@tinycloud/node-sdk 2.11.0-beta.1 → 2.11.0-beta.10

package/dist/core.js

@@ -220,6 +220,8 @@ var FileSessionStorage = class {
 };
 
 // src/authorization/NodeUserAuthorization.ts
+import { createHash } from "crypto";
+import { SiweMessage } from "siwe";
 import {
   fetchPeerId,
   submitHostDelegation,
@@ -238,6 +240,11 @@ import {
   canonicalizeAddress,
   makePkhSpaceId,
   pkhDid,
+  extractImmutableSiweFields,
+  diffImmutableSiweFields,
+  extractRecapAttenuations,
+  unauthorizedRecapCapabilities,
+  parseCanonicalRecapResource,
   KV,
   SQL,
   DUCKDB,
@@ -253,6 +260,27 @@ var defaultSignStrategy = { type: "auto-sign" };
 // src/authorization/NodeUserAuthorization.ts
 var DECRYPT_ACTION = ENCRYPTION.DECRYPT;
 var NETWORK_CREATE_ACTION = ENCRYPTION.NETWORK_CREATE;
+function canonicalizeOpenKeyManifestJson(value) {
+  const json = JSON.stringify(value);
+  if (json === void 0) {
+    throw new TypeError("manifest is not JSON-serializable");
+  }
+  return canonicalizeJsonValue(JSON.parse(json));
+}
+function canonicalizeJsonValue(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalizeJsonValue).join(",")}]`;
+  }
+  return `{${Object.keys(value).sort().map(
+    (key) => `${JSON.stringify(key)}:${canonicalizeJsonValue(value[key])}`
+  ).join(",")}}`;
+}
+function canonicalOpenKeyManifestSha256Hex(value) {
+  return createHash("sha256").update(canonicalizeOpenKeyManifestJson(value)).digest("hex");
+}
 function didPrincipalMatches(actual, expected) {
   try {
     return principalDidEquals(actual, expected);
@@ -473,6 +501,15 @@ var NodeUserAuthorization = class {
   get nodeFeatures() {
     return this._nodeFeatures;
   }
+  /**
+   * The node DID reported by `GET /info` for `host`, if the sign-in (or
+   * restore) that populated it targeted that same host. Returns `undefined`
+   * for any other host, and for nodes whose `/info` omits `nodeId`, so callers
+   * fall back to fetching it themselves rather than using a foreign node's DID.
+   */
+  nodeIdForHost(host) {
+    return this._nodeInfoIdentity?.host === host ? this._nodeInfoIdentity.nodeId : void 0;
+  }
   get lastActivationSkippedSpaceIds() {
     return [...this._lastActivationSkippedSpaceIds];
   }
@@ -942,11 +979,13 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
+    const infoHost = this.primaryTinyCloudHost;
     const nodeInfo = await checkNodeInfo(
-      this.primaryTinyCloudHost,
+      infoHost,
       this.wasm.protocolVersion()
     );
     this._nodeFeatures = nodeInfo.features;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -1112,11 +1151,13 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
+    const infoHost = this.primaryTinyCloudHost;
     const nodeInfo = await checkNodeInfo(
-      this.primaryTinyCloudHost,
+      infoHost,
       this.wasm.protocolVersion()
     );
     this._nodeFeatures = nodeInfo.features;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -1125,6 +1166,398 @@ var NodeUserAuthorization = class {
     await this.ensureSpaceExists();
     return clientSession;
   }
+  /**
+   * End-to-end sign-in via OpenKey `authorizeTinyCloud()` (Sol CRITICAL-4).
+   *
+   * This is the production entry point that wires
+   * {@link prepareSessionForSigning} → OpenKey `authorizeTinyCloud()` →
+   * {@link signInWithOpenKeyResult} into one call. Consumers pass in a
+   * caller-provided `authorizeFn` (typically a thin wrapper around
+   * `openkey.authorizeTinyCloud()`) so this method has no direct
+   * dependency on the OpenKey SDK — it works with any transport that
+   * conforms to the versioned protocol.
+   *
+   * The `authorizeFn` MUST:
+   *   1. Send the prepared SIWE bytes to OpenKey.
+   *   2. Return the exact `TinyCloudAuthorizationResultV1` shape (with
+   *      `signedMessage` — the bytes the signature actually verifies
+   *      against — plus `selectedActionKeys` and `permissions`).
