@tinycloud/node-sdk 2.11.0-beta.10 → 2.11.0-beta.11

package/dist/{core-BypriIWK.d.cts → core-9mWw3N8i.d.cts}

@@ -239,7 +239,7 @@ interface NodeUserAuthorizationConfig {
     manifest?: Manifest | Manifest[];
     /** Pre-composed manifest request. Takes precedence over `manifest`. */
     capabilityRequest?: ComposedManifestRequest;
-    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    /** Include canonical account registry read/create-update/list permissions when composing `manifest` and plain sign-in. Default true. */
     includeAccountRegistryPermissions?: boolean;
 }
 interface CreateBootstrapSessionOptions {
@@ -975,6 +975,9 @@ declare class DelegatedAccess {
  * ```
  */
 
+declare const BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
+declare const BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
+declare const ACCEPTED_MARKER_VERSIONS: readonly number[];
 /** Input for {@link TinyCloudNode.readSecret}. The target space is required. */
 interface SecretReadInput {
     /** Explicit full space URI or an owned-space name. */
@@ -1104,7 +1107,7 @@ interface TinyCloudNodeConfig {
     manifest?: Manifest | Manifest[];
     /** Pre-composed manifest request. Takes precedence over `manifest`. */
     capabilityRequest?: ComposedManifestRequest;
-    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    /** Include account bootstrap support in plain sessions and implicit manifest permissions. Default true. */
     includeAccountRegistryPermissions?: boolean;
     /** Run canonical first-account bootstrap when fresh account state is detected. Default true. */
     autoBootstrapAccount?: boolean;
@@ -1190,6 +1193,12 @@ interface BootstrapWarning {
     /** Human-readable detail. Diagnostics only — never parse this. */
     message: string;
 }
+/** Durable attestation that the canonical account bootstrap ceremony completed. */
+interface BootstrapCompletionMarker {
+    v: number;
+    stepIds: string[];
+    completedAt: string;
+}
 declare class TinyCloudNode {
     /** @internal Registered by importing @tinycloud/node-sdk (not /core) */
     private static nodeDefaults?;
@@ -1258,9 +1267,12 @@ declare class TinyCloudNode {
     private _bootstrapSkipped;
     /**
      * Outcome of the last signIn()'s account-bootstrap attempt. `skipped` is
-     * true when bootstrap did not complete (interactive signer, auto-sign
-     * denied, or a bootstrap step failed); `reason` carries the cause so apps
-     * can surface a "finish account setup" call-to-action. `warnings` is
+     * true when bootstrap did not complete in this invocation (interactive signer,
+     * auto-bootstrap disabled, already provisioned, or a decision/provisioning
+     * step failed). `already-provisioned` means the bootstrap was not run here;
+     * it does not mean a prior provisioning attempt failed to complete.
+     * `reason` carries the cause so apps can surface a "finish account setup"
+     * call-to-action. `warnings` is
      * present when bootstrap completed, but one or more steps recovered from
      * an ambiguous failure (e.g. a KV batch write reconciled via per-space
      * fallback) — clean vs. recovered runs are otherwise byte-identical.
