+    updated_at TEXT NOT NULL,
+    expires_at TEXT
+  )`,
+  `CREATE TABLE IF NOT EXISTS delegations (
+    cid TEXT PRIMARY KEY,
+    direction TEXT NOT NULL,
+    space_id TEXT NOT NULL,
+    space_name TEXT,
+    counterparty_did TEXT NOT NULL,
+    delegate_did TEXT NOT NULL,
+    delegator_did TEXT,
+    path TEXT NOT NULL,
+    actions_json TEXT NOT NULL,
+    expiry TEXT NOT NULL,
+    status TEXT NOT NULL,
+    created_at TEXT,
+    updated_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS sync_state (
+    source TEXT PRIMARY KEY,
+    synced_at TEXT NOT NULL,
+    count INTEGER NOT NULL
+  )`,
+  "CREATE INDEX IF NOT EXISTS idx_delegations_direction ON delegations(direction)",
+  "CREATE INDEX IF NOT EXISTS idx_delegations_space ON delegations(space_id)",
+  "CREATE INDEX IF NOT EXISTS idx_delegations_counterparty ON delegations(counterparty_did)",
+  "CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_did)",
+  "CREATE INDEX IF NOT EXISTS idx_spaces_type ON spaces(type)"
+];
+var SECRET_RECORDS_SCHEMA = [
+  `CREATE TABLE IF NOT EXISTS secret_records (
+    scope TEXT NOT NULL,
+    name TEXT NOT NULL,
+    provider_id TEXT,
+    custom_note TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    last_tested TEXT,
+    test_status TEXT,
+    test_message TEXT,
+    PRIMARY KEY(scope, name)
+  )`
+];
+var BOOTSTRAP_MANIFEST = {
+  spaces: BOOTSTRAP_SPACE_NAMES.map((name2) => ({
+    name: name2,
+    manifest: BOOTSTRAP_SPACE_MANIFESTS[name2],
+    persistedAsApplication: name2 === SECRETS_SPACE3
+  })),
+  applications: BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  accountIndexSchema: ACCOUNT_INDEX_SCHEMA,
+  secretRecordsSchema: SECRET_RECORDS_SCHEMA,
+  encryptionNetwork: {
+    name: BOOTSTRAP_ENCRYPTION_NETWORK_NAME
+  }
+};
+function cloneManifest(manifest) {
+  return {
+    ...manifest,
+    permissions: manifest.permissions?.map((permission) => ({
+      ...permission,
+      actions: [...permission.actions]
+    }))
+  };
+}
+function actionUrn(service, action) {
+  return action.includes("/") ? action : `${service}/${action}`;
+}
+function applyPrefix2(prefix, path, skipPrefix) {
+  if (skipPrefix === true || prefix === "" || path === "") {
+    return path;
+  }
+  if (path === "/") {
+    return `${prefix}/`;
+  }
+  const trimmedPrefix = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
+  const trimmedPath = path.startsWith("/") ? path.slice(1) : path;
+  return `${trimmedPrefix}/${trimmedPath}`;
+}
+function expandVaultPermission(entry) {
+  return entry.actions.map((action) => {
+    const normalized = action.startsWith("tinycloud.vault/") ? action.slice("tinycloud.vault/".length) : action.startsWith("tinycloud.kv/") ? action.slice("tinycloud.kv/".length) : action;
+    const mapped = normalized === "read" || normalized === "get" ? "tinycloud.kv/get" : normalized === "write" || normalized === "put" ? "tinycloud.kv/put" : normalized === "delete" || normalized === "del" ? "tinycloud.kv/del" : normalized === "list" ? "tinycloud.kv/list" : normalized === "metadata" ? "tinycloud.kv/metadata" : void 0;
+    if (mapped === void 0) {
+      throw new Error(`unknown vault action ${JSON.stringify(action)}`);
+    }
+    const normalizedPath = entry.path.startsWith("/") ? entry.path.slice(1) : entry.path;
+    return {
+      ...entry,
+      service: "tinycloud.kv",
+      path: `vault/${normalizedPath}`,
+      actions: [mapped],
+      skipPrefix: true
+    };
+  });
+}
+function expandPermissionEntry2(entry, prefix, inheritedSpace) {
+  if (entry.service === VAULT_PERMISSION_SERVICE2) {
+    return expandVaultPermission(entry).flatMap(
+      (expanded) => expandPermissionEntry2(expanded, prefix, inheritedSpace)
+    );
+  }
+  const skipPrefix = entry.skipPrefix === true || entry.service === ENCRYPTION_PERMISSION_SERVICE2;
+  return [
+    {
+      service: entry.service,
+      space: entry.service === ENCRYPTION_PERMISSION_SERVICE2 ? ENCRYPTION_MANIFEST_SPACE2 : entry.space ?? inheritedSpace,
+      path: applyPrefix2(prefix, entry.path, skipPrefix),
+      actions: entry.actions.map((action) => actionUrn(entry.service, action)),
+      ...entry.description !== void 0 ? { description: entry.description } : {}
+    }
+  ];
+}
+function dedupeResources2(resources) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const resource of resources) {
+    const key2 = `${resource.service}\0${resource.space}\0${resource.path}`;
+    const existing = byKey.get(key2);