+   *
+   * NodeUserAuthorization then completes the session with `signedMessage`
+   * (never the prepared bytes), verifying the signature, the immutable
+   * SIWE fields, and every subset invariant enforced by
+   * {@link signInWithOpenKeyResult}. This preserves the exact-byte
+   * guarantee: if the user did NOT narrow, the returned `signedMessage`
+   * equals the prepared SIWE byte-for-byte; if the user narrowed, only
+   * the ReCap block differs and every immutable header field survives.
+   *
+   * Legacy exact-byte {@link signIn} callers are unaffected — this method
+   * is opt-in.
+   *
+   * @param authorizeFn Callback that invokes the versioned OpenKey
+   *   `authorizeTinyCloud()` protocol and returns the result. Receives
+   *   the prepared SIWE bytes plus a `host` hint the widget should bind
+   *   into its /authorize-sign-prepare context.
+   * @param options Optional overrides for the OpenKey request.
+   */
+  async signInWithOpenKey(authorizeFn, options) {
+    if (options?.host !== void 0) {
+      const overrideHost = options.host.trim();
+      if (!overrideHost) {
+        throw new Error("OpenKey authorization host must not be empty");
+      }
+      this.tinycloudHosts = [overrideHost];
+    }
+    const signingAddress = canonicalizeAddress(await this.signer.getAddress());
+    const signingChainId = await this.signer.getChainId();
+    await this.resolveTinyCloudHostsForSignIn(signingAddress, signingChainId);
+    const { prepared, keyId, jwk } = await this.prepareSessionForSigning();
+    const presentation = this.buildPresentationEnvelope(options?.reason);
+    const hostHint = this.primaryTinyCloudHost;
+    const result = await authorizeFn({
+      protocolVersion: 1,
+      siwe: prepared.siwe,
+      jwk,
+      host: hostHint,
+      keyId: options?.openkeyKeyId,
+      presentation
+    });
+    return this.signInWithOpenKeyResult(result, prepared, keyId, jwk);
+  }
+  /**
+   * Build a `CapabilityPresentationEnvelopeV1` from `this._manifest`. The
+   * envelope is display-only — the OpenKey widget renders it under an
+   * honest trust label, and the server /authorize-sign-prepare route
+   * decides whether to upgrade the label to `origin-bound` by fetching
+   * the well-known manifest and comparing its digest to
+   * `manifestDigest`.
+   *
+   * Returns `undefined` when no manifest is set — the widget renders as
+   * "no manifest supplied" (unsigned).
+   *
+   * The digest is a deterministic SHA-256 over canonical JSON of the
+   * first manifest payload; OpenKey parses the fetched well-known manifest
+   * and applies the same canonicalization before comparing digests.
+   */
+  buildPresentationEnvelope(reason) {
+    const manifests = Array.isArray(this._manifest) ? this._manifest : this._manifest ? [this._manifest] : [];
+    if (manifests.length === 0 && !reason) {
+      return void 0;
+    }
+    const primary = manifests[0];
+    let displayName;
+    let manifestId;
+    let manifestDigest;
+    const envelopeManifests = [];
+    for (const m of manifests) {
+      envelopeManifests.push({
+        name: m.name,
+        appId: m.app_id,
+        // Deep-copy to prevent later mutations from affecting the digest.
+        payload: JSON.parse(JSON.stringify(m))
+      });
+    }
+    if (primary) {
+      displayName = primary.name;
+      manifestId = primary.app_id;
+      manifestDigest = canonicalOpenKeyManifestSha256Hex(primary);
+    }
+    return {
+      protocolVersion: 1,
+      displayName,
+      reason: reason && reason.length > 0 ? reason : void 0,
+      manifestId,
+      manifestDigest,
+      manifests: envelopeManifests.length > 0 ? envelopeManifests : void 0
+    };
+  }
+  /**
+   * Complete sign-in with a versioned OpenKey authorization result.
+   *
+   * Where `signInWithPreparedSession` completes with a signature over the
+   * ORIGINAL prepared SIWE, this method completes with the SIWE bytes the
+   * OpenKey widget actually presented and signed (`signedMessage`). It
+   * exists because the versioned authorizeTinyCloud protocol lets the user
+   * narrow capabilities; the returned bytes may differ from the original
+   * request and are the only ones the signature actually verifies against.