@@ -1396,7 +1408,11 @@ declare class TinyCloudNode {
     signIn(options?: SignInOptions): Promise<void>;
     private ownedSpaceId;
     private bootstrapAccountIfNeeded;
-    private isFreshBootstrapAccount;
+    private resolveBootstrapDecision;
+    private readBootstrapCompletionMarker;
+    private writeBootstrapCompletionMarker;
+    private isAcceptedBootstrapCompletionMarker;
+    private markerReadIsUnhostedSpace;
     private runAccountBootstrap;
     private registerBootstrapRuntimeGrant;
     /**
@@ -2301,6 +2317,13 @@ declare class TinyCloudNode {
         disableSubDelegation?: boolean;
         /** Expiration time in milliseconds from now (must be before parent's expiry) */
         expiryMs?: number;
+        /** Explicit multi-resource projection, including encryption networks. */
+        resources?: Array<{
+            service: string;
+            space?: string;
+            path: string;
+            actions: string[];
+        }>;
     }): Promise<PortableDelegation>;
 }
 
@@ -2412,4 +2435,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { type AuthDelegationArtifact as A, type BootstrapWarning as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimeDelegationActivator as g, type RuntimePermissionGrantOptions as h, type SecretReadInput as i, type SecretReadResult as j, type SignStrategy as k, type TinyCloudNodeConfig as l, type WasmKeyProviderConfig as m, activateValidatedRuntimeDelegation as n, createWasmKeyProvider as o, defaultSignStrategy as p, deserializeDelegation as q, grantAuthRequest as r, serializeDelegation as s };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type DelegateToResult as f, DelegatedAccess as g, type DelegationAuthority as h, NodeUserAuthorization as i, type NodeUserAuthorizationConfig as j, type RuntimeDelegationActivator as k, type RuntimePermissionGrantOptions as l, type SecretReadInput as m, type SecretReadResult as n, type SignStrategy as o, type TinyCloudNodeConfig as p, type WasmKeyProviderConfig as q, activateValidatedRuntimeDelegation as r, createWasmKeyProvider as s, defaultSignStrategy as t, deserializeDelegation as u, grantAuthRequest as v, serializeDelegation as w };

package/dist/{core-BypriIWK.d.ts → core-9mWw3N8i.d.ts}

@@ -239,7 +239,7 @@ interface NodeUserAuthorizationConfig {
     manifest?: Manifest | Manifest[];
     /** Pre-composed manifest request. Takes precedence over `manifest`. */
     capabilityRequest?: ComposedManifestRequest;
-    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    /** Include canonical account registry read/create-update/list permissions when composing `manifest` and plain sign-in. Default true. */
     includeAccountRegistryPermissions?: boolean;
 }
 interface CreateBootstrapSessionOptions {
@@ -975,6 +975,9 @@ declare class DelegatedAccess {
  * ```
  */
 
+declare const BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
+declare const BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
+declare const ACCEPTED_MARKER_VERSIONS: readonly number[];
 /** Input for {@link TinyCloudNode.readSecret}. The target space is required. */
 interface SecretReadInput {
     /** Explicit full space URI or an owned-space name. */
@@ -1104,7 +1107,7 @@ interface TinyCloudNodeConfig {
     manifest?: Manifest | Manifest[];
     /** Pre-composed manifest request. Takes precedence over `manifest`. */
     capabilityRequest?: ComposedManifestRequest;
-    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    /** Include account bootstrap support in plain sessions and implicit manifest permissions. Default true. */
     includeAccountRegistryPermissions?: boolean;
     /** Run canonical first-account bootstrap when fresh account state is detected. Default true. */
     autoBootstrapAccount?: boolean;
@@ -1190,6 +1193,12 @@ interface BootstrapWarning {
     /** Human-readable detail. Diagnostics only — never parse this. */
     message: string;
 }
+/** Durable attestation that the canonical account bootstrap ceremony completed. */
+interface BootstrapCompletionMarker {
+    v: number;
+    stepIds: string[];
+    completedAt: string;
+}
 declare class TinyCloudNode {
     /** @internal Registered by importing @tinycloud/node-sdk (not /core) */
     private static nodeDefaults?;
@@ -1258,9 +1267,12 @@ declare class TinyCloudNode {
     private _bootstrapSkipped;
     /**
      * Outcome of the last signIn()'s account-bootstrap attempt. `skipped` is
-     * true when bootstrap did not complete (interactive signer, auto-sign
-     * denied, or a bootstrap step failed); `reason` carries the cause so apps
-     * can surface a "finish account setup" call-to-action. `warnings` is
+     * true when bootstrap did not complete in this invocation (interactive signer,
+     * auto-bootstrap disabled, already provisioned, or a decision/provisioning
+     * step failed). `already-provisioned` means the bootstrap was not run here;
+     * it does not mean a prior provisioning attempt failed to complete.
+     * `reason` carries the cause so apps can surface a "finish account setup"
+     * call-to-action. `warnings` is
      * present when bootstrap completed, but one or more steps recovered from
      * an ambiguous failure (e.g. a KV batch write reconciled via per-space
      * fallback) — clean vs. recovered runs are otherwise byte-identical.
