@tinycloud/node-sdk 2.4.0-beta.9 → 2.4.1-beta.0

package/dist/index.js

@@ -17173,6 +17173,11 @@ import {
   UnsupportedFeatureError,
   makePublicSpaceId,
   ACCOUNT_REGISTRY_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS,
+  SECRET_RECORDS_SCHEMA,
+  SECRETS_SPACE as SECRETS_SPACE2,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+  bootstrapSteps,
   ENCRYPTION_PERMISSION_SERVICE as ENCRYPTION_PERMISSION_SERVICE2,
   PermissionNotInManifestError,
   SessionExpiredError,
@@ -17186,6 +17191,7 @@ import {
   verifyDidKeyEd25519Signature,
   canonicalizeAddress as canonicalizeAddress2,
   pkhDid as pkhDid2,
+  resolveTinyCloudHosts as resolveTinyCloudHosts2,
   principalDidEquals as principalDidEquals2,
   parseNetworkId as parseNetworkId2
 } from "@tinycloud/sdk-core";
@@ -17212,6 +17218,7 @@ import {
 } from "@tinycloud/sdk-core";
 
 // src/authorization/strategies.ts
+import { createOpenKeyCallbackSigningStrategy } from "@tinycloud/sdk-core";
 var defaultSignStrategy = { type: "auto-sign" };
 
 // src/storage/MemorySessionStorage.ts
@@ -17309,6 +17316,7 @@ var NodeUserAuthorization = class {
   constructor(config) {
     this.extensions = [];
     this._nodeFeatures = [];
+    this._lastActivationSkippedSpaceIds = [];
     this.wasm = config.wasmBindings;
     this.signer = config.signer;
     this.signStrategy = config.signStrategy ?? defaultSignStrategy;
@@ -17331,7 +17339,7 @@ var NodeUserAuthorization = class {
         "": [
           "tinycloud.sql/read",
           "tinycloud.sql/write",
-          "tinycloud.sql/ddl",
+          "tinycloud.sql/schema",
           "tinycloud.sql/admin",
           "tinycloud.sql/export"
         ]
@@ -17423,12 +17431,48 @@ var NodeUserAuthorization = class {
    * `siwe` is the load-bearing one because `extractSiweExpiration` returns
    * undefined for missing SIWEs and the SDK then treats the session as
    * expired-at-epoch-zero.
+   *
+   * @param hosts - The TinyCloud hosts this session was created against,
+   *   as persisted in {@link PersistedSessionData.tinycloudHosts}. When
+   *   present (and non-empty) they are adopted directly so the restored
+   *   session resolves to the same node as the original sign-in without
+   *   re-running registry/fallback resolution. When absent (old session)
+   *   hosts are resolved lazily on the first host-needing call via
+   *   {@link ensureTinyCloudHosts}.
    */
-  setRestoredTinyCloudSession(session) {
+  setRestoredTinyCloudSession(session, hosts) {
     const address = canonicalizeAddress(session.address);
     this._tinyCloudSession = { ...session, address };
     this._address = address;
     this._chainId = session.chainId;
+    if ((!this.tinycloudHosts || this.tinycloudHosts.length === 0) && hosts && hosts.length > 0) {
+      this.tinycloudHosts = [...hosts];
+    }
+  }
+  /**
+   * Ensure `tinycloudHosts` are resolved before a host-needing call.
+   *
+   * Fresh sign-in resolves hosts up front; a restored session may not have
+   * (old persisted sessions predate {@link PersistedSessionData.tinycloudHosts}).
+   * This guard makes a restored session resolve the node exactly like a fresh
+   * sign-in — persisted hosts are preferred (already set by
+   * {@link setRestoredTinyCloudSession}), otherwise the registry/fallback
+   * resolution runs lazily here. Idempotent: {@link resolveTinyCloudHostsForSignIn}
+   * early-returns when hosts are already set.
+   *
+   * Throws if hosts are unset and the restored session has no address/chainId
+   * to resolve from — a real failure that must surface, not be masked.
+   */
+  async ensureTinyCloudHosts() {
+    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
+      return;
+    }
+    if (this._address === void 0 || this._chainId === void 0) {
+      throw new Error(
+        "Cannot resolve TinyCloud hosts: no address/chainId available. Sign in or restore a session first."
+      );
+    }
+    await this.resolveTinyCloudHostsForSignIn(this._address, this._chainId);
   }
   async resolveTinyCloudHostsForSignIn(address, chainId) {
     if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
@@ -17453,6 +17497,9 @@ var NodeUserAuthorization = class {
   get nodeFeatures() {
     return this._nodeFeatures;
   }
+  get lastActivationSkippedSpaceIds() {
+    return [...this._lastActivationSkippedSpaceIds];
+  }
   /**
    * Compute the `abilities` map the WASM `prepareSession` call should
    * see at sign-in time.