+   *
+   * The `result` parameter is validated at the trust boundary via
+   * `validateAuthorizationResultV1` (in sdk-core). Callers should validate
+   * BEFORE calling this method so unknown/missing fields are rejected
+   * before any session state is created.
+   *
+   * Validation performed here (defence-in-depth: even a "valid" v1 payload
+   * must clear these checks before any session state is created):
+   * 1. `result.address` matches the local signer's address.
+   * 2. `result.signature` recovers to `result.address` when verified against
+   *    `result.signedMessage`.
+   * 3. Every immutable SIWE header field (domain, address, URI, version,
+   *    chainId, nonce, issuedAt) in the original prepared SIWE is preserved
+   *    byte-for-byte in `result.signedMessage`. `statement` is NOT in this
+   *    list because the WASM renders it from the ReCap contents; it MUST
+   *    change when the ReCap is narrowed.
+   * 4. Every capability in `result.signedMessage`'s ReCap block was present
+   *    in the original prepared SIWE — narrowing OK, broadening rejected.
+   * 5. Every `result.selectedActionKeys` entry corresponds to a
+   *    (resource, action) pair in the returned SIWE.
+   */
+  async signInWithOpenKeyResult(result, prepared, keyId, jwk) {
+    if (result.protocolVersion !== 1) {
+      throw new Error(`Unsupported OpenKey protocol version ${result.protocolVersion}`);
+    }
+    if (!result.signedMessage) {
+      throw new Error("OpenKey result must include signedMessage");
+    }
+    if (!prepared.siwe) {
+      throw new Error(
+        "signInWithOpenKeyResult requires prepared.siwe (the SDK-generated SIWE the sign-in was proposed with)"
+      );
+    }
+    const expectedAddress = canonicalizeAddress(await this.signer.getAddress());
+    if (canonicalizeAddress(result.address) !== expectedAddress) {
+      throw new Error(
+        `OpenKey returned signature from ${result.address} but expected ${expectedAddress}`
+      );
+    }
+    let parsedSignedSiwe;
+    try {
+      parsedSignedSiwe = new SiweMessage(result.signedMessage);
+    } catch (err) {
+      throw new Error(
+        `OpenKey signedMessage is not a parseable SIWE: ${err.message}`
+      );
+    }
+    const verifyResult = await parsedSignedSiwe.verify(
+      { signature: result.signature },
+      { suppressExceptions: true }
+    );
+    if (!verifyResult.success) {
+      const errData = verifyResult.error;
+      const type = errData && typeof errData === "object" && "type" in errData ? errData.type : void 0;
+      const details = errData && typeof errData === "object" && "expected" in errData ? ` (expected=${errData.expected}, received=${errData.received})` : "";
+      throw new Error(
+        `OpenKey signature verification failed${type ? `: ${type}` : ""}${details}`
+      );
+    }
+    if (canonicalizeAddress(parsedSignedSiwe.address) !== expectedAddress) {
+      throw new Error(
+        `OpenKey signedMessage.address (${parsedSignedSiwe.address}) does not match local signer address (${expectedAddress})`
+      );
+    }
+    const originalHasRecap = /(?:^|\n)-\s+urn:recap:/i.test(prepared.siwe);
+    const originalFields = extractImmutableSiweFields(prepared.siwe);
+    const signedFields = extractImmutableSiweFields(result.signedMessage);
+    const changedFields = diffImmutableSiweFields(originalFields, signedFields, {
+      originalHasRecap
+    });
+    if (changedFields.length > 0) {
+      throw new Error(
+        `OpenKey signedMessage altered immutable SIWE fields: ${changedFields.join(", ")}`
+      );
+    }
+    let originalCaps;
+    let signedCaps;
+    try {
+      originalCaps = extractRecapAttenuations(prepared.siwe);
+    } catch (err) {
+      throw new Error(
+        `Failed to decode prepared SIWE recap: ${err.message}`
+      );
+    }
+    try {
+      signedCaps = extractRecapAttenuations(result.signedMessage);
+    } catch (err) {
+      throw new Error(
+        `Failed to decode OpenKey signedMessage recap: ${err.message}`
+      );
+    }