@@ -1396,7 +1408,11 @@ declare class TinyCloudNode {
     signIn(options?: SignInOptions): Promise<void>;
     private ownedSpaceId;
     private bootstrapAccountIfNeeded;
-    private isFreshBootstrapAccount;
+    private resolveBootstrapDecision;
+    private readBootstrapCompletionMarker;
+    private writeBootstrapCompletionMarker;
+    private isAcceptedBootstrapCompletionMarker;
+    private markerReadIsUnhostedSpace;
     private runAccountBootstrap;
     private registerBootstrapRuntimeGrant;
     /**
@@ -2301,6 +2317,13 @@ declare class TinyCloudNode {
         disableSubDelegation?: boolean;
         /** Expiration time in milliseconds from now (must be before parent's expiry) */
         expiryMs?: number;
+        /** Explicit multi-resource projection, including encryption networks. */
+        resources?: Array<{
+            service: string;
+            space?: string;
+            path: string;
+            actions: string[];
+        }>;
     }): Promise<PortableDelegation>;
 }
 
@@ -2412,4 +2435,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { type AuthDelegationArtifact as A, type BootstrapWarning as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimeDelegationActivator as g, type RuntimePermissionGrantOptions as h, type SecretReadInput as i, type SecretReadResult as j, type SignStrategy as k, type TinyCloudNodeConfig as l, type WasmKeyProviderConfig as m, activateValidatedRuntimeDelegation as n, createWasmKeyProvider as o, defaultSignStrategy as p, deserializeDelegation as q, grantAuthRequest as r, serializeDelegation as s };
+export { ACCEPTED_MARKER_VERSIONS as A, BOOTSTRAP_COMPLETION_MARKER_KEY as B, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthDelegationArtifact as a, type AuthRequestArtifact as b, BOOTSTRAP_COMPLETION_MARKER_VERSION as c, type BootstrapCompletionMarker as d, type BootstrapWarning as e, type DelegateToResult as f, DelegatedAccess as g, type DelegationAuthority as h, NodeUserAuthorization as i, type NodeUserAuthorizationConfig as j, type RuntimeDelegationActivator as k, type RuntimePermissionGrantOptions as l, type SecretReadInput as m, type SecretReadResult as n, type SignStrategy as o, type TinyCloudNodeConfig as p, type WasmKeyProviderConfig as q, activateValidatedRuntimeDelegation as r, createWasmKeyProvider as s, defaultSignStrategy as t, deserializeDelegation as u, grantAuthRequest as v, serializeDelegation as w };

package/dist/core.cjs

@@ -371,6 +371,16 @@ function addRawAbility(rawAbilities, resource, action) {
     actions.push(action);
   }
 }
+function cloneAbilitiesMap(actions) {
+  return Object.fromEntries(
+    Object.entries(actions).map(([service, paths]) => [
+      service,
+      Object.fromEntries(
+        Object.entries(paths).map(([path, pathActions]) => [path, [...pathActions]])
+      )
+    ])
+  );
+}
 var NodeUserAuthorization = class {
   constructor(config) {
     this.activeSessionKeyId = "default";
@@ -642,23 +652,41 @@ var NodeUserAuthorization = class {
       const defaultNetworkId = this.defaultEncryptionNetworkId(address, chainId);
       const primarySpaceId2 = (0, import_sdk_core3.makePkhSpaceId)(address, chainId, this.spacePrefix);
       const secretsSpaceId = (0, import_sdk_core3.makePkhSpaceId)(address, chainId, "secrets");
-      return {
-        abilities: this.defaultActions,
-        spaceId: primarySpaceId2,
-        spaceAbilities: {
-          [primarySpaceId2]: this.defaultActions,
-          [secretsSpaceId]: {
-            kv: {
-              "vault/secrets/": [
-                import_sdk_core3.KV.GET,
-                import_sdk_core3.KV.PUT,
-                import_sdk_core3.KV.DEL,
-                import_sdk_core3.KV.LIST,
-                import_sdk_core3.KV.METADATA