@@ -17625,6 +17672,7 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession || !this._address || !this._chainId) {
       throw new Error("Must be signed in to host space");
     }
+    await this.ensureTinyCloudHosts();
     const host = this.primaryTinyCloudHost;
     const spaceId = targetSpaceId ?? this._tinyCloudSession.spaceId;
     const peerId = await fetchPeerId(host, spaceId);
@@ -17667,12 +17715,14 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession) {
       throw new Error("Must be signed in to ensure space exists");
     }
+    await this.ensureTinyCloudHosts();
     const host = this.primaryTinyCloudHost;
     const primarySpaceId = this._tinyCloudSession.spaceId;
     const result = await activateSessionWithHost(
       host,
       this._tinyCloudSession.delegationHeader
     );
+    this.recordActivationSkippedSpaces(result, primarySpaceId);
     const handler = this.spaceCreationHandler ?? (this.autoCreateSpace ? new AutoApproveSpaceCreationHandler() : void 0);
     const creationContext = {
       spaceId: primarySpaceId,
@@ -17760,6 +17810,66 @@ var NodeUserAuthorization = class {
     }
     throw new Error(`Failed to activate session: ${result.error}`);
   }
+  recordActivationSkippedSpaces(result, primarySpaceId) {
+    if (result.success) {
+      this._lastActivationSkippedSpaceIds = result.skipped ?? [];
+      return;
+    }
+    this._lastActivationSkippedSpaceIds = result.status === 404 ? [primarySpaceId] : [];
+  }
+  async createBootstrapSession(options) {
+    if (!this._address || !this._chainId) {
+      throw new Error("Must be signed in before creating bootstrap sessions");
+    }
+    const address = this._address;
+    const chainId = this._chainId;
+    const keyId = `bootstrap-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    this.sessionManager.createSessionKey(keyId);
+    const jwkString = this.sessionManager.jwk(keyId);
+    if (!jwkString) {
+      throw new Error("Failed to create bootstrap session key");
+    }
+    const jwk = JSON.parse(jwkString);
+    const now = /* @__PURE__ */ new Date();
+    const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
+    const abilities = resourceCapabilitiesToAbilitiesMap(
+      options.capabilityRequest.resources
+    );
+    const prepared = this.wasm.prepareSession({
+      abilities,
+      ...options.rawAbilities !== void 0 ? { rawAbilities: options.rawAbilities } : {},
+      address,
+      chainId,
+      domain: this.domain,
+      issuedAt: now.toISOString(),
+      expirationTime: expirationTime.toISOString(),
+      spaceId: options.spaceId,
+      jwk,
+      ...this.buildSiweOverrides()
+    });
+    const signature2 = await this.requestSignature({
+      address,
+      chainId,
+      message: prepared.siwe,
+      type: "siwe"
+    });
+    const session = this.wasm.completeSessionSetup({
+      ...prepared,
+      signature: signature2
+    });
+    return {
+      address,
+      chainId,
+      sessionKey: keyId,
+      spaceId: options.spaceId,
+      delegationCid: session.delegationCid,
+      delegationHeader: session.delegationHeader,
+      verificationMethod: this.sessionManager.getDID(keyId),
+      jwk,
+      siwe: prepared.siwe,
+      signature: signature2
+    };
+  }
   /**
    * Sign in and create a new session.
    *
@@ -17848,7 +17958,8 @@ var NodeUserAuthorization = class {
       },
       expiresAt: expirationTime.toISOString(),
       createdAt: now.toISOString(),
-      version: "1.0"
+      version: "1.0",
+      tinycloudHosts: this.tinycloudHosts
     };
     await this.sessionStorage.save(address, persistedData);
     this._session = clientSession;
@@ -18015,7 +18126,8 @@ var NodeUserAuthorization = class {
       },
       expiresAt,
       createdAt,
-      version: "1.0"
+      version: "1.0",
+      tinycloudHosts: this.tinycloudHosts
     };
     await this.sessionStorage.save(address, persistedData);
     this._session = clientSession;
@@ -18117,12 +18229,13 @@ import {
   ServiceContext
 } from "@tinycloud/sdk-core";
 var DelegatedAccess = class {
-  constructor(session, delegation, host, invoke2, telemetry) {
+  constructor(session, delegation, host, invoke2, invokeAny2, telemetry) {
     this.session = session;
     this._delegation = delegation;
     this.host = host;
     this._serviceContext = new ServiceContext({
       invoke: invoke2,
+      invokeAny: invokeAny2,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [host],
       telemetry
@@ -18389,12 +18502,12 @@ function displayActionUrn(action) {
 function secretActionName(action) {
   return action;
 }
-function secretPermissionEntries(name, options, action, encryptionNetworkId) {
+function secretPermissionEntries(name, options, action, space, encryptionNetworkId) {
   const entries = [];
   const path = action === "list" ? resolveSecretListPrefix(options) : resolveSecretPath(name, options).permissionPaths.vault;
   entries.push({
     service: "tinycloud.kv",
-    space: SECRETS_SPACE,
+    space,
     path,
     actions: [secretActionName(action)],
     skipPrefix: true
@@ -18409,11 +18522,23 @@ function secretPermissionEntries(name, options, action, encryptionNetworkId) {
   }
   return entries;
 }
+function normalizeSpace(space, resolveSpace) {
+  if (!space) return void 0;
+  if (space.startsWith("tinycloud:")) return space;
+  return resolveSpace?.(space) ?? space;
+}
+function spaceMatches(granted, requested, resolveSpace) {
+  if (!granted || !requested) return false;