+    const unauthorized = unauthorizedRecapCapabilities(signedCaps, originalCaps);
+    if (unauthorized.length > 0) {
+      const previewLimit = 5;
+      const preview = unauthorized.slice(0, previewLimit).map((u) => `${u.resource}::${u.action}`).join(", ");
+      const overflow = unauthorized.length > previewLimit ? ` (and ${unauthorized.length - previewLimit} more)` : "";
+      throw new Error(
+        `OpenKey signedMessage broadened authorization beyond the original request: ${preview}${overflow}`
+      );
+    }
+    if (!result.signedMessage.includes(prepared.spaceId)) {
+      throw new Error(
+        `OpenKey signedMessage does not reference the expected spaceId ${prepared.spaceId}`
+      );
+    }
+    const grantedPairs = /* @__PURE__ */ new Set();
+    const grantedFourPartIndex = /* @__PURE__ */ new Map();
+    for (const [resource, actions] of Object.entries(signedCaps)) {
+      const { space, path } = parseCanonicalRecapResource(resource);
+      for (const action of Object.keys(actions)) {
+        grantedPairs.add(`${resource}\0${action}`);
+        const slashIdx = action.indexOf("/");
+        const service = slashIdx > 0 ? action.slice(0, slashIdx) : "";
+        if (service) {
+          grantedFourPartIndex.set(
+            `${service}\0${space}\0${path}\0${action}`,
+            `${resource}\0${action}`
+          );
+        }
+      }
+    }
+    const isStructurallyRequired = (action) => action === "tinycloud.capabilities/read" || action === "capabilities/read";
+    const nonRequiredGrantedPairs = /* @__PURE__ */ new Set();
+    for (const pair of grantedPairs) {
+      const idx = pair.indexOf("\0");
+      const action = idx >= 0 ? pair.slice(idx + 1) : pair;
+      if (!isStructurallyRequired(action)) {
+        nonRequiredGrantedPairs.add(pair);
+      }
+    }
+    const allSignedGrantedPairs = new Set(grantedPairs);
+    const seenRawKeys = /* @__PURE__ */ new Set();
+    for (const rawKey of result.selectedActionKeys) {
+      if (seenRawKeys.has(rawKey)) {
+        throw new Error(
+          `OpenKey selectedActionKeys contains duplicate entry ${rawKey}`
+        );
+      }
+      seenRawKeys.add(rawKey);
+    }
+    const selectedResourceActionPairs = /* @__PURE__ */ new Set();
+    for (const rawKey of result.selectedActionKeys) {
+      const parts = rawKey.split("\0");
+      if (parts.length !== 4) {
+        throw new Error(
+          `OpenKey selectedActionKeys entry is malformed (expected canonical 4-part service\\0space\\0path\\0ability): ${rawKey}`
+        );
+      }
+      const canonical = grantedFourPartIndex.get(rawKey);
+      if (!canonical) {
+        throw new Error(
+          `OpenKey selectedActionKeys entry ${rawKey} is not covered by any granted capability`
+        );
+      }
+      selectedResourceActionPairs.add(canonical);
+    }
+    if (nonRequiredGrantedPairs.size > 0) {
+      const missingPairs = [];
+      for (const pair of nonRequiredGrantedPairs) {
+        if (!selectedResourceActionPairs.has(pair)) {
+          missingPairs.push(pair);
+        }
+      }
+      if (missingPairs.length > 0) {
+        const previewLimit = 5;
+        const preview = missingPairs.slice(0, previewLimit).map((p) => p.replace("\0", "::")).join(", ");
+        const overflow = missingPairs.length > previewLimit ? ` (and ${missingPairs.length - previewLimit} more)` : "";
+        throw new Error(
+          `OpenKey selectedActionKeys is missing entries for signedMessage capabilities: ${preview}${overflow}`
+        );
+      }
+    }
+    if (allSignedGrantedPairs.size > 0 && result.permissions.length === 0) {
+      throw new Error(
+        "OpenKey permissions is empty but signedMessage carries capabilities \u2014 refusing to accept a session without an authoritative grant list"
+      );
+    }
+    const permissionCanonicalKeys = /* @__PURE__ */ new Set();
+    const permissionPairsCovered = /* @__PURE__ */ new Set();
+    for (const perm of result.permissions) {
+      const { service, space, path, actions } = perm;
+      if (typeof service !== "string" || typeof space !== "string" || typeof path !== "string") {