-              ]
+      const primaryActions = this.includeAccountRegistryPermissions && this.spacePrefix === import_sdk_core3.ACCOUNT_REGISTRY_SPACE ? cloneAbilitiesMap(this.defaultActions) : this.defaultActions;
+      const spaceAbilities2 = {
+        [primarySpaceId2]: primaryActions,
+        [secretsSpaceId]: {
+          kv: {
+            "vault/secrets/": [
+              import_sdk_core3.KV.GET,
+              import_sdk_core3.KV.PUT,
+              import_sdk_core3.KV.DEL,
+              import_sdk_core3.KV.LIST,
+              import_sdk_core3.KV.METADATA
+            ]
+          }
+        }
+      };
+      if (this.includeAccountRegistryPermissions && this.spacePrefix !== import_sdk_core3.ACCOUNT_REGISTRY_SPACE) {
+        spaceAbilities2[(0, import_sdk_core3.makePkhSpaceId)(address, chainId, import_sdk_core3.ACCOUNT_REGISTRY_SPACE)] = (0, import_sdk_core3.resourceCapabilitiesToAbilitiesMap)(import_sdk_core3.ACCOUNT_MANIFEST_PERMISSIONS);
+      } else if (this.includeAccountRegistryPermissions) {
+        const accountAbilities = (0, import_sdk_core3.resourceCapabilitiesToAbilitiesMap)(
+          import_sdk_core3.ACCOUNT_MANIFEST_PERMISSIONS
+        );
+        for (const [service, paths] of Object.entries(accountAbilities)) {
+          const existingPaths = primaryActions[service] ?? (primaryActions[service] = {});
+          for (const [path, actions] of Object.entries(paths)) {
+            const existingActions = existingPaths[path] ?? (existingPaths[path] = []);
+            for (const action of actions) {
+              if (!existingActions.includes(action)) existingActions.push(action);
             }
           }
-        },
+        }
+      }
+      return {
+        abilities: primaryActions,
+        spaceId: primarySpaceId2,
+        spaceAbilities: spaceAbilities2,
         rawAbilities: {
           [defaultNetworkId]: [DECRYPT_ACTION, NETWORK_CREATE_ACTION]
         }
@@ -2125,6 +2153,9 @@ var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
 var NETWORK_CREATE_ACTION2 = import_sdk_core8.ENCRYPTION.NETWORK_CREATE;
 var DECRYPT_ACTION2 = import_sdk_core8.ENCRYPTION.DECRYPT;
+var BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
+var BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
+var ACCEPTED_MARKER_VERSIONS = [BOOTSTRAP_COMPLETION_MARKER_VERSION];
 var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
 function isSecretPayload(value) {
   return typeof value === "object" && value !== null && "value" in value && typeof value.value === "string" && "createdAt" in value && typeof value.createdAt === "string" && "updatedAt" in value && typeof value.updatedAt === "string";
@@ -2532,9 +2563,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._bootstrapSkipped = false;
     /**
      * Outcome of the last signIn()'s account-bootstrap attempt. `skipped` is
-     * true when bootstrap did not complete (interactive signer, auto-sign
-     * denied, or a bootstrap step failed); `reason` carries the cause so apps
-     * can surface a "finish account setup" call-to-action. `warnings` is
+     * true when bootstrap did not complete in this invocation (interactive signer,
+     * auto-bootstrap disabled, already provisioned, or a decision/provisioning
+     * step failed). `already-provisioned` means the bootstrap was not run here;
+     * it does not mean a prior provisioning attempt failed to complete.
+     * `reason` carries the cause so apps can surface a "finish account setup"
+     * call-to-action. `warnings` is
      * present when bootstrap completed, but one or more steps recovered from
      * an ambiguous failure (e.g. a KV batch write reconciled via per-space
      * fallback) — clean vs. recovered runs are otherwise byte-identical.