+  return normalizeSpace(granted, resolveSpace) === normalizeSpace(requested, resolveSpace);
+}
 var NodeSecretsService = class {
   constructor(config) {
     this.config = config;
     this.shouldRestoreUnlock = false;
   }
+  get space() {
+    return this.config.space ?? SECRETS_SPACE;
+  }
   get vault() {
     return this.service.vault;
   }
@@ -18466,6 +18591,7 @@ var NodeSecretsService = class {
         name,
         options,
         action,
+        this.space,
         action === "get" ? this.config.getEncryptionNetworkId?.() : void 0
       );
     } catch (error) {
@@ -18515,7 +18641,7 @@ var NodeSecretsService = class {
       (entry) => manifests.some((candidate) => {
         const resolved = resolveManifest(candidate);
         return resolved.resources.some(
-          (resource) => resource.service === entry.service && resource.space === entry.space && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
+          (resource) => resource.service === entry.service && spaceMatches(resource.space, entry.space, this.config.resolveSpace) && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
         );
       })
     );
@@ -18529,6 +18655,9 @@ var NETWORK_CREATE_ACTION2 = "tinycloud.encryption/network.create";
 var DECRYPT_ACTION2 = "tinycloud.encryption/decrypt";
 var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
 var DEFAULT_SESSION_EXPIRATION_MS = EXPIRY3.SESSION_MS;
+function isOpenKeyAutoSignStrategy(strategy) {
+  return strategy?.openKeyAutoSign === true;
+}
 function didPrincipalMatches2(actual, expected) {
   try {
     return principalDidEquals2(actual, expected);
@@ -18536,6 +18665,20 @@ function didPrincipalMatches2(actual, expected) {
     return actual === expected;
   }
 }
+function sharingActionsToAbilities(path, actions) {
+  var _a;
+  const abilities = {};
+  for (const action of actions) {
+    const slash = action.indexOf("/");
+    if (slash === -1) return void 0;
+    const shortService = SERVICE_LONG_TO_SHORT[action.slice(0, slash)];
+    if (shortService === void 0) return void 0;
+    abilities[shortService] ?? (abilities[shortService] = {});
+    (_a = abilities[shortService])[path] ?? (_a[path] = []);
+    abilities[shortService][path].push(action);
+  }
+  return Object.keys(abilities).length > 0 ? abilities : void 0;
+}
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
@@ -18648,6 +18791,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.auth = null;
     this.tc = null;
     this._chainId = 1;
+    this._baseSecrets = /* @__PURE__ */ new Map();
+    this._secrets = /* @__PURE__ */ new Map();
     this.runtimePermissionGrants = [];
     this.invokeWithRuntimePermissions = (session, service, path, action, facts) => {
       return this.wasmBindings.invoke(
@@ -18753,9 +18898,10 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @internal
    */
   setupAuth(config) {
+    const useBootstrapSignInRequest = this.shouldUseBootstrapSignInRequest(config);
     this.auth = new NodeUserAuthorization({
       signer: this.signer,
-      signStrategy: { type: "auto-sign" },
+      signStrategy: config.signStrategy ?? { type: "auto-sign" },
       wasmBindings: this.wasmBindings,
       sessionStorage: config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
@@ -18764,20 +18910,23 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: config.tinycloudFallbackHosts,
-      autoCreateSpace: config.autoCreateSpace,
+      autoCreateSpace: useBootstrapSignInRequest ? false : config.autoCreateSpace,
       enablePublicSpace: config.enablePublicSpace ?? true,
-      spaceCreationHandler: config.spaceCreationHandler,
+      spaceCreationHandler: useBootstrapSignInRequest ? void 0 : config.spaceCreationHandler,
       nonce: config.nonce,
       siweConfig: config.siweConfig,
-      manifest: config.manifest,
-      capabilityRequest: config.capabilityRequest,
-      includeAccountRegistryPermissions: config.includeAccountRegistryPermissions
+      manifest: useBootstrapSignInRequest ? void 0 : config.manifest,
+      capabilityRequest: useBootstrapSignInRequest ? BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
+      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : config.includeAccountRegistryPermissions
     });
     this.tc = new TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: config.telemetry
     });
   }
+  shouldUseBootstrapSignInRequest(config) {
+    return config.autoBootstrapAccount !== false && config.manifest === void 0 && config.capabilityRequest === void 0 && (config.prefix ?? "default") === "default" && isOpenKeyAutoSignStrategy(config.signStrategy);
+  }
   syncResolvedHostFromAuth() {
     const host = this.auth?.hosts[0];
     if (host) {
@@ -18892,7 +19041,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         getAccountDb: () => this.accountSpaceId ? this.sqlForSpace(this.accountSpaceId).db("account") : void 0,
         ensureAccountSpaceHosted: async () => {
           if (this.accountSpaceId && this.auth) {
-            await this.ensureOwnedSpaceHosted(this.accountSpaceId);
+            await this.ensureOwnedSpaceHostedById(this.accountSpaceId);
           }
         }
       });
@@ -18906,6 +19055,13 @@ var _TinyCloudNode = class _TinyCloudNode {
   get session() {
     return this.auth?.tinyCloudSession;
   }
+  /**
+   * Get the currently active session in the shape callers can persist and later
+   * pass back to {@link restoreSession}.
+   */
+  get restorableSession() {
+    return this.currentTinyCloudSession();
+  }
   /**
    * Sign in and create a new session.