+        throw new Error(
+          `OpenKey permissions entry has non-string service/space/path (service=${service}, space=${space}, path=${path})`
+        );
+      }
+      if (!Array.isArray(actions) || actions.length === 0) {
+        throw new Error(
+          `OpenKey permissions entry (${service} ${space} ${path}) has empty actions \u2014 a capability-bearing entry must list at least one action`
+        );
+      }
+      const canonicalKey = `${service}\0${space}\0${path}`;
+      if (permissionCanonicalKeys.has(canonicalKey)) {
+        throw new Error(
+          `OpenKey permissions has duplicate entry for (${service} ${space} ${path})`
+        );
+      }
+      permissionCanonicalKeys.add(canonicalKey);
+      let expectedResource;
+      if (space.startsWith("tinycloud:")) {
+        const shortService = service.startsWith("tinycloud.") ? service.slice("tinycloud.".length) : service;
+        expectedResource = path ? `${space}/${shortService}/${path}` : `${space}/${shortService}`;
+      } else {
+        if (path) {
+          throw new Error(
+            `OpenKey permissions entry (${service} ${space} ${path}) carries a path on a non-tinycloud: resource URI, which is not a recognized encoding`
+          );
+        }
+        expectedResource = space;
+      }
+      let matchedResource;
+      if (signedCaps[expectedResource] !== void 0) {
+        matchedResource = expectedResource;
+      } else {
+        throw new Error(
+          `OpenKey permissions entry (${service} ${space} ${path}) claims grants not confirmed in signedMessage capabilities`
+        );
+      }
+      const grantedActionsForResource = new Set(
+        Object.keys(signedCaps[matchedResource])
+      );
+      for (const action of actions) {
+        if (typeof action !== "string" || !action) {
+          throw new Error(
+            `OpenKey permissions entry (${service} ${space} ${path}) has non-string action ${String(action)}`
+          );
+        }
+        if (!grantedActionsForResource.has(action)) {
+          throw new Error(
+            `OpenKey permissions entry (${service} ${space} ${path}) claims action ${action} not present in signedMessage capabilities`
+          );
+        }
+        permissionPairsCovered.add(`${matchedResource}\0${action}`);
+      }
+    }
+    if (allSignedGrantedPairs.size > 0) {
+      const missingFromPerms = [];
+      for (const pair of allSignedGrantedPairs) {
+        if (!permissionPairsCovered.has(pair)) {
+          missingFromPerms.push(pair);
+        }
+      }
+      if (missingFromPerms.length > 0) {
+        const previewLimit = 5;
+        const preview = missingFromPerms.slice(0, previewLimit).map((p) => p.replace("\0", "::")).join(", ");
+        const overflow = missingFromPerms.length > previewLimit ? ` (and ${missingFromPerms.length - previewLimit} more)` : "";
+        throw new Error(
+          `OpenKey permissions is missing entries for signedMessage capabilities: ${preview}${overflow}`
+        );
+      }
+      const extrasInPerms = [];
+      for (const pair of permissionPairsCovered) {
+        if (!allSignedGrantedPairs.has(pair)) {
+          extrasInPerms.push(pair);
+        }
+      }
+      if (extrasInPerms.length > 0) {
+        const previewLimit = 5;
+        const preview = extrasInPerms.slice(0, previewLimit).map((p) => p.replace("\0", "::")).join(", ");
+        const overflow = extrasInPerms.length > previewLimit ? ` (and ${extrasInPerms.length - previewLimit} more)` : "";
+        throw new Error(
+          `OpenKey permissions contains entries not present in the signed authority: ${preview}${overflow}`
+        );
+      }
+    }
+    void nonRequiredGrantedPairs;
+    return this.signInWithPreparedSession(
+      {
+        siwe: result.signedMessage,
+        jwk: prepared.jwk,
+        spaceId: prepared.spaceId,
+        verificationMethod: prepared.verificationMethod
+      },
+      result.signature,
+      keyId,
+      jwk
+    );
+  }
   /**
    * Clear persisted session data.