@@ -2717,7 +2751,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: config.nonce,
       siweConfig: config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? config.includeAccountRegistryPermissions === false ? import_sdk_core8.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : config.includeAccountRegistryPermissions
     });
     this.tc = new import_sdk_core8.TinyCloud(this.auth, {
@@ -2960,6 +2994,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._bootstrapSkipped = false;
     this._bootstrapStatus = { skipped: false };
     if (this.config.autoBootstrapAccount === false) {
+      this._bootstrapStatus = { skipped: true, reason: "auto-bootstrap-disabled" };
       return false;
     }
     if (!this.auth || !this._address) {
@@ -2974,11 +3009,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       return false;
     }
     const steps = (0, import_sdk_core8.bootstrapSteps)(this._address, this._chainId);
-    if (!await this.isFreshBootstrapAccount(steps)) {
-      return false;
-    }
     try {
-      const warnings = await this.runAccountBootstrap(steps);
+      const decision = await this.resolveBootstrapDecision(steps);
+      if (decision.action === "skip") {
+        this._bootstrapStatus = { skipped: true, reason: "already-provisioned" };
+        return false;
+      }
+      const warnings = await this.runAccountBootstrap(steps, { mode: decision.mode });
+      await this.writeBootstrapCompletionMarker(steps);
       if (warnings.length > 0) {
         this._bootstrapStatus = { skipped: false, warnings };
         this.notificationHandler.warning(
@@ -2997,32 +3035,92 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return true;
   }
-  async isFreshBootstrapAccount(steps) {
+  async resolveBootstrapDecision(steps) {
     const enshrinedSpaceIds = /* @__PURE__ */ new Set();
     for (const step of steps) {
       if (step.kind === "session") {
         enshrinedSpaceIds.add(step.spaceId);
       }
     }
-    const skipped = this.auth.lastActivationSkippedSpaceIds;
+    const auth = this.auth;
+    if (!auth) {
+      throw new Error("Account bootstrap requires an active wallet session");
+    }
+    const skipped = auth.lastActivationSkippedSpaceIds;
     if (skipped.some((spaceId) => enshrinedSpaceIds.has(spaceId))) {
-      return true;
+      return { action: "run", mode: "fresh" };
     }
     try {
-      const indexed = await this.account.index.spaces.list();
-      if (indexed.ok && indexed.data.length === 0) {
-        return true;
+      const accountSpaceId = this.ownedSpaceId(import_sdk_core8.ACCOUNT_REGISTRY_SPACE);
+      const markerPermission = {
+        service: "tinycloud.kv",
+        space: accountSpaceId,
+        path: BOOTSTRAP_COMPLETION_MARKER_KEY,
+        actions: ["get"]
+      };
+      if (!this.hasRuntimePermissions([markerPermission])) {
+        return { action: "run", mode: "repair" };
       }
-    } catch {
+      const marker = await this.readBootstrapCompletionMarker();
+      if (marker.ok) {
+        if (this.isAcceptedBootstrapCompletionMarker(marker.data.data)) {
+          return { action: "skip" };
+        }
+        return { action: "run", mode: "repair" };
+      }
+      if (marker.error.code === import_sdk_core8.ErrorCodes.KV_NOT_FOUND && this.markerReadIsUnhostedSpace(marker.error.meta)) {
+        return { action: "run", mode: "fresh" };
+      }
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      this.notificationHandler.warning(
+        `Account bootstrap decision failed; attempting one bounded repair: ${reason}`
+      );
+      console.warn(`[TinyCloudNode] account bootstrap decision failed: ${reason}`);
+      return { action: "run", mode: "repair" };
     }
-    try {
-      const spaces = await this.account.spaces.list();
-      return spaces.ok && spaces.data.length === 0;
-    } catch {
-      return false;
+    return { action: "run", mode: "repair" };
+  }
+  async readBootstrapCompletionMarker() {
+    return this.kvForSpace(this.ownedSpaceId(import_sdk_core8.ACCOUNT_REGISTRY_SPACE)).get(
+      BOOTSTRAP_COMPLETION_MARKER_KEY
+    );
+  }
+  async writeBootstrapCompletionMarker(steps) {
+    if (!this._address) {
+      throw new Error("Bootstrap completion marker requires an active wallet session");
