@tinycloud/node-sdk 2.11.0-beta.10 → 2.11.0-beta.11

package/dist/index.cjs

@@ -17025,10 +17025,13 @@ var require_utils2 = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACCEPTED_MARKER_VERSIONS: () => ACCEPTED_MARKER_VERSIONS,
   ACCOUNT_REGISTRY_PATH: () => import_sdk_core12.ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE: () => import_sdk_core12.ACCOUNT_REGISTRY_SPACE,
   AccountService: () => import_sdk_core3.AccountService,
   AutoApproveSpaceCreationHandler: () => import_sdk_core11.AutoApproveSpaceCreationHandler,
+  BOOTSTRAP_COMPLETION_MARKER_KEY: () => BOOTSTRAP_COMPLETION_MARKER_KEY,
+  BOOTSTRAP_COMPLETION_MARKER_VERSION: () => BOOTSTRAP_COMPLETION_MARKER_VERSION,
   CapabilityKeyRegistry: () => import_sdk_core20.CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes: () => import_sdk_core20.CapabilityKeyRegistryErrorCodes,
   CaveatedDelegationUnsupportedError: () => import_sdk_core12.CaveatedDelegationUnsupportedError,
@@ -17399,6 +17402,16 @@ function addRawAbility(rawAbilities, resource, action) {
     actions.push(action);
   }
 }
+function cloneAbilitiesMap(actions) {
+  return Object.fromEntries(
+    Object.entries(actions).map(([service, paths]) => [
+      service,
+      Object.fromEntries(
+        Object.entries(paths).map(([path, pathActions]) => [path, [...pathActions]])
+      )
+    ])
+  );
+}
 var NodeUserAuthorization = class {
   constructor(config) {
     this.activeSessionKeyId = "default";
@@ -17670,23 +17683,41 @@ var NodeUserAuthorization = class {
       const defaultNetworkId = this.defaultEncryptionNetworkId(address, chainId);
       const primarySpaceId2 = (0, import_sdk_core2.makePkhSpaceId)(address, chainId, this.spacePrefix);
       const secretsSpaceId = (0, import_sdk_core2.makePkhSpaceId)(address, chainId, "secrets");
-      return {
-        abilities: this.defaultActions,
-        spaceId: primarySpaceId2,
-        spaceAbilities: {
-          [primarySpaceId2]: this.defaultActions,
-          [secretsSpaceId]: {
-            kv: {
-              "vault/secrets/": [
-                import_sdk_core2.KV.GET,
-                import_sdk_core2.KV.PUT,
-                import_sdk_core2.KV.DEL,
-                import_sdk_core2.KV.LIST,
-                import_sdk_core2.KV.METADATA
-              ]
+      const primaryActions = this.includeAccountRegistryPermissions && this.spacePrefix === import_sdk_core2.ACCOUNT_REGISTRY_SPACE ? cloneAbilitiesMap(this.defaultActions) : this.defaultActions;
+      const spaceAbilities2 = {
+        [primarySpaceId2]: primaryActions,
+        [secretsSpaceId]: {
+          kv: {
+            "vault/secrets/": [
+              import_sdk_core2.KV.GET,
+              import_sdk_core2.KV.PUT,
+              import_sdk_core2.KV.DEL,
+              import_sdk_core2.KV.LIST,
+              import_sdk_core2.KV.METADATA
+            ]
+          }
+        }
+      };
+      if (this.includeAccountRegistryPermissions && this.spacePrefix !== import_sdk_core2.ACCOUNT_REGISTRY_SPACE) {
+        spaceAbilities2[(0, import_sdk_core2.makePkhSpaceId)(address, chainId, import_sdk_core2.ACCOUNT_REGISTRY_SPACE)] = (0, import_sdk_core2.resourceCapabilitiesToAbilitiesMap)(import_sdk_core2.ACCOUNT_MANIFEST_PERMISSIONS);
+      } else if (this.includeAccountRegistryPermissions) {
+        const accountAbilities = (0, import_sdk_core2.resourceCapabilitiesToAbilitiesMap)(
+          import_sdk_core2.ACCOUNT_MANIFEST_PERMISSIONS
+        );
+        for (const [service, paths] of Object.entries(accountAbilities)) {
+          const existingPaths = primaryActions[service] ?? (primaryActions[service] = {});
+          for (const [path, actions] of Object.entries(paths)) {
+            const existingActions = existingPaths[path] ?? (existingPaths[path] = []);
+            for (const action of actions) {
+              if (!existingActions.includes(action)) existingActions.push(action);
             }
           }