    * This creates the user's space if it doesn't exist.
@@ -18928,19 +19084,22 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._hooks = void 0;
     this._vault = void 0;
     this._encryption = void 0;
-    this._baseSecrets = void 0;
-    this._secrets = void 0;
+    this._baseSecrets.clear();
+    this._secrets.clear();
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
     this.initializeServices();
+    const bootstrapped = await this.bootstrapAccountIfNeeded();
     await this.ensureRequestedEncryptionNetworks();
-    if (this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
-      await this.ensureOwnedSpaceHosted(this.ownedSpaceId("secrets"));
+    if (!bootstrapped && this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
+      await this.ensureOwnedSpaceHostedById(this.ownedSpaceId(SECRETS_SPACE2));
+    }
+    if (!bootstrapped) {
+      this.scheduleAccountRegistrySync();
     }
-    this.scheduleAccountRegistrySync();
     this.notificationHandler.success("Successfully signed in");
   }
   ownedSpaceId(name) {
@@ -18949,6 +19108,208 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return this.wasmBindings.makeSpaceId(this._address, this._chainId, name);
   }
+  async bootstrapAccountIfNeeded() {
+    if (this.config.autoBootstrapAccount === false) {
+      return false;
+    }
+    if (!this.auth || !this._address) {
+      return false;
+    }
+    const steps = bootstrapSteps(this._address, this._chainId);
+    if (!await this.isFreshBootstrapAccount(steps)) {
+      return false;
+    }
+    await this.runAccountBootstrap(steps);
+    return true;
+  }
+  async isFreshBootstrapAccount(steps) {
+    const enshrinedSpaceIds = /* @__PURE__ */ new Set();
+    for (const step of steps) {
+      if (step.kind === "session") {
+        enshrinedSpaceIds.add(step.spaceId);
+      }
+    }
+    const skipped = this.auth.lastActivationSkippedSpaceIds;
+    if (skipped.some((spaceId) => enshrinedSpaceIds.has(spaceId))) {
+      return true;
+    }
+    try {
+      const indexed = await this.account.index.spaces.list();
+      if (indexed.ok && indexed.data.length === 0) {
+        return true;
+      }
+    } catch {
+    }
+    try {
+      const spaces = await this.account.spaces.list();
+      return spaces.ok && spaces.data.length === 0;
+    } catch {
+      return false;
+    }
+  }
+  async runAccountBootstrap(steps) {
+    if (!this.auth || !this._address) {
+      throw new Error("Account bootstrap requires an active wallet session");
+    }
+    const host = this.hosts[0] ?? this.config.host;
+    if (!host) {
+      throw new Error("Account bootstrap requires a TinyCloud host");
+    }
+    const auth = this.auth;
+    const sessions = /* @__PURE__ */ new Map();
+    const rawAbilitiesBySpace = /* @__PURE__ */ new Map();
+    const primarySession = auth.tinyCloudSession;
+    const defaultSpaceId = this.ownedSpaceId("default");
+    const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === BOOTSTRAP_SESSION_REQUESTS.default;
+    for (const step of steps) {
+      if (step.kind !== "session") continue;
+      if (step.space === "default" && canReusePrimaryBootstrapSession && primarySession) {
+        sessions.set(step.space, primarySession);
+        continue;
+      }
+      const rawAbilities = step.rawAbilities;
+      if (rawAbilities) {
+        rawAbilitiesBySpace.set(step.space, rawAbilities);
+      }
+      const session = await auth.createBootstrapSession({
+        spaceId: step.spaceId,
+        capabilityRequest: step.request ?? BOOTSTRAP_SESSION_REQUESTS[step.space],
+        rawAbilities
+      });
+      sessions.set(step.space, session);
+    }
+    for (const step of steps) {
+      if (step.kind !== "host") continue;
+      const hosted = await auth.hostOwnedSpace(step.spaceId);
+      if (!hosted) {
+        throw new Error(`Failed to host bootstrap space: ${step.spaceId}`);
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+    for (const step of steps) {
+      if (step.kind !== "activate") continue;
+      const session = sessions.get(step.space);
+      if (!session) {
+        throw new Error(`Missing bootstrap session for ${step.space}`);
+      }
+      const activated = await activateSessionWithHost2(host, session.delegationHeader);
+      if (!activated.success || activated.skipped?.includes(step.spaceId)) {
+        throw new Error(
+          `Failed to activate bootstrap session for ${step.spaceId}: ${activated.error ?? "space was skipped"}`
+        );
+      }
+      this.registerBootstrapRuntimeGrant(
+        session,
+        BOOTSTRAP_SESSION_REQUESTS[step.space],
+        rawAbilitiesBySpace.get(step.space)
+      );
+    }
+    for (const step of steps) {
+      if (step.kind === "account-index-schema") {
+        const ensured = await this.account.index.ensure();
+        if (!ensured.ok) {
+          throw new Error(`Failed to create account index schema: ${ensured.error.message}`);
+        }
+      }
+      if (step.kind === "seed-spaces") {
+        for (const space of step.spaces) {
+          const registered = await this.account.spaces.register({
+            spaceId: space.spaceId,
+            name: space.name,
+            ownerDid: this.did,
+            type: "owned",
+            permissions: ["*"],
+            status: "active"
+          });
+          if (!registered.ok) {
+            throw new Error(