     }
+    const canonicalStepIds = new Set(
+      (0, import_sdk_core8.bootstrapSteps)(this._address, this._chainId).map((step) => step.id)
+    );
+    const providedStepIds = new Set(steps.map((step) => step.id));
+    if (canonicalStepIds.size !== providedStepIds.size || [...canonicalStepIds].some((stepId) => !providedStepIds.has(stepId))) {
+      throw new Error("Bootstrap completion marker requires the canonical bootstrap step set");
+    }
+    const marker = {
+      v: BOOTSTRAP_COMPLETION_MARKER_VERSION,
+      stepIds: [...canonicalStepIds],
+      completedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const written = await this.kvForSpace(this.ownedSpaceId(import_sdk_core8.ACCOUNT_REGISTRY_SPACE)).put(
+      BOOTSTRAP_COMPLETION_MARKER_KEY,
+      marker
+    );
+    if (!written.ok) {
+      throw new Error(`Failed to write bootstrap completion marker: ${written.error.message}`);
+    }
+  }
+  isAcceptedBootstrapCompletionMarker(value) {
+    if (typeof value !== "object" || value === null) return false;
+    const entries = Object.entries(value);
+    const markerValue = (name) => entries.find(([key]) => key === name)?.[1];
+    const version = markerValue("v");
+    return typeof version === "number" && Number.isInteger(version) && ACCEPTED_MARKER_VERSIONS.some((acceptedVersion) => acceptedVersion === version);
+  }
+  markerReadIsUnhostedSpace(meta) {
+    return meta?.status === 404;
   }
-  async runAccountBootstrap(steps) {
+  async runAccountBootstrap(steps, { mode } = { mode: "fresh" }) {
     if (!this.auth || !this._address) {
       throw new Error("Account bootstrap requires an active wallet session");
     }
@@ -3123,9 +3221,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (step.kind === "seed-applications") {
         const registered = await this.account.applications.register(
           step.manifests.length > 0 ? [...step.manifests] : import_sdk_core8.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
-          // Bootstrap only runs on an account with no registry records, so the
-          // manifest-hash pre-read is definitionally a miss. Skip it; the write
-          // it guards is an INSERT OR REPLACE and is safe to repeat.
+          // The write is an INSERT OR REPLACE and is safe to repeat during a
+          // repair, so skip the manifest-hash pre-read.
           { assumeUnregistered: true }
         );
         if (!registered.ok) {
@@ -3133,7 +3230,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
       }
       if (step.kind === "encryption-network-create") {
-        await this.ensureEncryptionNetwork(step.networkId, { assumeMissing: true });
+        await this.ensureEncryptionNetwork(step.networkId, { assumeMissing: mode === "fresh" });
       }
       if (step.kind === "secret-records-schema") {
         const db = this.sqlForSpace(step.spaceId).db(step.database);
@@ -4182,7 +4279,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core8.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
     });
     this.tc = new import_sdk_core8.TinyCloud(this.auth, {
@@ -4235,7 +4332,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core8.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core8.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
     });
     this.tc = new import_sdk_core8.TinyCloud(this.auth, {
@@ -6984,35 +7081,44 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (parentDelegation.disableSubDelegation) {
       throw new Error("Parent delegation does not allow sub-delegation");
     }
-    if (!params.path.startsWith(parentDelegation.path)) {
+    const parentResources = parentDelegation.resources ?? [{
+      service: parentDelegation.actions[0]?.split("/", 1)[0]?.replace(/^tinycloud\./, "") ?? "kv",
+      space: parentDelegation.spaceId,
+      path: parentDelegation.path,
+      actions: parentDelegation.actions
+    }];
+    const requestedResources = params.resources ?? [{
+      service: params.actions[0]?.split("/", 1)[0]?.replace(/^tinycloud\./, "") ?? "kv",
+      space: parentDelegation.spaceId,
+      path: params.path,
+      actions: params.actions
+    }];
+    const resourceIsContained = (parent, child) => {