-        },
+        }
+      }
+      return {
+        abilities: primaryActions,
+        spaceId: primarySpaceId2,
+        spaceAbilities: spaceAbilities2,
         rawAbilities: {
           [defaultNetworkId]: [DECRYPT_ACTION, NETWORK_CREATE_ACTION]
         }
@@ -19149,6 +19180,9 @@ var DEFAULT_HOST = "https://node.tinycloud.xyz";
 var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
 var NETWORK_CREATE_ACTION2 = import_sdk_core7.ENCRYPTION.NETWORK_CREATE;
 var DECRYPT_ACTION2 = import_sdk_core7.ENCRYPTION.DECRYPT;
+var BOOTSTRAP_COMPLETION_MARKER_KEY = "system/bootstrap/complete";
+var BOOTSTRAP_COMPLETION_MARKER_VERSION = 1;
+var ACCEPTED_MARKER_VERSIONS = [BOOTSTRAP_COMPLETION_MARKER_VERSION];
 var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
 function isSecretPayload(value) {
   return typeof value === "object" && value !== null && "value" in value && typeof value.value === "string" && "createdAt" in value && typeof value.createdAt === "string" && "updatedAt" in value && typeof value.updatedAt === "string";
@@ -19556,9 +19590,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._bootstrapSkipped = false;
     /**
      * Outcome of the last signIn()'s account-bootstrap attempt. `skipped` is
-     * true when bootstrap did not complete (interactive signer, auto-sign
-     * denied, or a bootstrap step failed); `reason` carries the cause so apps
-     * can surface a "finish account setup" call-to-action. `warnings` is
+     * true when bootstrap did not complete in this invocation (interactive signer,
+     * auto-bootstrap disabled, already provisioned, or a decision/provisioning
+     * step failed). `already-provisioned` means the bootstrap was not run here;
+     * it does not mean a prior provisioning attempt failed to complete.
+     * `reason` carries the cause so apps can surface a "finish account setup"
+     * call-to-action. `warnings` is
      * present when bootstrap completed, but one or more steps recovered from
      * an ambiguous failure (e.g. a KV batch write reconciled via per-space
      * fallback) — clean vs. recovered runs are otherwise byte-identical.
@@ -19741,7 +19778,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: config.nonce,
       siweConfig: config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? config.includeAccountRegistryPermissions === false ? import_sdk_core7.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : config.includeAccountRegistryPermissions
     });
     this.tc = new import_sdk_core7.TinyCloud(this.auth, {
@@ -19984,6 +20021,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._bootstrapSkipped = false;
     this._bootstrapStatus = { skipped: false };
     if (this.config.autoBootstrapAccount === false) {
+      this._bootstrapStatus = { skipped: true, reason: "auto-bootstrap-disabled" };
       return false;
     }
     if (!this.auth || !this._address) {
@@ -19998,11 +20036,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       return false;
     }
     const steps = (0, import_sdk_core7.bootstrapSteps)(this._address, this._chainId);
-    if (!await this.isFreshBootstrapAccount(steps)) {
-      return false;
-    }
     try {
-      const warnings = await this.runAccountBootstrap(steps);
+      const decision = await this.resolveBootstrapDecision(steps);
+      if (decision.action === "skip") {
+        this._bootstrapStatus = { skipped: true, reason: "already-provisioned" };
+        return false;
+      }
+      const warnings = await this.runAccountBootstrap(steps, { mode: decision.mode });
+      await this.writeBootstrapCompletionMarker(steps);
       if (warnings.length > 0) {
         this._bootstrapStatus = { skipped: false, warnings };
         this.notificationHandler.warning(
@@ -20021,32 +20062,92 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return true;
   }
-  async isFreshBootstrapAccount(steps) {
+  async resolveBootstrapDecision(steps) {