+    if (!existing) {
+      byKey.set(key2, { ...resource, actions: [...resource.actions] });
+      continue;
+    }
+    for (const action of resource.actions) {
+      if (!existing.actions.includes(action)) {
+        existing.actions.push(action);
+      }
+    }
+  }
+  return [...byKey.values()];
+}
+function withCapabilitiesReadForSpaces2(resources) {
+  const spaces = new Set(
+    resources.filter((resource) => resource.service !== ENCRYPTION_PERMISSION_SERVICE2).map((resource) => resource.space)
+  );
+  return dedupeResources2([
+    ...resources,
+    ...[...spaces].map((space) => ({
+      service: "tinycloud.capabilities",
+      space,
+      path: "",
+      actions: ["tinycloud.capabilities/read"]
+    }))
+  ]);
+}
+function accountRegistryPermissions() {
+  return [
+    {
+      service: "tinycloud.kv",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: ACCOUNT_REGISTRY_PATH,
+      actions: ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/list"]
+    },
+    {
+      service: "tinycloud.kv",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: "spaces/",
+      actions: ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/list"]
+    },
+    {
+      service: "tinycloud.sql",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: "account",
+      actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema"]
+    }
+  ];
+}
+function composeManifestRequest(inputs, options = {}) {
+  if (!Array.isArray(inputs) || inputs.length === 0) {
+    throw new Error("composeManifestRequest requires at least one manifest");
+  }
+  const includeAccountRegistryPermissions = options.includeAccountRegistryPermissions ?? true;
+  const manifests = inputs.map(cloneManifest);
+  const resources = manifests.flatMap((manifest) => {
+    const prefix = manifest.prefix ?? manifest.app_id;
+    const space = manifest.space ?? DEFAULT_MANIFEST_SPACE2;
+    const explicit = manifest.permissions ?? [];
+    return explicit.flatMap((entry) => expandPermissionEntry2(entry, prefix, space));
+  });
+  if (includeAccountRegistryPermissions) {
+    resources.push(...accountRegistryPermissions());
+  }
+  const manifestsByAppId = /* @__PURE__ */ new Map();
+  for (const manifest of manifests) {
+    const current = manifestsByAppId.get(manifest.app_id) ?? [];
+    current.push(cloneManifest(manifest));
+    manifestsByAppId.set(manifest.app_id, current);
+  }
+  return {
+    manifests,
+    resources: withCapabilitiesReadForSpaces2(resources),
+    delegationTargets: [],
+    registryRecords: includeAccountRegistryPermissions ? [...manifestsByAppId.entries()].map(([app_id, appManifests]) => ({
+      key: `${ACCOUNT_REGISTRY_PATH}${app_id}`,
+      app_id,
+      manifests: appManifests
+    })) : [],
+    expiryMs: DEFAULT_EXPIRY_MS,
+    includePublicSpace: manifests.some(
+      (manifest) => manifest.includePublicSpace ?? true
+    )
+  };
+}
+function composeBootstrapSpaceManifest(space) {
+  return composeManifestRequest([BOOTSTRAP_SPACE_MANIFESTS[space]], {
+    includeAccountRegistryPermissions: false
+  });
+}
+var BOOTSTRAP_SESSION_REQUESTS = Object.freeze(
+  Object.fromEntries(
+    BOOTSTRAP_SPACE_NAMES.map((space) => [
+      space,
+      composeBootstrapSpaceManifest(space)
+    ])
+  )
+);
+var ACCOUNT_SESSION_RAW_ALLOWLIST = Object.freeze([
+  {
+    service: "tinycloud.encryption",
+    resource: BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+    actions: [NETWORK_CREATE_ACTION]
+  }
+]);
+var BOOTSTRAP_ALLOWLIST = Object.freeze(
+  BOOTSTRAP_SPACE_NAMES.flatMap((space) => [
+    {
+      kind: "session",
+      service: "tinycloud.session",
+      space,
+      actions: ["siwe"],
+      resources: BOOTSTRAP_SESSION_REQUESTS[space].resources,
+      ...space === ACCOUNT_REGISTRY_SPACE ? { rawAbilities: ACCOUNT_SESSION_RAW_ALLOWLIST } : {}
+    },
+    {
+      kind: "space/host",
+      service: "tinycloud.space",
+      space,
+      actions: ["tinycloud.space/host"]
+    }
+  ])
+);
+
 // ../../node_modules/uint8arrays/dist/src/equals.js
 function equals(a, b) {
   if (a === b) {
@@ -49653,7 +50124,7 @@ var SharingServiceConfigSchema = external_exports.object({
     message: "Expected an onRootDelegationNeeded function or undefined"
   }).optional()
 });
-var DEFAULT_EXPIRY_MS = EXPIRY.SHARE_MS;
+var DEFAULT_EXPIRY_MS2 = EXPIRY.SHARE_MS;
 var AutoApproveSpaceCreationHandler = class {
   /**
    * Always returns true to auto-approve space creation.