+      const parentEncryption = parent.service === "encryption" || parent.service === "tinycloud.encryption";
+      const childEncryption = child.service === "encryption" || child.service === "tinycloud.encryption";
+      if (parentEncryption || childEncryption) return parentEncryption && childEncryption && parent.path === child.path && child.actions.every((action) => parent.actions.includes(action));
+      const pathContained = parent.path === child.path || parent.path.endsWith("/") && child.path.startsWith(parent.path) || child.path.startsWith(`${parent.path}/`);
+      return pathContained && child.actions.every((action) => parent.actions.includes(action));
+    };
+    if (requestedResources.length === 0 || requestedResources.some((child) => !parentResources.some((parent) => resourceIsContained(parent, child)))) {
       throw new Error(
-        `Sub-delegation path "${params.path}" must be within parent path "${parentDelegation.path}"`
+        "Sub-delegation resources exceed the received delegation"
       );
     }
-    const parentActions = new Set(parentDelegation.actions);
-    for (const action of params.actions) {
-      if (!parentActions.has(action)) {
-        throw new Error(
-          `Sub-delegation action "${action}" is not in parent's actions: ${parentDelegation.actions.join(", ")}`
-        );
-      }
-    }
     const now = /* @__PURE__ */ new Date();
     const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
     const requestedExpiry = new Date(now.getTime() + expiryMs);
     const actualExpiry = requestedExpiry > parentDelegation.expiry ? parentDelegation.expiry : requestedExpiry;
     const abilities = {};
-    const kvActions = params.actions.filter((a) => a.startsWith("tinycloud.kv/"));
-    const sqlActions = params.actions.filter((a) => a.startsWith("tinycloud.sql/"));
-    const duckdbActions = params.actions.filter((a) => a.startsWith("tinycloud.duckdb/"));
-    if (kvActions.length > 0) {
-      abilities.kv = { [params.path]: kvActions };
-    }
-    if (sqlActions.length > 0) {
-      abilities.sql = { [params.path]: sqlActions };
-    }
-    if (duckdbActions.length > 0) {
-      abilities.duckdb = { [params.path]: duckdbActions };
+    const rawAbilities = {};
+    for (const resource of requestedResources) {
+      const service = resource.service.replace(/^tinycloud\./, "");
+      if (service === "encryption") {
+        rawAbilities[resource.path] = [...resource.actions];
+        continue;
+      }
+      abilities[service] ?? (abilities[service] = {});
+      abilities[service][resource.path] = [...resource.actions];
     }
     const targetHost = parentDelegation.host ?? this.config.host;
     const prepared = this.wasmBindings.prepareSession({
@@ -7024,7 +7130,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       expirationTime: actualExpiry.toISOString(),
       spaceId: parentDelegation.spaceId,
       delegateUri: params.delegateDID,
-      parents: [parentDelegation.cid]
+      parents: [parentDelegation.cid],
+      ...Object.keys(rawAbilities).length > 0 ? { rawAbilities } : {}
     });
     const signature = await this.signer.signMessage(prepared.siwe);
     const subDelegationSession = this.wasmBindings.completeSessionSetup({
@@ -7042,14 +7149,20 @@ var _TinyCloudNode = class _TinyCloudNode {
       cid: subDelegationSession.delegationCid,
       delegationHeader: subDelegationSession.delegationHeader,
       spaceId: parentDelegation.spaceId,
-      path: params.path,
-      actions: params.actions,
+      path: requestedResources[0].path,
+      actions: requestedResources[0].actions,
       disableSubDelegation: params.disableSubDelegation ?? false,
       expiry: actualExpiry,
       delegateDID: params.delegateDID,
       ownerAddress: parentDelegation.ownerAddress,
       chainId: parentDelegation.chainId,
-      host: targetHost
+      host: targetHost,
+      resources: requestedResources.map((resource) => ({
+        service: resource.service.replace(/^tinycloud\./, ""),
+        space: resource.service.replace(/^tinycloud\./, "") === "encryption" ? "encryption" : resource.space ?? parentDelegation.spaceId,
+        path: resource.path,
+        actions: [...resource.actions]
+      }))
     };
   }
 };