     const enshrinedSpaceIds = /* @__PURE__ */ new Set();
     for (const step of steps) {
       if (step.kind === "session") {
         enshrinedSpaceIds.add(step.spaceId);
       }
     }
-    const skipped = this.auth.lastActivationSkippedSpaceIds;
+    const auth = this.auth;
+    if (!auth) {
+      throw new Error("Account bootstrap requires an active wallet session");
+    }
+    const skipped = auth.lastActivationSkippedSpaceIds;
     if (skipped.some((spaceId) => enshrinedSpaceIds.has(spaceId))) {
-      return true;
+      return { action: "run", mode: "fresh" };
     }
     try {
-      const indexed = await this.account.index.spaces.list();
-      if (indexed.ok && indexed.data.length === 0) {
-        return true;
+      const accountSpaceId = this.ownedSpaceId(import_sdk_core7.ACCOUNT_REGISTRY_SPACE);
+      const markerPermission = {
+        service: "tinycloud.kv",
+        space: accountSpaceId,
+        path: BOOTSTRAP_COMPLETION_MARKER_KEY,
+        actions: ["get"]
+      };
+      if (!this.hasRuntimePermissions([markerPermission])) {
+        return { action: "run", mode: "repair" };
       }
-    } catch {
+      const marker = await this.readBootstrapCompletionMarker();
+      if (marker.ok) {
+        if (this.isAcceptedBootstrapCompletionMarker(marker.data.data)) {
+          return { action: "skip" };
+        }
+        return { action: "run", mode: "repair" };
+      }
+      if (marker.error.code === import_sdk_core7.ErrorCodes.KV_NOT_FOUND && this.markerReadIsUnhostedSpace(marker.error.meta)) {
+        return { action: "run", mode: "fresh" };
+      }
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      this.notificationHandler.warning(
+        `Account bootstrap decision failed; attempting one bounded repair: ${reason}`
+      );
+      console.warn(`[TinyCloudNode] account bootstrap decision failed: ${reason}`);
+      return { action: "run", mode: "repair" };
     }
-    try {
-      const spaces = await this.account.spaces.list();
-      return spaces.ok && spaces.data.length === 0;
-    } catch {
-      return false;
+    return { action: "run", mode: "repair" };
+  }
+  async readBootstrapCompletionMarker() {
+    return this.kvForSpace(this.ownedSpaceId(import_sdk_core7.ACCOUNT_REGISTRY_SPACE)).get(
+      BOOTSTRAP_COMPLETION_MARKER_KEY
+    );
+  }
+  async writeBootstrapCompletionMarker(steps) {
+    if (!this._address) {
+      throw new Error("Bootstrap completion marker requires an active wallet session");
+    }
+    const canonicalStepIds = new Set(
+      (0, import_sdk_core7.bootstrapSteps)(this._address, this._chainId).map((step) => step.id)
+    );
+    const providedStepIds = new Set(steps.map((step) => step.id));
+    if (canonicalStepIds.size !== providedStepIds.size || [...canonicalStepIds].some((stepId) => !providedStepIds.has(stepId))) {
+      throw new Error("Bootstrap completion marker requires the canonical bootstrap step set");
+    }
+    const marker = {
+      v: BOOTSTRAP_COMPLETION_MARKER_VERSION,
+      stepIds: [...canonicalStepIds],
+      completedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const written = await this.kvForSpace(this.ownedSpaceId(import_sdk_core7.ACCOUNT_REGISTRY_SPACE)).put(
+      BOOTSTRAP_COMPLETION_MARKER_KEY,
+      marker
+    );
+    if (!written.ok) {
+      throw new Error(`Failed to write bootstrap completion marker: ${written.error.message}`);
     }
   }
-  async runAccountBootstrap(steps) {
+  isAcceptedBootstrapCompletionMarker(value) {
+    if (typeof value !== "object" || value === null) return false;
+    const entries = Object.entries(value);
+    const markerValue = (name) => entries.find(([key2]) => key2 === name)?.[1];
+    const version23 = markerValue("v");
+    return typeof version23 === "number" && Number.isInteger(version23) && ACCEPTED_MARKER_VERSIONS.some((acceptedVersion) => acceptedVersion === version23);
+  }
+  markerReadIsUnhostedSpace(meta) {