+              `Failed to seed account space ${space.spaceId}: ${registered.error.message}`
+            );
+          }
+        }
+      }
+      if (step.kind === "seed-applications") {
+        const registered = await this.account.applications.register(
+          step.manifests.length > 0 ? [...step.manifests] : TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST
+        );
+        if (!registered.ok) {
+          throw new Error(`Failed to seed bootstrap applications: ${registered.error.message}`);
+        }
+      }
+      if (step.kind === "encryption-network-create") {
+        await this.ensureEncryptionNetwork(step.networkId);
+      }
+      if (step.kind === "secret-records-schema") {
+        const db = this.sqlForSpace(step.spaceId).db(step.database);
+        const migrated = await db.migrations.apply({
+          namespace: "tinycloud.secrets.records",
+          migrations: [
+            {
+              id: "001_initial",
+              sql: [...SECRET_RECORDS_SCHEMA]
+            }
+          ]
+        });
+        if (!migrated.ok) {
+          throw new Error(
+            `Failed to create secret_records schema: ${migrated.error.message}`
+          );
+        }
+      }
+    }
+  }
+  registerBootstrapRuntimeGrant(session, request, rawAbilities) {
+    const operations = [];
+    for (const resource of request.resources) {
+      const service = resource.service.startsWith("tinycloud.") ? this.shortServiceName(resource.service) : resource.service;
+      const spaceId = resource.space.startsWith("tinycloud:") ? resource.space : this.ownedSpaceId(resource.space);
+      for (const action of resource.actions) {
+        operations.push({
+          spaceId,
+          service,
+          path: resource.path,
+          action
+        });
+      }
+    }
+    for (const [resource, actions2] of Object.entries(rawAbilities ?? {})) {
+      for (const action of actions2) {
+        operations.push({
+          resource,
+          service: "encryption",
+          path: resource,
+          action
+        });
+      }
+    }
+    const expiresAt = extractSiweExpiration(session.siwe) ?? this.getSessionExpiry();
+    const actions = [...new Set(operations.map((operation) => operation.action))];
+    this.runtimePermissionGrants.push({
+      session: {
+        delegationHeader: session.delegationHeader,
+        delegationCid: session.delegationCid,
+        spaceId: session.spaceId,
+        verificationMethod: session.verificationMethod,
+        jwk: session.jwk
+      },
+      delegation: {
+        cid: session.delegationCid,
+        delegationHeader: session.delegationHeader,
+        delegateDID: session.verificationMethod,
+        delegatorDID: this.did,
+        spaceId: session.spaceId,
+        path: "",
+        actions,
+        expiry: expiresAt,
+        allowSubDelegation: true,
+        ownerAddress: session.address,
+        chainId: session.chainId,
+        host: this.config.host
+      },
+      operations,
+      expiresAt
+    });
+  }
   async writeManifestRegistryRecords() {
     const request = this.capabilityRequest;
     if (!request || request.registryRecords.length === 0) {
@@ -18958,7 +19319,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Manifest registry write requires wallet mode");
     }
     const accountSpaceId = this.ownedSpaceId(ACCOUNT_REGISTRY_SPACE);
-    await this.ensureOwnedSpaceHosted(accountSpaceId);
+    await this.ensureOwnedSpaceHostedById(accountSpaceId);
     const result = await this.account.applications.register(request.manifests);
     if (!result.ok) {
       throw new Error(
@@ -18968,6 +19329,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   scheduleAccountRegistrySync() {
     void this.withAccountRegistryRetry(async () => {
+      void this.account.index.ensure();
       await this.writeManifestRegistryRecords();
       const spaces = await this.account.spaces.syncAccessible();
       if (!spaces.ok) {
@@ -19019,7 +19381,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       await this.ensureEncryptionNetwork(networkId);
     }
   }
-  async ensureOwnedSpaceHosted(spaceId) {
+  async ensureOwnedSpaceHostedById(spaceId) {
     if (!this.auth) {
       throw new Error("Owned space hosting requires wallet mode");
     }
@@ -19062,7 +19424,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * caller is the root authority of their own owned spaces, so no additional
    * delegation is required.
    *
-   * Unlike {@link ensureOwnedSpaceHosted}, this always submits the host
+   * Unlike {@link ensureOwnedSpaceHostedById}, this always submits the host
    * delegation rather than inferring hosting from session activation: a space
    * the current session has never referenced is reported neither as
    * `activated` nor `skipped`, so activation-based detection would wrongly
@@ -19107,6 +19469,91 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     return spaceId;
   }
+  /**
+   * Ensure one of this user's owned spaces (e.g. `"secrets"`) is hosted on the
+   * server.
+   *
+   * At sign-in, a full-authority session auto-hosts the owner's `secrets`
+   * space, but a session created with a manifest / capabilityRequest does not.
+   * Such a session can therefore hold valid `tinycloud.kv/*` capabilities for
+   * the owned `secrets` space yet still fail its first scoped
+   * `secrets.put(...)` with `404 Space not found`, because the space was never
+   * registered on the node.