    */
@@ -1439,7 +1872,7 @@ function createWasmKeyProvider(sessionManager) {
 // src/delegateToHelpers.ts
 import {
   parseExpiry,
-  SiweMessage,
+  SiweMessage as SiweMessage2,
   EXPIRY as EXPIRY2
 } from "@tinycloud/sdk-core";
 function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
@@ -1488,7 +1921,7 @@ function resolveExpiryMs(expiry) {
   return parseExpiry(expiry);
 }
 function extractSiweExpiration(siwe) {
-  const parsed = new SiweMessage(siwe);
+  const parsed = new SiweMessage2(siwe);
   if (parsed.expirationTime === void 0 || parsed.expirationTime === null) {
     return void 0;
   }
@@ -2000,7 +2433,9 @@ function base64UrlDecode(value) {
   return new Uint8Array(bytes);
 }
 async function signJwtInputWithJwk(signingInput, jwk) {
-  const bytes = new TextEncoder().encode(signingInput);
+  return signBytesWithJwk(new TextEncoder().encode(signingInput), jwk);
+}
+async function signBytesWithJwk(bytes, jwk) {
   try {
     const subtle = globalThis.crypto?.subtle;
     if (!subtle) {
@@ -2081,6 +2516,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._baseSecrets = /* @__PURE__ */ new Map();
     this._secrets = /* @__PURE__ */ new Map();
     this.runtimePermissionGrants = [];
+    /**
+     * Owned space ids this sign-in has already confirmed are hosted. Consulted by
+     * {@link ensureOwnedSpaceHostedById}; cleared on every {@link signIn} because
+     * hosting is confirmed against the session that was active at the time.
+     */
+    this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -2091,7 +2532,10 @@ var _TinyCloudNode = class _TinyCloudNode {
      * Outcome of the last signIn()'s account-bootstrap attempt. `skipped` is
      * true when bootstrap did not complete (interactive signer, auto-sign
      * denied, or a bootstrap step failed); `reason` carries the cause so apps
-     * can surface a "finish account setup" call-to-action.
+     * can surface a "finish account setup" call-to-action. `warnings` is
+     * present when bootstrap completed, but one or more steps recovered from
+     * an ambiguous failure (e.g. a KV batch write reconciled via per-space
+     * fallback) — clean vs. recovered runs are otherwise byte-identical.
      */
     this._bootstrapStatus = {
       skipped: false
@@ -2477,6 +2921,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
+    this.confirmedHostedSpaceIds.clear();
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
     const oldGraph = this._serviceGraph;
@@ -2531,7 +2976,13 @@ var _TinyCloudNode = class _TinyCloudNode {
       return false;
     }
     try {
-      await this.runAccountBootstrap(steps);
+      const warnings = await this.runAccountBootstrap(steps);
+      if (warnings.length > 0) {
+        this._bootstrapStatus = { skipped: false, warnings };
+        this.notificationHandler.warning(
+          `Account bootstrap completed with warnings: ${warnings.map((w) => `${w.stepId} (${w.kind}: ${w.code})`).join("; ")}`
+        );
+      }
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       this._bootstrapSkipped = true;
@@ -2580,6 +3031,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const auth = this.auth;
     const sessions = /* @__PURE__ */ new Map();
     const rawAbilitiesBySpace = /* @__PURE__ */ new Map();
+    const warnings = [];
     const primarySession = auth.tinyCloudSession;
     const defaultSpaceId = this.ownedSpaceId("default");
     const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === BOOTSTRAP_SESSION_REQUESTS.default;
@@ -2641,32 +3093,45 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
       }
       if (step.kind === "seed-spaces") {
-        for (const space of step.spaces) {
-          const registered = await this.account.spaces.register({
+        const registered = await this.account.spaces.registerBatch(
+          step.spaces.map((space) => ({
             spaceId: space.spaceId,
             name: space.name,
             ownerDid: this.did,
             type: "owned",
             permissions: ["*"],
             status: "active"
+          }))
+        );
+        if (!registered.ok) {
+          throw new Error(
+            `Failed to seed account spaces: ${registered.error.message}`
+          );
+        }
+        const batchError = registered.data.recoveredFromBatchError;
+        if (batchError) {
+          warnings.push({
+            stepId: step.id,
+            kind: "batch-write-reconciled",
+            code: batchError.code,
+            message: batchError.message
           });
-          if (!registered.ok) {
-            throw new Error(
-              `Failed to seed account space ${space.spaceId}: ${registered.error.message}`
-            );
-          }
         }
       }
       if (step.kind === "seed-applications") {
         const registered = await this.account.applications.register(
-          step.manifests.length > 0 ? [...step.manifests] : TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST
+          step.manifests.length > 0 ? [...step.manifests] : TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+          // Bootstrap only runs on an account with no registry records, so the
+          // manifest-hash pre-read is definitionally a miss. Skip it; the write
+          // it guards is an INSERT OR REPLACE and is safe to repeat.