+    return meta?.status === 404;
+  }
+  async runAccountBootstrap(steps, { mode } = { mode: "fresh" }) {
     if (!this.auth || !this._address) {
       throw new Error("Account bootstrap requires an active wallet session");
     }
@@ -20147,9 +20248,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (step.kind === "seed-applications") {
         const registered = await this.account.applications.register(
           step.manifests.length > 0 ? [...step.manifests] : import_sdk_core7.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
-          // Bootstrap only runs on an account with no registry records, so the
-          // manifest-hash pre-read is definitionally a miss. Skip it; the write
-          // it guards is an INSERT OR REPLACE and is safe to repeat.
+          // The write is an INSERT OR REPLACE and is safe to repeat during a
+          // repair, so skip the manifest-hash pre-read.
           { assumeUnregistered: true }
         );
         if (!registered.ok) {
@@ -20157,7 +20257,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
       }
       if (step.kind === "encryption-network-create") {
-        await this.ensureEncryptionNetwork(step.networkId, { assumeMissing: true });
+        await this.ensureEncryptionNetwork(step.networkId, { assumeMissing: mode === "fresh" });
       }
       if (step.kind === "secret-records-schema") {
         const db = this.sqlForSpace(step.spaceId).db(step.database);
@@ -21206,7 +21306,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core7.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
     });
     this.tc = new import_sdk_core7.TinyCloud(this.auth, {
@@ -21259,7 +21359,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
       manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
-      capabilityRequest: useBootstrapSignInRequest ? import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      capabilityRequest: useBootstrapSignInRequest ? this.config.includeAccountRegistryPermissions === false ? import_sdk_core7.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST : import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
       includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
     });
     this.tc = new import_sdk_core7.TinyCloud(this.auth, {
@@ -24008,35 +24108,44 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (parentDelegation.disableSubDelegation) {
       throw new Error("Parent delegation does not allow sub-delegation");
     }
-    if (!params.path.startsWith(parentDelegation.path)) {
+    const parentResources = parentDelegation.resources ?? [{
+      service: parentDelegation.actions[0]?.split("/", 1)[0]?.replace(/^tinycloud\./, "") ?? "kv",
+      space: parentDelegation.spaceId,
+      path: parentDelegation.path,
+      actions: parentDelegation.actions
+    }];
+    const requestedResources = params.resources ?? [{
+      service: params.actions[0]?.split("/", 1)[0]?.replace(/^tinycloud\./, "") ?? "kv",
+      space: parentDelegation.spaceId,
+      path: params.path,
+      actions: params.actions
+    }];
+    const resourceIsContained = (parent, child) => {
+      const parentEncryption = parent.service === "encryption" || parent.service === "tinycloud.encryption";
+      const childEncryption = child.service === "encryption" || child.service === "tinycloud.encryption";
+      if (parentEncryption || childEncryption) return parentEncryption && childEncryption && parent.path === child.path && child.actions.every((action) => parent.actions.includes(action));
+      const pathContained = parent.path === child.path || parent.path.endsWith("/") && child.path.startsWith(parent.path) || child.path.startsWith(`${parent.path}/`);
+      return pathContained && child.actions.every((action) => parent.actions.includes(action));
+    };
+    if (requestedResources.length === 0 || requestedResources.some((child) => !parentResources.some((parent) => resourceIsContained(parent, child)))) {
       throw new Error(
-        `Sub-delegation path "${params.path}" must be within parent path "${parentDelegation.path}"`
+        "Sub-delegation resources exceed the received delegation"
       );
     }
-    const parentActions = new Set(parentDelegation.actions);
-    for (const action of params.actions) {
-      if (!parentActions.has(action)) {
-        throw new Error(
-          `Sub-delegation action "${action}" is not in parent's actions: ${parentDelegation.actions.join(", ")}`
-        );
-      }
-    }
     const now = /* @__PURE__ */ new Date();
     const expiryMs = params.expiryMs ?? 60 * 60 * 1e3;
     const requestedExpiry = new Date(now.getTime() + expiryMs);
     const actualExpiry = requestedExpiry > parentDelegation.expiry ? parentDelegation.expiry : requestedExpiry;
     const abilities = {};
-    const kvActions = params.actions.filter((a) => a.startsWith("tinycloud.kv/"));
-    const sqlActions = params.actions.filter((a) => a.startsWith("tinycloud.sql/"));
-    const duckdbActions = params.actions.filter((a) => a.startsWith("tinycloud.duckdb/"));
-    if (kvActions.length > 0) {
-      abilities.kv = { [params.path]: kvActions };
-    }
-    if (sqlActions.length > 0) {
-      abilities.sql = { [params.path]: sqlActions };
-    }
-    if (duckdbActions.length > 0) {
-      abilities.duckdb = { [params.path]: duckdbActions };
+    const rawAbilities = {};
+    for (const resource of requestedResources) {
+      const service = resource.service.replace(/^tinycloud\./, "");
+      if (service === "encryption") {
+        rawAbilities[resource.path] = [...resource.actions];
+        continue;
+      }
+      abilities[service] ?? (abilities[service] = {});
+      abilities[service][resource.path] = [...resource.actions];
     }
     const targetHost = parentDelegation.host ?? this.config.host;
     const prepared = this.wasmBindings.prepareSession({
@@ -24048,7 +24157,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       expirationTime: actualExpiry.toISOString(),
       spaceId: parentDelegation.spaceId,
       delegateUri: params.delegateDID,
-      parents: [parentDelegation.cid]
+      parents: [parentDelegation.cid],
+      ...Object.keys(rawAbilities).length > 0 ? { rawAbilities } : {}
     });
     const signature2 = await this.signer.signMessage(prepared.siwe);
     const subDelegationSession = this.wasmBindings.completeSessionSetup({
@@ -24066,14 +24176,20 @@ var _TinyCloudNode = class _TinyCloudNode {
       cid: subDelegationSession.delegationCid,
       delegationHeader: subDelegationSession.delegationHeader,
       spaceId: parentDelegation.spaceId,
-      path: params.path,
-      actions: params.actions,
+      path: requestedResources[0].path,
+      actions: requestedResources[0].actions,
       disableSubDelegation: params.disableSubDelegation ?? false,
       expiry: actualExpiry,
       delegateDID: params.delegateDID,
       ownerAddress: parentDelegation.ownerAddress,
       chainId: parentDelegation.chainId,
-      host: targetHost
+      host: targetHost,
+      resources: requestedResources.map((resource) => ({
+        service: resource.service.replace(/^tinycloud\./, ""),
+        space: resource.service.replace(/^tinycloud\./, "") === "encryption" ? "encryption" : resource.space ?? parentDelegation.spaceId,
+        path: resource.path,
+        actions: [...resource.actions]
+      }))
     };
   }
 };
@@ -24597,10 +24713,13 @@ var import_sdk_core22 = require("@tinycloud/sdk-core");
 var import_sdk_core23 = require("@tinycloud/sdk-core");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACCEPTED_MARKER_VERSIONS,
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE,
   AccountService,
   AutoApproveSpaceCreationHandler,
+  BOOTSTRAP_COMPLETION_MARKER_KEY,
+  BOOTSTRAP_COMPLETION_MARKER_VERSION,
   CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
   CaveatedDelegationUnsupportedError,