+   *
+   * Calling this resolves `name` to the owner's owned-space URI
+   * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`). It first consults the
+   * account-space spaces registry (`account/spaces/{space_id}`, the canonical
+   * KV source of truth, fronted by a best-effort SQLite index): if the space is
+   * already registered/hosted it returns the URI WITHOUT submitting a host
+   * delegation, avoiding a redundant host-SIWE signature prompt for owners who
+   * already use the space. Only when the space is absent — or the registry
+   * check fails for any reason (e.g. a cold SQLite index reporting
+   * `no such table: spaces`) — does it fall through to {@link hostOwnedSpace}.
+   *
+   * The registry check is purely an optimization: any failure falls back to
+   * hosting, and the host SIWE is idempotent server-side, so re-hosting an
+   * existing space remains a safe no-op. Must be called after {@link signIn}.
+   *
+   * @param name - The owned space name (e.g. `"secrets"`).
+   * @returns The hosted owned-space URI.
+   */
+  async ensureOwnedSpaceHosted(name) {
+    if (!this.auth || !this.auth.tinyCloudSession) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    const spaceId = this.ownedSpaceId(name);
+    if (await this.isOwnedSpaceRegistered(spaceId)) {
+      return spaceId;
+    }
+    const hosted = await this.hostOwnedSpace(name);
+    try {
+      await this.account.spaces.register({
+        spaceId,
+        name,
+        ownerDid: this.did,
+        type: "owned",
+        permissions: ["*"],
+        status: "active"
+      });
+    } catch {
+    }
+    return hosted;
+  }
+  /**
+   * Check whether an owned space is already registered/hosted by consulting the
+   * account spaces registry.
+   *
+   * Source of truth is the canonical KV registry record
+   * `account/spaces/{space_id}`, read here via `account.spaces.get(spaceId)`.
+   * The KV path is used (rather than `syncAccessible()`) because it works under
+   * a manifest/recap session with NO extra prompt: the composed manifest recap
+   * already grants `tinycloud.kv get/list` on the account space `spaces/`
+   * prefix, whereas `syncAccessible()` depends on `tinycloud.space/list`, which
+   * a recap session does not hold. Before reading, it consults the fast SQLite
+   * index (`account.index.spaces.list()`) as a best-effort short-circuit; on a
+   * cold index (`no such table: spaces`) or any other index failure it falls
+   * back to the canonical KV read.
+   *
+   * This is a best-effort optimization. ANY failure of the check path (missing
+   * table, KV error, missing record, thrown exception) resolves to `false` so
+   * the caller falls through to hosting — per the directive, "if it fails in any
+   * way then create the space".
+   */
+  async isOwnedSpaceRegistered(spaceId) {
+    try {
+      const indexed = await this.account.index.spaces.list();
+      if (indexed.ok && indexed.data.some((space) => space.spaceId === spaceId)) {
+        return true;
+      }
+    } catch {
+    }
+    try {
+      const record = await this.account.spaces.get(spaceId);
+      return record.ok;
+    } catch {
+      return false;
+    }
+  }
   /**
    * Restore a previously established session from stored delegation data.
    *
@@ -19124,8 +19571,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._hooks = void 0;
     this._vault = void 0;
     this._encryption = void 0;
-    this._baseSecrets = void 0;
-    this._secrets = void 0;
+    this._baseSecrets.clear();
+    this._secrets.clear();
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
@@ -19136,6 +19583,14 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (sessionData.chainId) {
       this._chainId = sessionData.chainId;
     }
+    const resolvedHost = await this.resolveRestoredHost(
+      sessionData.tinycloudHosts,
+      restoredAddress,
+      sessionData.chainId
+    );
+    if (resolvedHost) {
+      this.config.host = resolvedHost;
+    }
     this._serviceContext = new ServiceContext2({
       invoke: this.invokeWithRuntimePermissions,
       invokeAny: this.invokeAnyWithRuntimePermissions,
@@ -19181,12 +19636,45 @@ var _TinyCloudNode = class _TinyCloudNode {
         signature: sessionData.signature ?? ""
       };
       if (this.auth) {
-        this.auth.setRestoredTinyCloudSession(tcSession);
+        this.auth.setRestoredTinyCloudSession(
+          tcSession,
+          this.config.host ? [this.config.host] : void 0
+        );
       } else {
         this._restoredTcSession = tcSession;
       }
     }
   }
+  /**
+   * Resolve the host a restored session should target.
+   *
+   * Mirrors fresh sign-in host resolution but for the restore path:
+   * an explicit/pinned host always wins, then the hosts the session was
+   * persisted with, then a lazy registry/fallback resolution for sessions
+   * that predate the persisted `tinycloudHosts` field. Returns `undefined`
+   * only when there's nothing to resolve from (no explicit host, no
+   * persisted hosts, and no address/chainId) — in which case the existing
+   * `config.host` (default) is left in place.
+   *
+   * Resolution failures are surfaced, not swallowed: a genuinely broken
+   * registry lookup throws rather than silently falling back to a wrong host.
+   */
+  async resolveRestoredHost(persistedHosts, address, chainId) {
+    if (this.explicitHost) {
+      return this.explicitHost;
+    }
+    if (persistedHosts && persistedHosts.length > 0) {
+      return persistedHosts[0];
+    }
+    if (address === void 0 || chainId === void 0) {
+      return void 0;
+    }
+    const resolved = await resolveTinyCloudHosts2(pkhDid2(address, chainId), {
+      registryUrl: this.config.tinycloudRegistryUrl,
+      fallbackHosts: this.config.tinycloudFallbackHosts
+    });
+    return resolved.hosts[0];
+  }
   /**
    * Resolve the currently-active TinyCloudSession, preferring the auth
    * layer's value (wallet mode) and falling back to the node-level
@@ -19231,9 +19719,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     this.signer = _TinyCloudNode.nodeDefaults.createSigner(privateKey);
+    const authConfig = { ...this.config, prefix };
+    const useBootstrapSignInRequest = this.shouldUseBootstrapSignInRequest(authConfig);
     this.auth = new NodeUserAuthorization({
       signer: this.signer,
-      signStrategy: { type: "auto-sign" },
+      signStrategy: this.config.signStrategy ?? { type: "auto-sign" },
       wasmBindings: this.wasmBindings,
       sessionStorage: options?.sessionStorage ?? this.config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
@@ -19242,14 +19732,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: this.config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: this.config.tinycloudFallbackHosts,
-      autoCreateSpace: this.config.autoCreateSpace,
+      autoCreateSpace: useBootstrapSignInRequest ? false : this.config.autoCreateSpace,
       enablePublicSpace: this.config.enablePublicSpace ?? true,
-      spaceCreationHandler: this.config.spaceCreationHandler,
+      spaceCreationHandler: useBootstrapSignInRequest ? void 0 : this.config.spaceCreationHandler,
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
-      manifest: this.config.manifest,
-      capabilityRequest: this.config.capabilityRequest,
-      includeAccountRegistryPermissions: this.config.includeAccountRegistryPermissions
+      manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
+      capabilityRequest: useBootstrapSignInRequest ? BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
     });
     this.tc = new TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
@@ -19276,9 +19766,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const prefix = options?.prefix ?? "default";
     this.signer = signer;
+    const authConfig = { ...this.config, prefix };
+    const useBootstrapSignInRequest = this.shouldUseBootstrapSignInRequest(authConfig);
     this.auth = new NodeUserAuthorization({
       signer: this.signer,
-      signStrategy: { type: "auto-sign" },
+      signStrategy: this.config.signStrategy ?? { type: "auto-sign" },
       wasmBindings: this.wasmBindings,
       sessionStorage: options?.sessionStorage ?? this.config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
@@ -19287,14 +19779,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: this.config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: this.config.tinycloudFallbackHosts,
-      autoCreateSpace: this.config.autoCreateSpace,
+      autoCreateSpace: useBootstrapSignInRequest ? false : this.config.autoCreateSpace,
       enablePublicSpace: this.config.enablePublicSpace ?? true,
-      spaceCreationHandler: this.config.spaceCreationHandler,
+      spaceCreationHandler: useBootstrapSignInRequest ? void 0 : this.config.spaceCreationHandler,
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
-      manifest: this.config.manifest,
-      capabilityRequest: this.config.capabilityRequest,
-      includeAccountRegistryPermissions: this.config.includeAccountRegistryPermissions
+      manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
+      capabilityRequest: useBootstrapSignInRequest ? BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
     });
     this.tc = new TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
@@ -19370,6 +19862,20 @@ var _TinyCloudNode = class _TinyCloudNode {
   getDefaultEncryptionNetworkId(name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
     return `urn:tinycloud:encryption:${this.did}:${name}`;
   }
+  getEncryptionNetworkIdForSpace(spaceId, name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
+    const ownerDid = this.ownerDidFromSpaceId(spaceId) ?? this.did;
+    return `urn:tinycloud:encryption:${ownerDid}:${name}`;
+  }
+  ownerDidFromSpaceId(spaceId) {
+    if (!spaceId.startsWith("tinycloud:")) return void 0;
+    const body = spaceId.slice("tinycloud:".length);
+    const lastSeparator = body.lastIndexOf(":");
+    if (lastSeparator <= 0) return void 0;
+    const owner = body.slice(0, lastSeparator);
+    if (owner.startsWith("did:")) return owner;
+    if (!owner.includes(":")) return void 0;
+    return `did:${owner}`;
+  }
   requireServiceSession() {
     const session = this._serviceContext?.session;
     if (!session) {
@@ -19557,7 +20063,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       spaceId,
       crypto: vaultCrypto,
       encryption: {
-        networkId: this.getDefaultEncryptionNetworkId(),
+        networkId: this.getEncryptionNetworkIdForSpace(spaceId),
         service: this.getEncryptionService(),
         decryptCapabilityProof: () => ({
           proofs: [this.requireServiceSession().delegationCid]
@@ -19688,6 +20194,9 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
         return vaultService;
       },
+      createSecretsService: (spaceId) => {
+        return this.secretsForSpace(spaceId);
+      },
       // Enable space.delegations.create() via SIWE-based delegation
       createDelegation: async (params) => {
         try {
@@ -19810,11 +20319,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     try {
       const host = this.config.host;
       const now = /* @__PURE__ */ new Date();
-      const abilities = {
-        kv: {
-          [params.path]: params.actions
-        }
-      };
+      const abilities = sharingActionsToAbilities(params.path, params.actions);
+      if (!abilities) {
+        return void 0;
+      }
       const prepared = this.wasmBindings.prepareSession({
         abilities,
         address: this.wasmBindings.ensureEip55(session.address),
@@ -20070,27 +20578,49 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._spaceService) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    if (!this._secrets) {
-      this._secrets = new NodeSecretsService({
-        getService: () => this.getBaseSecrets(),
+    return this.secretsForSpace("secrets");
+  }
+  /**
+   * App-facing secrets API backed by the requested space's vault.
+   */
+  secretsForSpace(spaceId) {
+    if (!this._spaceService) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    const resolvedSpace = spaceId.startsWith("tinycloud:") ? spaceId : this.ownedSpaceId(spaceId);
+    let secrets = this._secrets.get(resolvedSpace);
+    if (!secrets) {
+      secrets = new NodeSecretsService({
+        getService: () => this.getBaseSecrets(resolvedSpace),
+        space: resolvedSpace,
         getManifest: () => this.manifest,
         hasPermissions: (permissions) => this.hasRuntimePermissions(permissions),
         grantPermissions: (additional) => this.grantRuntimePermissions(additional),
         canEscalate: () => this.signer !== void 0 && this.tc !== void 0,
-        getEncryptionNetworkId: () => this.getDefaultEncryptionNetworkId(),
+        getEncryptionNetworkId: () => this.getEncryptionNetworkIdForSpace(resolvedSpace),
+        resolveSpace: (space) => space.startsWith("tinycloud:") ? space : this.ownedSpaceId(space),
         getUnlockSigner: () => this.signer ?? void 0
       });
+      this._secrets.set(resolvedSpace, secrets);
     }
-    return this._secrets;
+    return secrets;
   }
-  getBaseSecrets() {
+  getBaseSecrets(spaceId) {
     if (!this._spaceService) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    if (!this._baseSecrets) {
-      this._baseSecrets = new SecretsService(() => this.space("secrets").vault);
+    const resolvedSpace = spaceId.startsWith("tinycloud:") ? spaceId : this.ownedSpaceId(spaceId);
+    let secrets = this._baseSecrets.get(resolvedSpace);
+    if (!secrets) {
+      const kvService = this.createSpaceScopedKVService(resolvedSpace);
+      const vaultService = this.createVaultService(resolvedSpace, kvService);
+      if (this._serviceContext) {
+        vaultService.initialize(this._serviceContext);
+      }
+      secrets = new SecretsService(() => vaultService);
+      this._baseSecrets.set(resolvedSpace, secrets);
     }
-    return this._baseSecrets;
+    return secrets;
   }
   /**
    * Hooks write stream subscription API.
@@ -21504,6 +22034,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         delegation,
         targetHost,
         this.wasmBindings.invoke,
+        this.wasmBindings.invokeAny,
         this.config.telemetry
       );
     }
@@ -21569,6 +22100,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegation,
       targetHost,
       this.wasmBindings.invoke,
+      this.wasmBindings.invokeAny,
       this.config.telemetry
     );
   }
@@ -21700,7 +22232,14 @@ import {
   pkhDid as pkhDid3,
   principalDid,
   principalDidEquals as principalDidEquals3,
-  parseCanonicalNetworkId
+  parseCanonicalNetworkId,
+  TinyCloudDebugLogger,
+  tinyCloudDebugLogger,
+  enableTinyCloudDebug,
+  disableTinyCloudDebug,
+  getTinyCloudDebugLogs,
+  clearTinyCloudDebugLogs,
+  installTinyCloudDebugGlobals
 } from "@tinycloud/sdk-core";
 
 // src/storage/FileSessionStorage.ts
@@ -22034,6 +22573,7 @@ export {
   SpaceErrorCodes,
   SpaceService2 as SpaceService,
   TinyCloud2 as TinyCloud,
+  TinyCloudDebugLogger,
   TinyCloudNode,
   UnsupportedFeatureError2 as UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE,
@@ -22058,8 +22598,10 @@ export {
   canonicalizeSecretScope,
   checkDecryptInvocationInput,
   checkNodeInfo2 as checkNodeInfo,
+  clearTinyCloudDebugLogs,
   composeManifestRequest2 as composeManifestRequest,
   createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy,
   createSharingService,
   createSpaceService,
   createVaultCrypto2 as createVaultCrypto,
@@ -22071,7 +22613,9 @@ export {
   deserializeDelegation,
   didCacheKey,
   didEquals,
+  disableTinyCloudDebug,
   discoverNetwork,
+  enableTinyCloudDebug,
   encryptToNetwork,
   encryptionBase64Decode,
   encryptionBase64Encode,
@@ -22083,9 +22627,11 @@ export {
   expandPermissionEntries2 as expandPermissionEntries,
   expandPermissionEntry,
   generateRandomReceiverKey,
+  getTinyCloudDebugLogs,
   grantAuthRequest,
   hexDecode,
   hexEncode,
+  installTinyCloudDebugGlobals,
   isCapabilitySubset2 as isCapabilitySubset,
   isEvmAddress,
   isNetworkId,
@@ -22107,6 +22653,7 @@ export {
   resolveSecretPath2 as resolveSecretPath,
   resourceCapabilitiesToSpaceAbilitiesMap2 as resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation,
+  tinyCloudDebugLogger,
   validateEnvelope,
   validateManifest,
   verifyDecryptResponse