+          { assumeUnregistered: true }
         );
         if (!registered.ok) {
           throw new Error(`Failed to seed bootstrap applications: ${registered.error.message}`);
         }
       }
       if (step.kind === "encryption-network-create") {
-        await this.ensureEncryptionNetwork(step.networkId);
+        await this.ensureEncryptionNetwork(step.networkId, { assumeMissing: true });
       }
       if (step.kind === "secret-records-schema") {
         const db = this.sqlForSpace(step.spaceId).db(step.database);
@@ -2686,6 +3151,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
       }
     }
+    return warnings;
   }
   registerBootstrapRuntimeGrant(session, request, rawAbilities) {
     const operations = [];
@@ -2945,6 +3411,22 @@ var _TinyCloudNode = class _TinyCloudNode {
       await this.ensureEncryptionNetwork(networkId);
     }
   }
+  /**
+   * Ensure one of this user's owned spaces is hosted, at most once per space
+   * per sign-in.
+   *
+   * Account bootstrap funnels six calls through here (via
+   * `AccountService.ensureAccountSpaceHosted`), and each one re-submits
+   * `activateSessionWithHost` with the *primary* session. That session's recap
+   * covers only `default` and `secrets`, so the account space appears in
+   * neither `activated` nor `skipped` and the guard below returns immediately
+   * — the repeat calls cannot change the outcome, they only cost round trips.
+   *
+   * The memo is per sign-in ({@link confirmedHostedSpaceIds} is cleared in
+   * `signIn`) and only records confirmed successes. A wrong skip is
+   * self-revealing: the next write to the space fails immediately and loudly
+   * with `404 Space not found`.
+   */
   async ensureOwnedSpaceHostedById(spaceId) {
     if (!this.auth) {
       throw new Error("Owned space hosting requires wallet mode");
@@ -2953,12 +3435,16 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       throw new Error("Owned space hosting requires an active session");
     }
+    if (this.confirmedHostedSpaceIds.has(spaceId)) {
+      return;
+    }
     const host = this.hosts[0] ?? this.config.host;
     if (!host) {
       throw new Error("Owned space hosting requires a TinyCloud host");
     }
     const activation = await activateSessionWithHost2(host, session.delegationHeader);
     if (activation.success && !activation.skipped?.includes(spaceId)) {
+      this.confirmedHostedSpaceIds.add(spaceId);
       return;
     }
     if (!activation.success && activation.status !== 404) {
@@ -2977,6 +3463,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         `Failed to activate session after creating owned space ${spaceId}: ${retry.error ?? "space was skipped"}`
       );
     }
+    this.confirmedHostedSpaceIds.add(spaceId);
   }
   /**
    * Host one of this user's owned spaces by name (e.g. `"applications"`).
@@ -3292,6 +3779,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._delegationManager = stagedGraph.delegationManager;
     this._spaceService = stagedGraph.spaceService;
     this._serviceGraph = stagedGraph.graph;
+    this._activeServiceSession = serviceSession;
     this._baseSecrets = /* @__PURE__ */ new Map();
     this._secrets = /* @__PURE__ */ new Map();
     this._publicKV = void 0;
@@ -3299,6 +3787,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.tc = stagedGraph.core;
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
+    this.confirmedHostedSpaceIds.clear();
     if (this.auth) {
       this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost]);
       this._restoredTcSession = void 0;
@@ -3608,6 +4097,28 @@ var _TinyCloudNode = class _TinyCloudNode {
   currentTinyCloudSession() {
     return this.auth?.tinyCloudSession ?? this._restoredTcSession;
   }
+  /**
+   * Mint a multi-capability invocation through the established session key.
+   * Callers receive only the signed headers; session key material remains
+   * owned by the session manager and is never part of the caller contract.
+   */
+  invokeAny(entries, facts) {
+    const session = this.currentTinyCloudSession() ?? this._activeServiceSession;
+    if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
+    return this._serviceGraph.invokeAny(session, entries, facts);
+  }
+  /** Sign protocol bytes with the established in-memory session key. */
+  async signSessionBytes(bytes) {
+    const session = this.currentTinyCloudSession() ?? this._activeServiceSession;
+    if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
+    return signBytesWithJwk(bytes, session.jwk);
+  }
+  /** Bind a session-signed invocation to the canonical service audience. */
+  async bindInvocationAudience(authorization, audience) {
+    const session = this.currentTinyCloudSession() ?? this._activeServiceSession;
+    if (session === void 0) throw new Error("Not signed in. Call signIn() first.");
+    return rewriteInvocationAudience(authorization, audience, session.jwk);
+  }
   /**
    * Connect a wallet to upgrade from session-only mode to wallet mode.
    *
@@ -3789,6 +4300,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (this._serviceContext) {
       const spaceScopedContext = this._serviceGraph.track(new ServiceContext2({
         invoke: this._serviceContext.invoke,
+        invokeAny: this._serviceContext.invokeAny,
         fetch: this._serviceContext.fetch,
         hosts: this._serviceContext.hosts,
         telemetry: this.config.telemetry
@@ -3881,7 +4393,17 @@ var _TinyCloudNode = class _TinyCloudNode {
       verifyNodeSignature: (nodeId, message, signature) => verifyDidKeyEd25519Signature(nodeId, message, signature)
     };
   }
+  /**
+   * The node DID for {@link config.host}.
+   *
+   * Sign-in already performs `GET /info` for the protocol-version check, and
+   * that response carries `nodeId`, so reuse it rather than fetching `/info` a
+   * second time. Only a value recorded for this exact host qualifies; older
+   * nodes that omit `nodeId` fall through to the fetch.
+   */
   async fetchNodeId() {
+    const cached = this.auth?.nodeIdForHost(this.config.host);
+    if (cached) return cached;
     const response = await fetch(`${this.config.host}/info`);
     if (!response.ok) {
       throw new Error(`Failed to fetch node info: HTTP ${response.status}`);
@@ -4444,6 +4966,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       shareUrl: input.shareUrl,
       documentName: input.documentName,
       jti: base64UrlEncode(crypto.getRandomValues(new Uint8Array(16))),
+      idempotencyKey: input.idempotencyKey,
       expiresAt: input.expiresAt
     };
     const requestBodyDigest = base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalizeEncryptionJson(body)))));
@@ -4653,6 +5176,13 @@ var _TinyCloudNode = class _TinyCloudNode {
         body
       )
     });
+    if (response.status === 409) {
+      const existing = await this.getEncryptionNetwork(networkId);
+      if (existing) return existing;
+      throw new Error(
+        `Encryption network ${networkId} already exists but could not be read back`
+      );
+    }
     if (!response.ok) {
       throw new Error(
         `Failed to create encryption network ${networkId}: HTTP ${response.status} ${await response.text()}`
@@ -4661,11 +5191,19 @@ var _TinyCloudNode = class _TinyCloudNode {
     const created = await response.json();
     return created.descriptor;
   }
-  async ensureEncryptionNetwork(nameOrNetworkId = DEFAULT_ENCRYPTION_NETWORK_NAME) {
+  /**
+   * Ensure an encryption network exists, creating it if necessary.
+   *
+   * @param nameOrNetworkId - Network name or full `urn:tinycloud:encryption:` id.
+   * @param options - See {@link EnsureEncryptionNetworkOptions}.
+   */
+  async ensureEncryptionNetwork(nameOrNetworkId = DEFAULT_ENCRYPTION_NETWORK_NAME, options = {}) {
     const networkId = nameOrNetworkId.startsWith("urn:tinycloud:encryption:") ? nameOrNetworkId : this.getDefaultEncryptionNetworkId(nameOrNetworkId);
-    const existing = await this.getEncryptionNetwork(networkId);
-    if (existing) {
-      return existing;
+    if (!options.assumeMissing) {
+      const existing = await this.getEncryptionNetwork(networkId);
+      if (existing) {
+        return existing;
+      }
     }
     const parsed = parseNetworkId2(networkId);
     if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {