@tinycloud/node-sdk 2.4.0-beta.9 → 2.4.1-beta.0

package/dist/index.cjs

@@ -17025,135 +17025,143 @@ var require_utils2 = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  ACCOUNT_REGISTRY_PATH: () => import_sdk_core10.ACCOUNT_REGISTRY_PATH,
-  ACCOUNT_REGISTRY_SPACE: () => import_sdk_core10.ACCOUNT_REGISTRY_SPACE,
-  AccountService: () => import_sdk_core2.AccountService,
-  AutoApproveSpaceCreationHandler: () => import_sdk_core9.AutoApproveSpaceCreationHandler,
-  CapabilityKeyRegistry: () => import_sdk_core18.CapabilityKeyRegistry,
-  CapabilityKeyRegistryErrorCodes: () => import_sdk_core18.CapabilityKeyRegistryErrorCodes,
-  DECRYPT_ACTION: () => import_sdk_core15.DECRYPT_ACTION,
-  DECRYPT_FACT_TYPE: () => import_sdk_core15.DECRYPT_FACT_TYPE,
-  DECRYPT_RESULT_TYPE: () => import_sdk_core15.DECRYPT_RESULT_TYPE,
-  DEFAULT_ENCRYPTION_ALG: () => import_sdk_core15.DEFAULT_ENCRYPTION_ALG,
-  DEFAULT_KEY_VERSION: () => import_sdk_core15.DEFAULT_KEY_VERSION,
-  DEFAULT_MANIFEST_SPACE: () => import_sdk_core10.DEFAULT_MANIFEST_SPACE,
-  DEFAULT_MANIFEST_VERSION: () => import_sdk_core10.DEFAULT_MANIFEST_VERSION,
-  DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => import_sdk_core11.DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
-  DataVaultService: () => import_sdk_core14.DataVaultService,
-  DatabaseHandle: () => import_sdk_core12.DatabaseHandle,
+  ACCOUNT_REGISTRY_PATH: () => import_sdk_core11.ACCOUNT_REGISTRY_PATH,
+  ACCOUNT_REGISTRY_SPACE: () => import_sdk_core11.ACCOUNT_REGISTRY_SPACE,
+  AccountService: () => import_sdk_core3.AccountService,
+  AutoApproveSpaceCreationHandler: () => import_sdk_core10.AutoApproveSpaceCreationHandler,
+  CapabilityKeyRegistry: () => import_sdk_core19.CapabilityKeyRegistry,
+  CapabilityKeyRegistryErrorCodes: () => import_sdk_core19.CapabilityKeyRegistryErrorCodes,
+  DECRYPT_ACTION: () => import_sdk_core16.DECRYPT_ACTION,
+  DECRYPT_FACT_TYPE: () => import_sdk_core16.DECRYPT_FACT_TYPE,
+  DECRYPT_RESULT_TYPE: () => import_sdk_core16.DECRYPT_RESULT_TYPE,
+  DEFAULT_ENCRYPTION_ALG: () => import_sdk_core16.DEFAULT_ENCRYPTION_ALG,
+  DEFAULT_KEY_VERSION: () => import_sdk_core16.DEFAULT_KEY_VERSION,
+  DEFAULT_MANIFEST_SPACE: () => import_sdk_core11.DEFAULT_MANIFEST_SPACE,
+  DEFAULT_MANIFEST_VERSION: () => import_sdk_core11.DEFAULT_MANIFEST_VERSION,
+  DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => import_sdk_core12.DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
+  DataVaultService: () => import_sdk_core15.DataVaultService,
+  DatabaseHandle: () => import_sdk_core13.DatabaseHandle,
   DelegatedAccess: () => DelegatedAccess,
-  DelegationErrorCodes: () => import_sdk_core17.DelegationErrorCodes,
-  DelegationManager: () => import_sdk_core17.DelegationManager,
-  DuckDbAction: () => import_sdk_core13.DuckDbAction,
-  DuckDbDatabaseHandle: () => import_sdk_core13.DuckDbDatabaseHandle,
-  DuckDbService: () => import_sdk_core13.DuckDbService,
-  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_core15.ENCRYPTION_NETWORK_URN_PREFIX,
-  ENCRYPTION_SERVICE: () => import_sdk_core15.ENCRYPTION_SERVICE,
-  ENCRYPTION_SERVICE_SHORT: () => import_sdk_core15.ENCRYPTION_SERVICE_SHORT,
-  ENVELOPE_VERSION: () => import_sdk_core15.ENVELOPE_VERSION,
-  EncryptionService: () => import_sdk_core15.EncryptionService,
+  DelegationErrorCodes: () => import_sdk_core18.DelegationErrorCodes,
+  DelegationManager: () => import_sdk_core18.DelegationManager,
+  DuckDbAction: () => import_sdk_core14.DuckDbAction,
+  DuckDbDatabaseHandle: () => import_sdk_core14.DuckDbDatabaseHandle,
+  DuckDbService: () => import_sdk_core14.DuckDbService,
+  ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_core16.ENCRYPTION_NETWORK_URN_PREFIX,
+  ENCRYPTION_SERVICE: () => import_sdk_core16.ENCRYPTION_SERVICE,
+  ENCRYPTION_SERVICE_SHORT: () => import_sdk_core16.ENCRYPTION_SERVICE_SHORT,
+  ENVELOPE_VERSION: () => import_sdk_core16.ENVELOPE_VERSION,
+  EncryptionService: () => import_sdk_core16.EncryptionService,
   FileSessionStorage: () => FileSessionStorage,
-  HooksService: () => import_sdk_core16.HooksService,
-  IdentityParseError: () => import_sdk_core9.IdentityParseError,
-  KVService: () => import_sdk_core11.KVService,
-  ManifestValidationError: () => import_sdk_core10.ManifestValidationError,
+  HooksService: () => import_sdk_core17.HooksService,
+  IdentityParseError: () => import_sdk_core10.IdentityParseError,
+  KVService: () => import_sdk_core12.KVService,
+  ManifestValidationError: () => import_sdk_core11.ManifestValidationError,
   MemorySessionStorage: () => MemorySessionStorage,
-  NETWORK_NAME_PATTERN: () => import_sdk_core15.NETWORK_NAME_PATTERN,
-  NetworkIdError: () => import_sdk_core15.NetworkIdError,
+  NETWORK_NAME_PATTERN: () => import_sdk_core16.NETWORK_NAME_PATTERN,
+  NetworkIdError: () => import_sdk_core16.NetworkIdError,
   NodeUserAuthorization: () => NodeUserAuthorization,
   NodeWasmBindings: () => NodeWasmBindings,
-  PermissionNotInManifestError: () => import_sdk_core10.PermissionNotInManifestError,
-  PrefixedKVService: () => import_sdk_core11.PrefixedKVService,
+  PermissionNotInManifestError: () => import_sdk_core11.PermissionNotInManifestError,
+  PrefixedKVService: () => import_sdk_core12.PrefixedKVService,
   PrivateKeySigner: () => PrivateKeySigner,
-  ProtocolMismatchError: () => import_sdk_core20.ProtocolMismatchError,
-  SECRET_NAME_RE: () => import_sdk_core14.SECRET_NAME_RE,
-  SQLAction: () => import_sdk_core12.SQLAction,
-  SQLService: () => import_sdk_core12.SQLService,
-  SecretsService: () => import_sdk_core14.SecretsService,
-  ServiceContext: () => import_sdk_core21.ServiceContext,
-  SessionExpiredError: () => import_sdk_core10.SessionExpiredError,
-  SharingService: () => import_sdk_core17.SharingService,
-  SilentNotificationHandler: () => import_sdk_core9.SilentNotificationHandler,
-  Space: () => import_sdk_core19.Space,
-  SpaceErrorCodes: () => import_sdk_core19.SpaceErrorCodes,
-  SpaceService: () => import_sdk_core19.SpaceService,
-  TinyCloud: () => import_sdk_core8.TinyCloud,
+  ProtocolMismatchError: () => import_sdk_core21.ProtocolMismatchError,
+  SECRET_NAME_RE: () => import_sdk_core15.SECRET_NAME_RE,
+  SQLAction: () => import_sdk_core13.SQLAction,
+  SQLService: () => import_sdk_core13.SQLService,
+  SecretsService: () => import_sdk_core15.SecretsService,
+  ServiceContext: () => import_sdk_core22.ServiceContext,
+  SessionExpiredError: () => import_sdk_core11.SessionExpiredError,
+  SharingService: () => import_sdk_core18.SharingService,
+  SilentNotificationHandler: () => import_sdk_core10.SilentNotificationHandler,
+  Space: () => import_sdk_core20.Space,
+  SpaceErrorCodes: () => import_sdk_core20.SpaceErrorCodes,
+  SpaceService: () => import_sdk_core20.SpaceService,
+  TinyCloud: () => import_sdk_core9.TinyCloud,
+  TinyCloudDebugLogger: () => import_sdk_core10.TinyCloudDebugLogger,
   TinyCloudNode: () => TinyCloudNode,
-  UnsupportedFeatureError: () => import_sdk_core20.UnsupportedFeatureError,
-  VAULT_PERMISSION_SERVICE: () => import_sdk_core10.VAULT_PERMISSION_SERVICE,
-  VaultHeaders: () => import_sdk_core14.VaultHeaders,
-  VaultPublicSpaceKVActions: () => import_sdk_core14.VaultPublicSpaceKVActions,
-  VersionCheckError: () => import_sdk_core20.VersionCheckError,
+  UnsupportedFeatureError: () => import_sdk_core21.UnsupportedFeatureError,
+  VAULT_PERMISSION_SERVICE: () => import_sdk_core11.VAULT_PERMISSION_SERVICE,
+  VaultHeaders: () => import_sdk_core15.VaultHeaders,
+  VaultPublicSpaceKVActions: () => import_sdk_core15.VaultPublicSpaceKVActions,
+  VersionCheckError: () => import_sdk_core21.VersionCheckError,
   WasmKeyProvider: () => WasmKeyProvider,
-  addressStorageKey: () => import_sdk_core9.addressStorageKey,
-  buildCanonicalDecryptRequest: () => import_sdk_core15.buildCanonicalDecryptRequest,
-  buildDecryptAttenuation: () => import_sdk_core15.buildDecryptAttenuation,
-  buildDecryptFacts: () => import_sdk_core15.buildDecryptFacts,
-  buildDecryptInvocation: () => import_sdk_core15.buildDecryptInvocation,
-  buildNetworkId: () => import_sdk_core15.buildNetworkId,
-  buildSpaceUri: () => import_sdk_core19.buildSpaceUri,
-  canonicalHashHex: () => import_sdk_core15.canonicalHashHex,
-  canonicalSignedResponse: () => import_sdk_core15.canonicalSignedResponse,
-  canonicalizeAddress: () => import_sdk_core9.canonicalizeAddress,
-  canonicalizeDid: () => import_sdk_core9.canonicalizeDid,
-  canonicalizeDidUrl: () => import_sdk_core9.canonicalizeDidUrl,
-  canonicalizeEncryptionJson: () => import_sdk_core15.canonicalizeEncryptionJson,
-  canonicalizeNetworkId: () => import_sdk_core9.canonicalizeNetworkId,
-  canonicalizeSecretScope: () => import_sdk_core14.canonicalizeSecretScope,
-  checkDecryptInvocationInput: () => import_sdk_core15.checkDecryptInvocationInput,
-  checkNodeInfo: () => import_sdk_core20.checkNodeInfo,
-  composeManifestRequest: () => import_sdk_core10.composeManifestRequest,
-  createCapabilityKeyRegistry: () => import_sdk_core18.createCapabilityKeyRegistry,
-  createSharingService: () => import_sdk_core17.createSharingService,
-  createSpaceService: () => import_sdk_core19.createSpaceService,
-  createVaultCrypto: () => import_sdk_core14.createVaultCrypto,
+  addressStorageKey: () => import_sdk_core10.addressStorageKey,
+  buildCanonicalDecryptRequest: () => import_sdk_core16.buildCanonicalDecryptRequest,
+  buildDecryptAttenuation: () => import_sdk_core16.buildDecryptAttenuation,
+  buildDecryptFacts: () => import_sdk_core16.buildDecryptFacts,
+  buildDecryptInvocation: () => import_sdk_core16.buildDecryptInvocation,
+  buildNetworkId: () => import_sdk_core16.buildNetworkId,
+  buildSpaceUri: () => import_sdk_core20.buildSpaceUri,
+  canonicalHashHex: () => import_sdk_core16.canonicalHashHex,
+  canonicalSignedResponse: () => import_sdk_core16.canonicalSignedResponse,
+  canonicalizeAddress: () => import_sdk_core10.canonicalizeAddress,
+  canonicalizeDid: () => import_sdk_core10.canonicalizeDid,
+  canonicalizeDidUrl: () => import_sdk_core10.canonicalizeDidUrl,
+  canonicalizeEncryptionJson: () => import_sdk_core16.canonicalizeEncryptionJson,
+  canonicalizeNetworkId: () => import_sdk_core10.canonicalizeNetworkId,
+  canonicalizeSecretScope: () => import_sdk_core15.canonicalizeSecretScope,
+  checkDecryptInvocationInput: () => import_sdk_core16.checkDecryptInvocationInput,
+  checkNodeInfo: () => import_sdk_core21.checkNodeInfo,
+  clearTinyCloudDebugLogs: () => import_sdk_core10.clearTinyCloudDebugLogs,
+  composeManifestRequest: () => import_sdk_core11.composeManifestRequest,
+  createCapabilityKeyRegistry: () => import_sdk_core19.createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy: () => import_sdk_core.createOpenKeyCallbackSigningStrategy,
+  createSharingService: () => import_sdk_core18.createSharingService,
+  createSpaceService: () => import_sdk_core20.createSpaceService,
+  createVaultCrypto: () => import_sdk_core15.createVaultCrypto,
   createWasmKeyProvider: () => createWasmKeyProvider,
-  decryptEnvelopeWithKey: () => import_sdk_core15.decryptEnvelopeWithKey,
+  decryptEnvelopeWithKey: () => import_sdk_core16.decryptEnvelopeWithKey,
   defaultSignStrategy: () => defaultSignStrategy,
-  defaultSpaceCreationHandler: () => import_sdk_core9.defaultSpaceCreationHandler,
-  deriveSignedReceiverKey: () => import_sdk_core15.deriveSignedReceiverKey,
+  defaultSpaceCreationHandler: () => import_sdk_core10.defaultSpaceCreationHandler,
+  deriveSignedReceiverKey: () => import_sdk_core16.deriveSignedReceiverKey,
   deserializeDelegation: () => deserializeDelegation,
-  didCacheKey: () => import_sdk_core9.didCacheKey,
-  didEquals: () => import_sdk_core9.didEquals,
-  discoverNetwork: () => import_sdk_core15.discoverNetwork,
-  encryptToNetwork: () => import_sdk_core15.encryptToNetwork,
-  encryptionBase64Decode: () => import_sdk_core15.encryptionBase64Decode,
-  encryptionBase64Encode: () => import_sdk_core15.encryptionBase64Encode,
-  encryptionError: () => import_sdk_core15.encryptionError,
-  encryptionUtf8Decode: () => import_sdk_core15.encryptionUtf8Decode,
-  encryptionUtf8Encode: () => import_sdk_core15.encryptionUtf8Encode,
-  ensureNetworkUsableForDecrypt: () => import_sdk_core15.ensureNetworkUsableForDecrypt,
-  expandActionShortNames: () => import_sdk_core10.expandActionShortNames,
-  expandPermissionEntries: () => import_sdk_core10.expandPermissionEntries,
-  expandPermissionEntry: () => import_sdk_core10.expandPermissionEntry,
-  generateRandomReceiverKey: () => import_sdk_core15.generateRandomReceiverKey,
+  didCacheKey: () => import_sdk_core10.didCacheKey,
+  didEquals: () => import_sdk_core10.didEquals,
+  disableTinyCloudDebug: () => import_sdk_core10.disableTinyCloudDebug,
+  discoverNetwork: () => import_sdk_core16.discoverNetwork,
+  enableTinyCloudDebug: () => import_sdk_core10.enableTinyCloudDebug,
+  encryptToNetwork: () => import_sdk_core16.encryptToNetwork,
+  encryptionBase64Decode: () => import_sdk_core16.encryptionBase64Decode,
+  encryptionBase64Encode: () => import_sdk_core16.encryptionBase64Encode,
+  encryptionError: () => import_sdk_core16.encryptionError,
+  encryptionUtf8Decode: () => import_sdk_core16.encryptionUtf8Decode,
+  encryptionUtf8Encode: () => import_sdk_core16.encryptionUtf8Encode,
+  ensureNetworkUsableForDecrypt: () => import_sdk_core16.ensureNetworkUsableForDecrypt,
+  expandActionShortNames: () => import_sdk_core11.expandActionShortNames,
+  expandPermissionEntries: () => import_sdk_core11.expandPermissionEntries,
+  expandPermissionEntry: () => import_sdk_core11.expandPermissionEntry,
+  generateRandomReceiverKey: () => import_sdk_core16.generateRandomReceiverKey,
+  getTinyCloudDebugLogs: () => import_sdk_core10.getTinyCloudDebugLogs,
   grantAuthRequest: () => grantAuthRequest,
-  hexDecode: () => import_sdk_core15.hexDecode,
-  hexEncode: () => import_sdk_core15.hexEncode,
-  isCapabilitySubset: () => import_sdk_core10.isCapabilitySubset,
-  isEvmAddress: () => import_sdk_core9.isEvmAddress,
-  isNetworkId: () => import_sdk_core15.isNetworkId,
-  loadManifest: () => import_sdk_core10.loadManifest,
-  makePkhSpaceId: () => import_sdk_core9.makePkhSpaceId,
-  makePublicSpaceId: () => import_sdk_core19.makePublicSpaceId,
-  networkDiscoveryKey: () => import_sdk_core15.networkDiscoveryKey,
-  openWrappedKey: () => import_sdk_core15.openWrappedKey,
-  parseCanonicalNetworkId: () => import_sdk_core9.parseCanonicalNetworkId,
-  parseExpiry: () => import_sdk_core10.parseExpiry,
-  parseNetworkId: () => import_sdk_core15.parseNetworkId,
-  parsePkhDid: () => import_sdk_core9.parsePkhDid,
-  parseSpaceUri: () => import_sdk_core19.parseSpaceUri,
-  pkhDid: () => import_sdk_core9.pkhDid,
-  principalDid: () => import_sdk_core9.principalDid,
-  principalDidEquals: () => import_sdk_core9.principalDidEquals,
-  resolveManifest: () => import_sdk_core10.resolveManifest,
-  resolveSecretListPrefix: () => import_sdk_core14.resolveSecretListPrefix,
-  resolveSecretPath: () => import_sdk_core14.resolveSecretPath,
-  resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core10.resourceCapabilitiesToSpaceAbilitiesMap,
+  hexDecode: () => import_sdk_core16.hexDecode,
+  hexEncode: () => import_sdk_core16.hexEncode,
+  installTinyCloudDebugGlobals: () => import_sdk_core10.installTinyCloudDebugGlobals,
+  isCapabilitySubset: () => import_sdk_core11.isCapabilitySubset,
+  isEvmAddress: () => import_sdk_core10.isEvmAddress,
+  isNetworkId: () => import_sdk_core16.isNetworkId,
+  loadManifest: () => import_sdk_core11.loadManifest,
+  makePkhSpaceId: () => import_sdk_core10.makePkhSpaceId,
+  makePublicSpaceId: () => import_sdk_core20.makePublicSpaceId,
+  networkDiscoveryKey: () => import_sdk_core16.networkDiscoveryKey,
+  openWrappedKey: () => import_sdk_core16.openWrappedKey,
+  parseCanonicalNetworkId: () => import_sdk_core10.parseCanonicalNetworkId,
+  parseExpiry: () => import_sdk_core11.parseExpiry,
+  parseNetworkId: () => import_sdk_core16.parseNetworkId,
+  parsePkhDid: () => import_sdk_core10.parsePkhDid,
+  parseSpaceUri: () => import_sdk_core20.parseSpaceUri,
+  pkhDid: () => import_sdk_core10.pkhDid,
+  principalDid: () => import_sdk_core10.principalDid,
+  principalDidEquals: () => import_sdk_core10.principalDidEquals,
+  resolveManifest: () => import_sdk_core11.resolveManifest,
+  resolveSecretListPrefix: () => import_sdk_core15.resolveSecretListPrefix,
+  resolveSecretPath: () => import_sdk_core15.resolveSecretPath,
+  resourceCapabilitiesToSpaceAbilitiesMap: () => import_sdk_core11.resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation: () => serializeDelegation,
-  validateEnvelope: () => import_sdk_core15.validateEnvelope,
-  validateManifest: () => import_sdk_core10.validateManifest,
-  verifyDecryptResponse: () => import_sdk_core15.verifyDecryptResponse
+  tinyCloudDebugLogger: () => import_sdk_core10.tinyCloudDebugLogger,
+  validateEnvelope: () => import_sdk_core16.validateEnvelope,
+  validateManifest: () => import_sdk_core11.validateManifest,
+  verifyDecryptResponse: () => import_sdk_core16.verifyDecryptResponse
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -17258,12 +17266,13 @@ var PrivateKeySigner = class {
 };
 
 // src/TinyCloudNode.ts
-var import_sdk_core6 = require("@tinycloud/sdk-core");
+var import_sdk_core7 = require("@tinycloud/sdk-core");
 
 // src/authorization/NodeUserAuthorization.ts
-var import_sdk_core = require("@tinycloud/sdk-core");
+var import_sdk_core2 = require("@tinycloud/sdk-core");
 
 // src/authorization/strategies.ts
+var import_sdk_core = require("@tinycloud/sdk-core");
 var defaultSignStrategy = { type: "auto-sign" };
 
 // src/storage/MemorySessionStorage.ts
@@ -17342,7 +17351,7 @@ var DECRYPT_ACTION = "tinycloud.encryption/decrypt";
 var NETWORK_CREATE_ACTION = "tinycloud.encryption/network.create";
 function didPrincipalMatches(actual, expected) {
   try {
-    return (0, import_sdk_core.principalDidEquals)(actual, expected);
+    return (0, import_sdk_core2.principalDidEquals)(actual, expected);
   } catch {
     return actual === expected;
   }
@@ -17361,6 +17370,7 @@ var NodeUserAuthorization = class {
   constructor(config) {
     this.extensions = [];
     this._nodeFeatures = [];
+    this._lastActivationSkippedSpaceIds = [];
     this.wasm = config.wasmBindings;
     this.signer = config.signer;
     this.signStrategy = config.signStrategy ?? defaultSignStrategy;
@@ -17383,7 +17393,7 @@ var NodeUserAuthorization = class {
         "": [
           "tinycloud.sql/read",
           "tinycloud.sql/write",
-          "tinycloud.sql/ddl",
+          "tinycloud.sql/schema",
           "tinycloud.sql/admin",
           "tinycloud.sql/export"
         ]
@@ -17411,7 +17421,7 @@ var NodeUserAuthorization = class {
         ]
       }
     };
-    this.sessionExpirationMs = config.sessionExpirationMs ?? import_sdk_core.EXPIRY.SESSION_MS;
+    this.sessionExpirationMs = config.sessionExpirationMs ?? import_sdk_core2.EXPIRY.SESSION_MS;
     this.autoCreateSpace = config.autoCreateSpace ?? false;
     this.spaceCreationHandler = config.spaceCreationHandler;
     this.tinycloudHosts = config.tinycloudHosts;
@@ -17475,19 +17485,55 @@ var NodeUserAuthorization = class {
    * `siwe` is the load-bearing one because `extractSiweExpiration` returns
    * undefined for missing SIWEs and the SDK then treats the session as
    * expired-at-epoch-zero.
+   *
+   * @param hosts - The TinyCloud hosts this session was created against,
+   *   as persisted in {@link PersistedSessionData.tinycloudHosts}. When
+   *   present (and non-empty) they are adopted directly so the restored
+   *   session resolves to the same node as the original sign-in without
+   *   re-running registry/fallback resolution. When absent (old session)
+   *   hosts are resolved lazily on the first host-needing call via
+   *   {@link ensureTinyCloudHosts}.
    */
-  setRestoredTinyCloudSession(session) {
-    const address = (0, import_sdk_core.canonicalizeAddress)(session.address);
+  setRestoredTinyCloudSession(session, hosts) {
+    const address = (0, import_sdk_core2.canonicalizeAddress)(session.address);
     this._tinyCloudSession = { ...session, address };
     this._address = address;
     this._chainId = session.chainId;
+    if ((!this.tinycloudHosts || this.tinycloudHosts.length === 0) && hosts && hosts.length > 0) {
+      this.tinycloudHosts = [...hosts];
+    }
+  }
+  /**
+   * Ensure `tinycloudHosts` are resolved before a host-needing call.
+   *
+   * Fresh sign-in resolves hosts up front; a restored session may not have
+   * (old persisted sessions predate {@link PersistedSessionData.tinycloudHosts}).
+   * This guard makes a restored session resolve the node exactly like a fresh
+   * sign-in — persisted hosts are preferred (already set by
+   * {@link setRestoredTinyCloudSession}), otherwise the registry/fallback
+   * resolution runs lazily here. Idempotent: {@link resolveTinyCloudHostsForSignIn}
+   * early-returns when hosts are already set.
+   *
+   * Throws if hosts are unset and the restored session has no address/chainId
+   * to resolve from — a real failure that must surface, not be masked.
+   */
+  async ensureTinyCloudHosts() {
+    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
+      return;
+    }
+    if (this._address === void 0 || this._chainId === void 0) {
+      throw new Error(
+        "Cannot resolve TinyCloud hosts: no address/chainId available. Sign in or restore a session first."
+      );
+    }
+    await this.resolveTinyCloudHostsForSignIn(this._address, this._chainId);
   }
   async resolveTinyCloudHostsForSignIn(address, chainId) {
     if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
       return;
     }
-    const subject = (0, import_sdk_core.pkhDid)(address, chainId);
-    const resolved = await (0, import_sdk_core.resolveTinyCloudHosts)(subject, {
+    const subject = (0, import_sdk_core2.pkhDid)(address, chainId);
+    const resolved = await (0, import_sdk_core2.resolveTinyCloudHosts)(subject, {
       registryUrl: this.tinycloudRegistryUrl,
       fallbackHosts: this.tinycloudFallbackHosts
     });
@@ -17505,6 +17551,9 @@ var NodeUserAuthorization = class {
   get nodeFeatures() {
     return this._nodeFeatures;
   }
+  get lastActivationSkippedSpaceIds() {
+    return [...this._lastActivationSkippedSpaceIds];
+  }
   /**
    * Compute the `abilities` map the WASM `prepareSession` call should
    * see at sign-in time.
@@ -17538,7 +17587,7 @@ var NodeUserAuthorization = class {
     if (this._manifest === void 0) {
       return void 0;
     }
-    this._capabilityRequest = (0, import_sdk_core.composeManifestRequest)(
+    this._capabilityRequest = (0, import_sdk_core2.composeManifestRequest)(
       Array.isArray(this._manifest) ? this._manifest : [this._manifest],
       {
         includeAccountRegistryPermissions: this.includeAccountRegistryPermissions
@@ -17550,17 +17599,17 @@ var NodeUserAuthorization = class {
     if (space.startsWith("tinycloud:")) {
       return space;
     }
-    return (0, import_sdk_core.makePkhSpaceId)(address, chainId, space);
+    return (0, import_sdk_core2.makePkhSpaceId)(address, chainId, space);
   }
   defaultEncryptionNetworkId(address, chainId) {
-    return `urn:tinycloud:encryption:${(0, import_sdk_core.pkhDid)(address, chainId)}:default`;
+    return `urn:tinycloud:encryption:${(0, import_sdk_core2.pkhDid)(address, chainId)}:default`;
   }
   resolveSignInCapabilities(address, chainId) {
     const request = this.getCapabilityRequest();
     if (request === void 0) {
       const defaultNetworkId = this.defaultEncryptionNetworkId(address, chainId);
-      const primarySpaceId2 = (0, import_sdk_core.makePkhSpaceId)(address, chainId, this.spacePrefix);
-      const secretsSpaceId = (0, import_sdk_core.makePkhSpaceId)(address, chainId, "secrets");
+      const primarySpaceId2 = (0, import_sdk_core2.makePkhSpaceId)(address, chainId, this.spacePrefix);
+      const secretsSpaceId = (0, import_sdk_core2.makePkhSpaceId)(address, chainId, "secrets");
       return {
         abilities: this.defaultActions,
         spaceId: primarySpaceId2,
@@ -17587,35 +17636,35 @@ var NodeUserAuthorization = class {
       };
     }
     const rawAbilities = {};
-    const currentDid = (0, import_sdk_core.pkhDid)(address, chainId);
+    const currentDid = (0, import_sdk_core2.pkhDid)(address, chainId);
     const spaceResources = request.resources.filter((entry) => {
-      if (entry.service !== import_sdk_core.ENCRYPTION_PERMISSION_SERVICE) {
+      if (entry.service !== import_sdk_core2.ENCRYPTION_PERMISSION_SERVICE) {
         return true;
       }
       for (const action of entry.actions) {
         addRawAbility(rawAbilities, entry.path, action);
       }
       if (entry.actions.includes(DECRYPT_ACTION)) {
-        const parsed = (0, import_sdk_core.parseNetworkId)(entry.path);
+        const parsed = (0, import_sdk_core2.parseNetworkId)(entry.path);
         if (didPrincipalMatches(parsed.ownerDid, currentDid)) {
           addRawAbility(rawAbilities, entry.path, NETWORK_CREATE_ACTION);
         }
       }
       return false;
     });
-    const primarySpaceName = spaceResources.find((entry) => entry.space !== "account")?.space ?? import_sdk_core.DEFAULT_MANIFEST_SPACE;
+    const primarySpaceName = spaceResources.find((entry) => entry.space !== "account")?.space ?? import_sdk_core2.DEFAULT_MANIFEST_SPACE;
     const primarySpaceId = this.resolveSpaceName(
       primarySpaceName,
       address,
       chainId
     );
-    const bySpace = (0, import_sdk_core.resourceCapabilitiesToSpaceAbilitiesMap)(spaceResources);
+    const bySpace = (0, import_sdk_core2.resourceCapabilitiesToSpaceAbilitiesMap)(spaceResources);
     const spaceAbilities = {};
     for (const [space, abilities] of Object.entries(bySpace)) {
       spaceAbilities[this.resolveSpaceName(space, address, chainId)] = abilities;
     }
     return {
-      abilities: spaceAbilities[primarySpaceId] ?? (0, import_sdk_core.resourceCapabilitiesToAbilitiesMap)([]),
+      abilities: spaceAbilities[primarySpaceId] ?? (0, import_sdk_core2.resourceCapabilitiesToAbilitiesMap)([]),
       spaceId: primarySpaceId,
       spaceAbilities,
       rawAbilities: Object.keys(rawAbilities).length > 0 ? rawAbilities : void 0
@@ -17677,9 +17726,10 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession || !this._address || !this._chainId) {
       throw new Error("Must be signed in to host space");
     }
+    await this.ensureTinyCloudHosts();
     const host = this.primaryTinyCloudHost;
     const spaceId = targetSpaceId ?? this._tinyCloudSession.spaceId;
-    const peerId = await (0, import_sdk_core.fetchPeerId)(host, spaceId);
+    const peerId = await (0, import_sdk_core2.fetchPeerId)(host, spaceId);
     const siwe = this.wasm.generateHostSIWEMessage({
       address: this._address,
       chainId: this._chainId,
@@ -17690,7 +17740,7 @@ var NodeUserAuthorization = class {
     });
     const signature2 = await this.signMessage(siwe);
     const headers = this.wasm.siweToDelegationHeaders({ siwe, signature: signature2 });
-    const result = await (0, import_sdk_core.submitHostDelegation)(host, headers);
+    const result = await (0, import_sdk_core2.submitHostDelegation)(host, headers);
     return result.success;
   }
   /**
@@ -17719,13 +17769,15 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession) {
       throw new Error("Must be signed in to ensure space exists");
     }
+    await this.ensureTinyCloudHosts();
     const host = this.primaryTinyCloudHost;
     const primarySpaceId = this._tinyCloudSession.spaceId;
-    const result = await (0, import_sdk_core.activateSessionWithHost)(
+    const result = await (0, import_sdk_core2.activateSessionWithHost)(
       host,
       this._tinyCloudSession.delegationHeader
     );
-    const handler = this.spaceCreationHandler ?? (this.autoCreateSpace ? new import_sdk_core.AutoApproveSpaceCreationHandler() : void 0);
+    this.recordActivationSkippedSpaces(result, primarySpaceId);
+    const handler = this.spaceCreationHandler ?? (this.autoCreateSpace ? new import_sdk_core2.AutoApproveSpaceCreationHandler() : void 0);
     const creationContext = {
       spaceId: primarySpaceId,
       address: this._address,
@@ -17759,7 +17811,7 @@ var NodeUserAuthorization = class {
         throw error;
       }
       await new Promise((resolve) => setTimeout(resolve, 100));
-      const retryResult = await (0, import_sdk_core.activateSessionWithHost)(
+      const retryResult = await (0, import_sdk_core2.activateSessionWithHost)(
         host,
         this._tinyCloudSession.delegationHeader
       );
@@ -17796,7 +17848,7 @@ var NodeUserAuthorization = class {
         throw error;
       }
       await new Promise((resolve) => setTimeout(resolve, 100));
-      const retryResult = await (0, import_sdk_core.activateSessionWithHost)(
+      const retryResult = await (0, import_sdk_core2.activateSessionWithHost)(
         host,
         this._tinyCloudSession.delegationHeader
       );
@@ -17812,6 +17864,66 @@ var NodeUserAuthorization = class {
     }
     throw new Error(`Failed to activate session: ${result.error}`);
   }
+  recordActivationSkippedSpaces(result, primarySpaceId) {
+    if (result.success) {
+      this._lastActivationSkippedSpaceIds = result.skipped ?? [];
+      return;
+    }
+    this._lastActivationSkippedSpaceIds = result.status === 404 ? [primarySpaceId] : [];
+  }
+  async createBootstrapSession(options) {
+    if (!this._address || !this._chainId) {
+      throw new Error("Must be signed in before creating bootstrap sessions");
+    }
+    const address = this._address;
+    const chainId = this._chainId;
+    const keyId = `bootstrap-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    this.sessionManager.createSessionKey(keyId);
+    const jwkString = this.sessionManager.jwk(keyId);
+    if (!jwkString) {
+      throw new Error("Failed to create bootstrap session key");
+    }
+    const jwk = JSON.parse(jwkString);
+    const now = /* @__PURE__ */ new Date();
+    const expirationTime = new Date(now.getTime() + this.sessionExpirationMs);
+    const abilities = (0, import_sdk_core2.resourceCapabilitiesToAbilitiesMap)(
+      options.capabilityRequest.resources
+    );
+    const prepared = this.wasm.prepareSession({
+      abilities,
+      ...options.rawAbilities !== void 0 ? { rawAbilities: options.rawAbilities } : {},
+      address,
+      chainId,
+      domain: this.domain,
+      issuedAt: now.toISOString(),
+      expirationTime: expirationTime.toISOString(),
+      spaceId: options.spaceId,
+      jwk,
+      ...this.buildSiweOverrides()
+    });
+    const signature2 = await this.requestSignature({
+      address,
+      chainId,
+      message: prepared.siwe,
+      type: "siwe"
+    });
+    const session = this.wasm.completeSessionSetup({
+      ...prepared,
+      signature: signature2
+    });
+    return {
+      address,
+      chainId,
+      sessionKey: keyId,
+      spaceId: options.spaceId,
+      delegationCid: session.delegationCid,
+      delegationHeader: session.delegationHeader,
+      verificationMethod: this.sessionManager.getDID(keyId),
+      jwk,
+      siwe: prepared.siwe,
+      signature: signature2
+    };
+  }
   /**
    * Sign in and create a new session.
    *
@@ -17824,7 +17936,7 @@ var NodeUserAuthorization = class {
    * @param options - Optional per-call SIWE overrides for this sign-in only
    */
   async signIn(options) {
-    this._address = (0, import_sdk_core.canonicalizeAddress)(await this.signer.getAddress());
+    this._address = (0, import_sdk_core2.canonicalizeAddress)(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
     const address = this._address;
     const chainId = this._chainId;
@@ -17871,7 +17983,7 @@ var NodeUserAuthorization = class {
       siwe: prepared.siwe,
       signature: signature2
     };
-    const spacesMetadata = this.enablePublicSpace ? { public: (0, import_sdk_core.makePkhSpaceId)(address, chainId, "public") } : void 0;
+    const spacesMetadata = this.enablePublicSpace ? { public: (0, import_sdk_core2.makePkhSpaceId)(address, chainId, "public") } : void 0;
     const tinyCloudSession = {
       address,
       chainId,
@@ -17900,14 +18012,15 @@ var NodeUserAuthorization = class {
       },
       expiresAt: expirationTime.toISOString(),
       createdAt: now.toISOString(),
-      version: "1.0"
+      version: "1.0",
+      tinycloudHosts: this.tinycloudHosts
     };
     await this.sessionStorage.save(address, persistedData);
     this._session = clientSession;
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const nodeInfo = await (0, import_sdk_core.checkNodeInfo)(
+    const nodeInfo = await (0, import_sdk_core2.checkNodeInfo)(
       this.primaryTinyCloudHost,
       this.wasm.protocolVersion()
     );
@@ -17946,7 +18059,7 @@ var NodeUserAuthorization = class {
    */
   async signMessage(message) {
     if (!this._address) {
-      this._address = (0, import_sdk_core.canonicalizeAddress)(await this.signer.getAddress());
+      this._address = (0, import_sdk_core2.canonicalizeAddress)(await this.signer.getAddress());
     }
     if (!this._chainId) {
       this._chainId = await this.signer.getChainId();
@@ -17973,7 +18086,7 @@ var NodeUserAuthorization = class {
    * ```
    */
   async prepareSessionForSigning() {
-    const address = (0, import_sdk_core.canonicalizeAddress)(await this.signer.getAddress());
+    const address = (0, import_sdk_core2.canonicalizeAddress)(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     const keyId = `session-${Date.now()}`;
     this.sessionManager.renameSessionKeyId("default", keyId);
@@ -18023,7 +18136,7 @@ var NodeUserAuthorization = class {
       ...prepared,
       signature: signature2
     });
-    const address = (0, import_sdk_core.canonicalizeAddress)(await this.signer.getAddress());
+    const address = (0, import_sdk_core2.canonicalizeAddress)(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
     await this.resolveTinyCloudHostsForSignIn(address, chainId);
     const clientSession = {
@@ -18034,7 +18147,7 @@ var NodeUserAuthorization = class {
       siwe: prepared.siwe,
       signature: signature2
     };
-    const spacesMetadata = this.enablePublicSpace ? { public: (0, import_sdk_core.makePkhSpaceId)(address, chainId, "public") } : void 0;
+    const spacesMetadata = this.enablePublicSpace ? { public: (0, import_sdk_core2.makePkhSpaceId)(address, chainId, "public") } : void 0;
     const tinyCloudSession = {
       address,
       chainId,
@@ -18067,14 +18180,15 @@ var NodeUserAuthorization = class {
       },
       expiresAt,
       createdAt,
-      version: "1.0"
+      version: "1.0",
+      tinycloudHosts: this.tinycloudHosts
     };
     await this.sessionStorage.save(address, persistedData);
     this._session = clientSession;
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
-    const nodeInfo = await (0, import_sdk_core.checkNodeInfo)(
+    const nodeInfo = await (0, import_sdk_core2.checkNodeInfo)(
       this.primaryTinyCloudHost,
       this.wasm.protocolVersion()
     );
@@ -18158,32 +18272,33 @@ var NodeUserAuthorization = class {
 };
 
 // src/account/AccountService.ts
-var import_sdk_core2 = require("@tinycloud/sdk-core");
+var import_sdk_core3 = require("@tinycloud/sdk-core");
 
 // src/DelegatedAccess.ts
-var import_sdk_core3 = require("@tinycloud/sdk-core");
+var import_sdk_core4 = require("@tinycloud/sdk-core");
 var DelegatedAccess = class {
-  constructor(session, delegation, host, invoke2, telemetry) {
+  constructor(session, delegation, host, invoke2, invokeAny2, telemetry) {
     this.session = session;
     this._delegation = delegation;
     this.host = host;
-    this._serviceContext = new import_sdk_core3.ServiceContext({
+    this._serviceContext = new import_sdk_core4.ServiceContext({
       invoke: invoke2,
+      invokeAny: invokeAny2,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [host],
       telemetry
     });
     const prefix = this._delegation.path.replace(/\/$/, "");
-    this._kv = new import_sdk_core3.KVService({ prefix });
+    this._kv = new import_sdk_core4.KVService({ prefix });
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
-    this._sql = new import_sdk_core3.SQLService({});
+    this._sql = new import_sdk_core4.SQLService({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
-    this._duckdb = new import_sdk_core3.DuckDbService({});
+    this._duckdb = new import_sdk_core4.DuckDbService({});
     this._duckdb.initialize(this._serviceContext);
     this._serviceContext.registerService("duckdb", this._duckdb);
-    this._hooks = new import_sdk_core3.HooksService({});
+    this._hooks = new import_sdk_core4.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -18333,7 +18448,7 @@ function createWasmKeyProvider(sessionManager) {
 }
 
 // src/delegateToHelpers.ts
-var import_sdk_core4 = require("@tinycloud/sdk-core");
+var import_sdk_core5 = require("@tinycloud/sdk-core");
 function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   const byService = /* @__PURE__ */ new Map();
   for (const a of actions) {
@@ -18364,7 +18479,7 @@ function legacyParamsToPermissionEntries(actions, path, spaceIdOverride) {
   }
   return entries;
 }
-var DEFAULT_DELEGATION_EXPIRY_MS = import_sdk_core4.EXPIRY.SESSION_MS;
+var DEFAULT_DELEGATION_EXPIRY_MS = import_sdk_core5.EXPIRY.SESSION_MS;
 function resolveExpiryMs(expiry) {
   if (expiry === void 0) {
     return DEFAULT_DELEGATION_EXPIRY_MS;
@@ -18377,10 +18492,10 @@ function resolveExpiryMs(expiry) {
     }
     return expiry;
   }
-  return (0, import_sdk_core4.parseExpiry)(expiry);
+  return (0, import_sdk_core5.parseExpiry)(expiry);
 }
 function extractSiweExpiration(siwe) {
-  const parsed = new import_sdk_core4.SiweMessage(siwe);
+  const parsed = new import_sdk_core5.SiweMessage(siwe);
   if (parsed.expirationTime === void 0 || parsed.expirationTime === null) {
     return void 0;
   }
@@ -18394,7 +18509,7 @@ function extractSiweExpiration(siwe) {
 }
 
 // src/NodeSecretsService.ts
-var import_sdk_core5 = require("@tinycloud/sdk-core");
+var import_sdk_core6 = require("@tinycloud/sdk-core");
 var SECRETS_SPACE = "secrets";
 function ok() {
   return { ok: true, data: void 0 };
@@ -18425,12 +18540,12 @@ function displayActionUrn(action) {
 function secretActionName(action) {
   return action;
 }
-function secretPermissionEntries(name, options, action, encryptionNetworkId) {
+function secretPermissionEntries(name, options, action, space, encryptionNetworkId) {
   const entries = [];
-  const path = action === "list" ? (0, import_sdk_core5.resolveSecretListPrefix)(options) : (0, import_sdk_core5.resolveSecretPath)(name, options).permissionPaths.vault;
+  const path = action === "list" ? (0, import_sdk_core6.resolveSecretListPrefix)(options) : (0, import_sdk_core6.resolveSecretPath)(name, options).permissionPaths.vault;
   entries.push({
     service: "tinycloud.kv",
-    space: SECRETS_SPACE,
+    space,
     path,
     actions: [secretActionName(action)],
     skipPrefix: true
@@ -18445,11 +18560,23 @@ function secretPermissionEntries(name, options, action, encryptionNetworkId) {
   }
   return entries;
 }
+function normalizeSpace(space, resolveSpace) {
+  if (!space) return void 0;
+  if (space.startsWith("tinycloud:")) return space;
+  return resolveSpace?.(space) ?? space;
+}
+function spaceMatches(granted, requested, resolveSpace) {
+  if (!granted || !requested) return false;
+  return normalizeSpace(granted, resolveSpace) === normalizeSpace(requested, resolveSpace);
+}
 var NodeSecretsService = class {
   constructor(config) {
     this.config = config;
     this.shouldRestoreUnlock = false;
   }
+  get space() {
+    return this.config.space ?? SECRETS_SPACE;
+  }
   get vault() {
     return this.service.vault;
   }
@@ -18502,11 +18629,12 @@ var NodeSecretsService = class {
         name,
         options,
         action,
+        this.space,
         action === "get" ? this.config.getEncryptionNetworkId?.() : void 0
       );
     } catch (error) {
       return secretsError(
-        import_sdk_core5.ErrorCodes.INVALID_INPUT,
+        import_sdk_core6.ErrorCodes.INVALID_INPUT,
         error instanceof Error ? error.message : String(error),
         error instanceof Error ? error : void 0
       );
@@ -18516,7 +18644,7 @@ var NodeSecretsService = class {
     }
     if (!this.config.canEscalate()) {
       return secretsError(
-        import_sdk_core5.ErrorCodes.PERMISSION_DENIED,
+        import_sdk_core6.ErrorCodes.PERMISSION_DENIED,
         `Cannot autosign ${displayActionUrn(action)} for ${target}; TinyCloudNode needs wallet mode with a signer or privateKey.`
       );
     }
@@ -18525,7 +18653,7 @@ var NodeSecretsService = class {
       return this.restoreUnlockAfterEscalation();
     } catch (error) {
       return secretsError(
-        import_sdk_core5.ErrorCodes.PERMISSION_DENIED,
+        import_sdk_core6.ErrorCodes.PERMISSION_DENIED,
         error instanceof Error ? error.message : `Autosign escalation for ${displayActionUrn(action)} on ${target} failed.`,
         error instanceof Error ? error : void 0
       );
@@ -18546,12 +18674,12 @@ var NodeSecretsService = class {
       return false;
     }
     const manifests = Array.isArray(manifest) ? manifest : [manifest];
-    const requestedEntries = (0, import_sdk_core5.expandPermissionEntries)(permissionEntries);
+    const requestedEntries = (0, import_sdk_core6.expandPermissionEntries)(permissionEntries);
     return requestedEntries.every(
       (entry) => manifests.some((candidate) => {
-        const resolved = (0, import_sdk_core5.resolveManifest)(candidate);
+        const resolved = (0, import_sdk_core6.resolveManifest)(candidate);
         return resolved.resources.some(
-          (resource) => resource.service === entry.service && resource.space === entry.space && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
+          (resource) => resource.service === entry.service && spaceMatches(resource.space, entry.space, this.config.resolveSpace) && resource.path === entry.path && entry.actions.every((action) => resource.actions.includes(action))
         );
       })
     );
@@ -18564,14 +18692,31 @@ var DEFAULT_ENCRYPTION_NETWORK_NAME = "default";
 var NETWORK_CREATE_ACTION2 = "tinycloud.encryption/network.create";
 var DECRYPT_ACTION2 = "tinycloud.encryption/decrypt";
 var NETWORK_ADMIN_TYPE = "tinycloud.encryption.network-admin/v1";
-var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core6.EXPIRY.SESSION_MS;
+var DEFAULT_SESSION_EXPIRATION_MS = import_sdk_core7.EXPIRY.SESSION_MS;
+function isOpenKeyAutoSignStrategy(strategy) {
+  return strategy?.openKeyAutoSign === true;
+}
 function didPrincipalMatches2(actual, expected) {
   try {
-    return (0, import_sdk_core6.principalDidEquals)(actual, expected);
+    return (0, import_sdk_core7.principalDidEquals)(actual, expected);
   } catch {
     return actual === expected;
   }
 }
+function sharingActionsToAbilities(path, actions) {
+  var _a;
+  const abilities = {};
+  for (const action of actions) {
+    const slash = action.indexOf("/");
+    if (slash === -1) return void 0;
+    const shortService = import_sdk_core7.SERVICE_LONG_TO_SHORT[action.slice(0, slash)];
+    if (shortService === void 0) return void 0;
+    abilities[shortService] ?? (abilities[shortService] = {});
+    (_a = abilities[shortService])[path] ?? (_a[path] = []);
+    abilities[shortService][path].push(action);
+  }
+  return Object.keys(abilities).length > 0 ? abilities : void 0;
+}
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
@@ -18684,6 +18829,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.auth = null;
     this.tc = null;
     this._chainId = 1;
+    this._baseSecrets = /* @__PURE__ */ new Map();
+    this._secrets = /* @__PURE__ */ new Map();
     this.runtimePermissionGrants = [];
     this.invokeWithRuntimePermissions = (session, service, path, action, facts) => {
       return this.wasmBindings.invoke(
@@ -18733,12 +18880,12 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Failed to get session key JWK");
     }
     this.sessionKeyJwk = JSON.parse(jwkStr);
-    this._capabilityRegistry = new import_sdk_core6.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core7.CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({
       sessionManager: this.sessionManager
     });
-    this.notificationHandler = config.notificationHandler ?? new import_sdk_core6.SilentNotificationHandler();
-    this._sharingService = new import_sdk_core6.SharingService({
+    this.notificationHandler = config.notificationHandler ?? new import_sdk_core7.SilentNotificationHandler();
+    this._sharingService = new import_sdk_core7.SharingService({
       hosts: [this.config.host],
       // session: undefined - not needed for receive()
       invoke: this.invokeWithRuntimePermissions,
@@ -18748,8 +18895,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       // delegationManager: undefined - not needed for receive()
       createKVService: (config2) => {
         const prefix = config2.pathPrefix?.replace(/\/$/, "");
-        const kvService = new import_sdk_core6.KVService({ prefix });
-        const kvContext = new import_sdk_core6.ServiceContext({
+        const kvService = new import_sdk_core7.KVService({ prefix });
+        const kvContext = new import_sdk_core7.ServiceContext({
           invoke: config2.invoke,
           fetch: config2.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config2.hosts,
@@ -18789,9 +18936,10 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @internal
    */
   setupAuth(config) {
+    const useBootstrapSignInRequest = this.shouldUseBootstrapSignInRequest(config);
     this.auth = new NodeUserAuthorization({
       signer: this.signer,
-      signStrategy: { type: "auto-sign" },
+      signStrategy: config.signStrategy ?? { type: "auto-sign" },
       wasmBindings: this.wasmBindings,
       sessionStorage: config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
@@ -18800,20 +18948,23 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: config.tinycloudFallbackHosts,
-      autoCreateSpace: config.autoCreateSpace,
+      autoCreateSpace: useBootstrapSignInRequest ? false : config.autoCreateSpace,
       enablePublicSpace: config.enablePublicSpace ?? true,
-      spaceCreationHandler: config.spaceCreationHandler,
+      spaceCreationHandler: useBootstrapSignInRequest ? void 0 : config.spaceCreationHandler,
       nonce: config.nonce,
       siweConfig: config.siweConfig,
-      manifest: config.manifest,
-      capabilityRequest: config.capabilityRequest,
-      includeAccountRegistryPermissions: config.includeAccountRegistryPermissions
+      manifest: useBootstrapSignInRequest ? void 0 : config.manifest,
+      capabilityRequest: useBootstrapSignInRequest ? import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS.default : config.capabilityRequest,
+      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : config.includeAccountRegistryPermissions
     });
-    this.tc = new import_sdk_core6.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core7.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: config.telemetry
     });
   }
+  shouldUseBootstrapSignInRequest(config) {
+    return config.autoBootstrapAccount !== false && config.manifest === void 0 && config.capabilityRequest === void 0 && (config.prefix ?? "default") === "default" && isOpenKeyAutoSignStrategy(config.signStrategy);
+  }
   syncResolvedHostFromAuth() {
     const host = this.auth?.hosts[0];
     if (host) {
@@ -18870,7 +19021,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    */
   get did() {
     if (this._address) {
-      return (0, import_sdk_core6.pkhDid)(this._address, this._chainId);
+      return (0, import_sdk_core7.pkhDid)(this._address, this._chainId);
     }
     return this.sessionManager.getDID(this.sessionKeyId);
   }
@@ -18912,14 +19063,14 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._address) {
       return void 0;
     }
-    return this.wasmBindings.makeSpaceId(this._address, this._chainId, import_sdk_core6.ACCOUNT_REGISTRY_SPACE);
+    return this.wasmBindings.makeSpaceId(this._address, this._chainId, import_sdk_core7.ACCOUNT_REGISTRY_SPACE);
   }
   /**
    * Account-level application and delegation helpers.
    */
   get account() {
     if (!this._account) {
-      this._account = new import_sdk_core2.AccountService({
+      this._account = new import_sdk_core3.AccountService({
         getDid: () => this.did,
         getHost: () => this.hosts[0] ?? this.config.host,
         getPrimarySpaceId: () => this.spaceId,
@@ -18928,7 +19079,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         getAccountDb: () => this.accountSpaceId ? this.sqlForSpace(this.accountSpaceId).db("account") : void 0,
         ensureAccountSpaceHosted: async () => {
           if (this.accountSpaceId && this.auth) {
-            await this.ensureOwnedSpaceHosted(this.accountSpaceId);
+            await this.ensureOwnedSpaceHostedById(this.accountSpaceId);
           }
         }
       });
@@ -18942,6 +19093,13 @@ var _TinyCloudNode = class _TinyCloudNode {
   get session() {
     return this.auth?.tinyCloudSession;
   }
+  /**
+   * Get the currently active session in the shape callers can persist and later
+   * pass back to {@link restoreSession}.
+   */
+  get restorableSession() {
+    return this.currentTinyCloudSession();
+  }
   /**
    * Sign in and create a new session.
    * This creates the user's space if it doesn't exist.
@@ -18956,7 +19114,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     await this.wasmBindings.ensureInitialized?.();
-    this._address = (0, import_sdk_core6.canonicalizeAddress)(await this.signer.getAddress());
+    this._address = (0, import_sdk_core7.canonicalizeAddress)(await this.signer.getAddress());
     this._chainId = await this.signer.getChainId();
     this._kv = void 0;
     this._sql = void 0;
@@ -18964,19 +19122,22 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._hooks = void 0;
     this._vault = void 0;
     this._encryption = void 0;
-    this._baseSecrets = void 0;
-    this._secrets = void 0;
+    this._baseSecrets.clear();
+    this._secrets.clear();
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
     this.initializeServices();
+    const bootstrapped = await this.bootstrapAccountIfNeeded();
     await this.ensureRequestedEncryptionNetworks();
-    if (this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
-      await this.ensureOwnedSpaceHosted(this.ownedSpaceId("secrets"));
+    if (!bootstrapped && this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
+      await this.ensureOwnedSpaceHostedById(this.ownedSpaceId(import_sdk_core7.SECRETS_SPACE));
+    }
+    if (!bootstrapped) {
+      this.scheduleAccountRegistrySync();
     }
-    this.scheduleAccountRegistrySync();
     this.notificationHandler.success("Successfully signed in");
   }
   ownedSpaceId(name) {
@@ -18985,6 +19146,208 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return this.wasmBindings.makeSpaceId(this._address, this._chainId, name);
   }
+  async bootstrapAccountIfNeeded() {
+    if (this.config.autoBootstrapAccount === false) {
+      return false;
+    }
+    if (!this.auth || !this._address) {
+      return false;
+    }
+    const steps = (0, import_sdk_core7.bootstrapSteps)(this._address, this._chainId);
+    if (!await this.isFreshBootstrapAccount(steps)) {
+      return false;
+    }
+    await this.runAccountBootstrap(steps);
+    return true;
+  }
+  async isFreshBootstrapAccount(steps) {
+    const enshrinedSpaceIds = /* @__PURE__ */ new Set();
+    for (const step of steps) {
+      if (step.kind === "session") {
+        enshrinedSpaceIds.add(step.spaceId);
+      }
+    }
+    const skipped = this.auth.lastActivationSkippedSpaceIds;
+    if (skipped.some((spaceId) => enshrinedSpaceIds.has(spaceId))) {
+      return true;
+    }
+    try {
+      const indexed = await this.account.index.spaces.list();
+      if (indexed.ok && indexed.data.length === 0) {
+        return true;
+      }
+    } catch {
+    }
+    try {
+      const spaces = await this.account.spaces.list();
+      return spaces.ok && spaces.data.length === 0;
+    } catch {
+      return false;
+    }
+  }
+  async runAccountBootstrap(steps) {
+    if (!this.auth || !this._address) {
+      throw new Error("Account bootstrap requires an active wallet session");
+    }
+    const host = this.hosts[0] ?? this.config.host;
+    if (!host) {
+      throw new Error("Account bootstrap requires a TinyCloud host");
+    }
+    const auth = this.auth;
+    const sessions = /* @__PURE__ */ new Map();
+    const rawAbilitiesBySpace = /* @__PURE__ */ new Map();
+    const primarySession = auth.tinyCloudSession;
+    const defaultSpaceId = this.ownedSpaceId("default");
+    const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS.default;
+    for (const step of steps) {
+      if (step.kind !== "session") continue;
+      if (step.space === "default" && canReusePrimaryBootstrapSession && primarySession) {
+        sessions.set(step.space, primarySession);
+        continue;
+      }
+      const rawAbilities = step.rawAbilities;
+      if (rawAbilities) {
+        rawAbilitiesBySpace.set(step.space, rawAbilities);
+      }
+      const session = await auth.createBootstrapSession({
+        spaceId: step.spaceId,
+        capabilityRequest: step.request ?? import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS[step.space],
+        rawAbilities
+      });
+      sessions.set(step.space, session);
+    }
+    for (const step of steps) {
+      if (step.kind !== "host") continue;
+      const hosted = await auth.hostOwnedSpace(step.spaceId);
+      if (!hosted) {
+        throw new Error(`Failed to host bootstrap space: ${step.spaceId}`);
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+    for (const step of steps) {
+      if (step.kind !== "activate") continue;
+      const session = sessions.get(step.space);
+      if (!session) {
+        throw new Error(`Missing bootstrap session for ${step.space}`);
+      }
+      const activated = await (0, import_sdk_core7.activateSessionWithHost)(host, session.delegationHeader);
+      if (!activated.success || activated.skipped?.includes(step.spaceId)) {
+        throw new Error(
+          `Failed to activate bootstrap session for ${step.spaceId}: ${activated.error ?? "space was skipped"}`
+        );
+      }
+      this.registerBootstrapRuntimeGrant(
+        session,
+        import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS[step.space],
+        rawAbilitiesBySpace.get(step.space)
+      );
+    }
+    for (const step of steps) {
+      if (step.kind === "account-index-schema") {
+        const ensured = await this.account.index.ensure();
+        if (!ensured.ok) {
+          throw new Error(`Failed to create account index schema: ${ensured.error.message}`);
+        }
+      }
+      if (step.kind === "seed-spaces") {
+        for (const space of step.spaces) {
+          const registered = await this.account.spaces.register({
+            spaceId: space.spaceId,
+            name: space.name,
+            ownerDid: this.did,
+            type: "owned",
+            permissions: ["*"],
+            status: "active"
+          });
+          if (!registered.ok) {
+            throw new Error(
+              `Failed to seed account space ${space.spaceId}: ${registered.error.message}`
+            );
+          }
+        }
+      }
+      if (step.kind === "seed-applications") {
+        const registered = await this.account.applications.register(
+          step.manifests.length > 0 ? [...step.manifests] : import_sdk_core7.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST
+        );
+        if (!registered.ok) {
+          throw new Error(`Failed to seed bootstrap applications: ${registered.error.message}`);
+        }
+      }
+      if (step.kind === "encryption-network-create") {
+        await this.ensureEncryptionNetwork(step.networkId);
+      }
+      if (step.kind === "secret-records-schema") {
+        const db = this.sqlForSpace(step.spaceId).db(step.database);
+        const migrated = await db.migrations.apply({
+          namespace: "tinycloud.secrets.records",
+          migrations: [
+            {
+              id: "001_initial",
+              sql: [...import_sdk_core7.SECRET_RECORDS_SCHEMA]
+            }
+          ]
+        });
+        if (!migrated.ok) {
+          throw new Error(
+            `Failed to create secret_records schema: ${migrated.error.message}`
+          );
+        }
+      }
+    }
+  }
+  registerBootstrapRuntimeGrant(session, request, rawAbilities) {
+    const operations = [];
+    for (const resource of request.resources) {
+      const service = resource.service.startsWith("tinycloud.") ? this.shortServiceName(resource.service) : resource.service;
+      const spaceId = resource.space.startsWith("tinycloud:") ? resource.space : this.ownedSpaceId(resource.space);
+      for (const action of resource.actions) {
+        operations.push({
+          spaceId,
+          service,
+          path: resource.path,
+          action
+        });
+      }
+    }
+    for (const [resource, actions2] of Object.entries(rawAbilities ?? {})) {
+      for (const action of actions2) {
+        operations.push({
+          resource,
+          service: "encryption",
+          path: resource,
+          action
+        });
+      }
+    }
+    const expiresAt = extractSiweExpiration(session.siwe) ?? this.getSessionExpiry();
+    const actions = [...new Set(operations.map((operation) => operation.action))];
+    this.runtimePermissionGrants.push({
+      session: {
+        delegationHeader: session.delegationHeader,
+        delegationCid: session.delegationCid,
+        spaceId: session.spaceId,
+        verificationMethod: session.verificationMethod,
+        jwk: session.jwk
+      },
+      delegation: {
+        cid: session.delegationCid,
+        delegationHeader: session.delegationHeader,
+        delegateDID: session.verificationMethod,
+        delegatorDID: this.did,
+        spaceId: session.spaceId,
+        path: "",
+        actions,
+        expiry: expiresAt,
+        allowSubDelegation: true,
+        ownerAddress: session.address,
+        chainId: session.chainId,
+        host: this.config.host
+      },
+      operations,
+      expiresAt
+    });
+  }
   async writeManifestRegistryRecords() {
     const request = this.capabilityRequest;
     if (!request || request.registryRecords.length === 0) {
@@ -18993,8 +19356,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.signer) {
       throw new Error("Manifest registry write requires wallet mode");
     }
-    const accountSpaceId = this.ownedSpaceId(import_sdk_core6.ACCOUNT_REGISTRY_SPACE);
-    await this.ensureOwnedSpaceHosted(accountSpaceId);
+    const accountSpaceId = this.ownedSpaceId(import_sdk_core7.ACCOUNT_REGISTRY_SPACE);
+    await this.ensureOwnedSpaceHostedById(accountSpaceId);
     const result = await this.account.applications.register(request.manifests);
     if (!result.ok) {
       throw new Error(
@@ -19004,6 +19367,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   scheduleAccountRegistrySync() {
     void this.withAccountRegistryRetry(async () => {
+      void this.account.index.ensure();
       await this.writeManifestRegistryRecords();
       const spaces = await this.account.spaces.syncAccessible();
       if (!spaces.ok) {
@@ -19037,7 +19401,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const networkIds = /* @__PURE__ */ new Set();
     for (const resource of request.resources) {
-      if (resource.service === import_sdk_core6.ENCRYPTION_PERMISSION_SERVICE && resource.path.startsWith("urn:tinycloud:encryption:") && resource.actions.includes(DECRYPT_ACTION2)) {
+      if (resource.service === import_sdk_core7.ENCRYPTION_PERMISSION_SERVICE && resource.path.startsWith("urn:tinycloud:encryption:") && resource.actions.includes(DECRYPT_ACTION2)) {
         networkIds.add(resource.path);
       }
     }
@@ -19048,14 +19412,14 @@ var _TinyCloudNode = class _TinyCloudNode {
       return;
     }
     for (const networkId of this.requestedEncryptionNetworkIds()) {
-      const parsed = (0, import_sdk_core6.parseNetworkId)(networkId);
+      const parsed = (0, import_sdk_core7.parseNetworkId)(networkId);
       if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
         continue;
       }
       await this.ensureEncryptionNetwork(networkId);
     }
   }
-  async ensureOwnedSpaceHosted(spaceId) {
+  async ensureOwnedSpaceHostedById(spaceId) {
     if (!this.auth) {
       throw new Error("Owned space hosting requires wallet mode");
     }
@@ -19067,7 +19431,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!host) {
       throw new Error("Owned space hosting requires a TinyCloud host");
     }
-    const activation = await (0, import_sdk_core6.activateSessionWithHost)(host, session.delegationHeader);
+    const activation = await (0, import_sdk_core7.activateSessionWithHost)(host, session.delegationHeader);
     if (activation.success && !activation.skipped?.includes(spaceId)) {
       return;
     }
@@ -19081,7 +19445,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error(`Failed to create owned space: ${spaceId}`);
     }
     await new Promise((resolve) => setTimeout(resolve, 100));
-    const retry = await (0, import_sdk_core6.activateSessionWithHost)(host, session.delegationHeader);
+    const retry = await (0, import_sdk_core7.activateSessionWithHost)(host, session.delegationHeader);
     if (!retry.success || retry.skipped?.includes(spaceId)) {
       throw new Error(
         `Failed to activate session after creating owned space ${spaceId}: ${retry.error ?? "space was skipped"}`
@@ -19098,7 +19462,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * caller is the root authority of their own owned spaces, so no additional
    * delegation is required.
    *
-   * Unlike {@link ensureOwnedSpaceHosted}, this always submits the host
+   * Unlike {@link ensureOwnedSpaceHostedById}, this always submits the host
    * delegation rather than inferring hosting from session activation: a space
    * the current session has never referenced is reported neither as
    * `activated` nor `skipped`, so activation-based detection would wrongly
@@ -19123,7 +19487,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!hosted) {
       throw new Error(`Failed to host owned space: ${spaceId}`);
     }
-    const activation = await (0, import_sdk_core6.activateSessionWithHost)(
+    const activation = await (0, import_sdk_core7.activateSessionWithHost)(
       host,
       this.auth.tinyCloudSession.delegationHeader
     );
@@ -19143,6 +19507,91 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     return spaceId;
   }
+  /**
+   * Ensure one of this user's owned spaces (e.g. `"secrets"`) is hosted on the
+   * server.
+   *
+   * At sign-in, a full-authority session auto-hosts the owner's `secrets`
+   * space, but a session created with a manifest / capabilityRequest does not.
+   * Such a session can therefore hold valid `tinycloud.kv/*` capabilities for
+   * the owned `secrets` space yet still fail its first scoped
+   * `secrets.put(...)` with `404 Space not found`, because the space was never
+   * registered on the node.
+   *
+   * Calling this resolves `name` to the owner's owned-space URI
+   * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`). It first consults the
+   * account-space spaces registry (`account/spaces/{space_id}`, the canonical
+   * KV source of truth, fronted by a best-effort SQLite index): if the space is
+   * already registered/hosted it returns the URI WITHOUT submitting a host
+   * delegation, avoiding a redundant host-SIWE signature prompt for owners who
+   * already use the space. Only when the space is absent — or the registry
+   * check fails for any reason (e.g. a cold SQLite index reporting
+   * `no such table: spaces`) — does it fall through to {@link hostOwnedSpace}.
+   *
+   * The registry check is purely an optimization: any failure falls back to
+   * hosting, and the host SIWE is idempotent server-side, so re-hosting an
+   * existing space remains a safe no-op. Must be called after {@link signIn}.
+   *
+   * @param name - The owned space name (e.g. `"secrets"`).
+   * @returns The hosted owned-space URI.
+   */
+  async ensureOwnedSpaceHosted(name) {
+    if (!this.auth || !this.auth.tinyCloudSession) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    const spaceId = this.ownedSpaceId(name);
+    if (await this.isOwnedSpaceRegistered(spaceId)) {
+      return spaceId;
+    }
+    const hosted = await this.hostOwnedSpace(name);
+    try {
+      await this.account.spaces.register({
+        spaceId,
+        name,
+        ownerDid: this.did,
+        type: "owned",
+        permissions: ["*"],
+        status: "active"
+      });
+    } catch {
+    }
+    return hosted;
+  }
+  /**
+   * Check whether an owned space is already registered/hosted by consulting the
+   * account spaces registry.
+   *
+   * Source of truth is the canonical KV registry record
+   * `account/spaces/{space_id}`, read here via `account.spaces.get(spaceId)`.
+   * The KV path is used (rather than `syncAccessible()`) because it works under
+   * a manifest/recap session with NO extra prompt: the composed manifest recap
+   * already grants `tinycloud.kv get/list` on the account space `spaces/`
+   * prefix, whereas `syncAccessible()` depends on `tinycloud.space/list`, which
+   * a recap session does not hold. Before reading, it consults the fast SQLite
+   * index (`account.index.spaces.list()`) as a best-effort short-circuit; on a
+   * cold index (`no such table: spaces`) or any other index failure it falls
+   * back to the canonical KV read.
+   *
+   * This is a best-effort optimization. ANY failure of the check path (missing
+   * table, KV error, missing record, thrown exception) resolves to `false` so
+   * the caller falls through to hosting — per the directive, "if it fails in any
+   * way then create the space".
+   */
+  async isOwnedSpaceRegistered(spaceId) {
+    try {
+      const indexed = await this.account.index.spaces.list();
+      if (indexed.ok && indexed.data.some((space) => space.spaceId === spaceId)) {
+        return true;
+      }
+    } catch {
+    }
+    try {
+      const record = await this.account.spaces.get(spaceId);
+      return record.ok;
+    } catch {
+      return false;
+    }
+  }
   /**
    * Restore a previously established session from stored delegation data.
    *
@@ -19160,35 +19609,43 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._hooks = void 0;
     this._vault = void 0;
     this._encryption = void 0;
-    this._baseSecrets = void 0;
-    this._secrets = void 0;
+    this._baseSecrets.clear();
+    this._secrets.clear();
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
-    const restoredAddress = sessionData.address ? (0, import_sdk_core6.canonicalizeAddress)(sessionData.address) : void 0;
+    const restoredAddress = sessionData.address ? (0, import_sdk_core7.canonicalizeAddress)(sessionData.address) : void 0;
     if (restoredAddress) {
       this._address = restoredAddress;
     }
     if (sessionData.chainId) {
       this._chainId = sessionData.chainId;
     }
-    this._serviceContext = new import_sdk_core6.ServiceContext({
+    const resolvedHost = await this.resolveRestoredHost(
+      sessionData.tinycloudHosts,
+      restoredAddress,
+      sessionData.chainId
+    );
+    if (resolvedHost) {
+      this.config.host = resolvedHost;
+    }
+    this._serviceContext = new import_sdk_core7.ServiceContext({
       invoke: this.invokeWithRuntimePermissions,
       invokeAny: this.invokeAnyWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [this.config.host],
       telemetry: this.config.telemetry
     });
-    this._kv = new import_sdk_core6.KVService({});
+    this._kv = new import_sdk_core7.KVService({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
-    this._sql = new import_sdk_core6.SQLService({});
+    this._sql = new import_sdk_core7.SQLService({});
     this._sql.initialize(this._serviceContext);
     this._serviceContext.registerService("sql", this._sql);
-    this._duckdb = new import_sdk_core6.DuckDbService({});
+    this._duckdb = new import_sdk_core7.DuckDbService({});
     this._duckdb.initialize(this._serviceContext);
     this._serviceContext.registerService("duckdb", this._duckdb);
-    this._hooks = new import_sdk_core6.HooksService({});
+    this._hooks = new import_sdk_core7.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -19217,12 +19674,45 @@ var _TinyCloudNode = class _TinyCloudNode {
         signature: sessionData.signature ?? ""
       };
       if (this.auth) {
-        this.auth.setRestoredTinyCloudSession(tcSession);
+        this.auth.setRestoredTinyCloudSession(
+          tcSession,
+          this.config.host ? [this.config.host] : void 0
+        );
       } else {
         this._restoredTcSession = tcSession;
       }
     }
   }
+  /**
+   * Resolve the host a restored session should target.
+   *
+   * Mirrors fresh sign-in host resolution but for the restore path:
+   * an explicit/pinned host always wins, then the hosts the session was
+   * persisted with, then a lazy registry/fallback resolution for sessions
+   * that predate the persisted `tinycloudHosts` field. Returns `undefined`
+   * only when there's nothing to resolve from (no explicit host, no
+   * persisted hosts, and no address/chainId) — in which case the existing
+   * `config.host` (default) is left in place.
+   *
+   * Resolution failures are surfaced, not swallowed: a genuinely broken
+   * registry lookup throws rather than silently falling back to a wrong host.
+   */
+  async resolveRestoredHost(persistedHosts, address, chainId) {
+    if (this.explicitHost) {
+      return this.explicitHost;
+    }
+    if (persistedHosts && persistedHosts.length > 0) {
+      return persistedHosts[0];
+    }
+    if (address === void 0 || chainId === void 0) {
+      return void 0;
+    }
+    const resolved = await (0, import_sdk_core7.resolveTinyCloudHosts)((0, import_sdk_core7.pkhDid)(address, chainId), {
+      registryUrl: this.config.tinycloudRegistryUrl,
+      fallbackHosts: this.config.tinycloudFallbackHosts
+    });
+    return resolved.hosts[0];
+  }
   /**
    * Resolve the currently-active TinyCloudSession, preferring the auth
    * layer's value (wallet mode) and falling back to the node-level
@@ -19267,9 +19757,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     this.signer = _TinyCloudNode.nodeDefaults.createSigner(privateKey);
+    const authConfig = { ...this.config, prefix };
+    const useBootstrapSignInRequest = this.shouldUseBootstrapSignInRequest(authConfig);
     this.auth = new NodeUserAuthorization({
       signer: this.signer,
-      signStrategy: { type: "auto-sign" },
+      signStrategy: this.config.signStrategy ?? { type: "auto-sign" },
       wasmBindings: this.wasmBindings,
       sessionStorage: options?.sessionStorage ?? this.config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
@@ -19278,16 +19770,16 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: this.config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: this.config.tinycloudFallbackHosts,
-      autoCreateSpace: this.config.autoCreateSpace,
+      autoCreateSpace: useBootstrapSignInRequest ? false : this.config.autoCreateSpace,
       enablePublicSpace: this.config.enablePublicSpace ?? true,
-      spaceCreationHandler: this.config.spaceCreationHandler,
+      spaceCreationHandler: useBootstrapSignInRequest ? void 0 : this.config.spaceCreationHandler,
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
-      manifest: this.config.manifest,
-      capabilityRequest: this.config.capabilityRequest,
-      includeAccountRegistryPermissions: this.config.includeAccountRegistryPermissions
+      manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
+      capabilityRequest: useBootstrapSignInRequest ? import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
     });
-    this.tc = new import_sdk_core6.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core7.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: this.config.telemetry
     });
@@ -19312,9 +19804,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const prefix = options?.prefix ?? "default";
     this.signer = signer;
+    const authConfig = { ...this.config, prefix };
+    const useBootstrapSignInRequest = this.shouldUseBootstrapSignInRequest(authConfig);
     this.auth = new NodeUserAuthorization({
       signer: this.signer,
-      signStrategy: { type: "auto-sign" },
+      signStrategy: this.config.signStrategy ?? { type: "auto-sign" },
       wasmBindings: this.wasmBindings,
       sessionStorage: options?.sessionStorage ?? this.config.sessionStorage ?? new MemorySessionStorage(),
       domain: this.siweDomain,
@@ -19323,16 +19817,16 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: this.config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: this.config.tinycloudFallbackHosts,
-      autoCreateSpace: this.config.autoCreateSpace,
+      autoCreateSpace: useBootstrapSignInRequest ? false : this.config.autoCreateSpace,
       enablePublicSpace: this.config.enablePublicSpace ?? true,
-      spaceCreationHandler: this.config.spaceCreationHandler,
+      spaceCreationHandler: useBootstrapSignInRequest ? void 0 : this.config.spaceCreationHandler,
       nonce: this.config.nonce,
       siweConfig: this.config.siweConfig,
-      manifest: this.config.manifest,
-      capabilityRequest: this.config.capabilityRequest,
-      includeAccountRegistryPermissions: this.config.includeAccountRegistryPermissions
+      manifest: useBootstrapSignInRequest ? void 0 : this.config.manifest,
+      capabilityRequest: useBootstrapSignInRequest ? import_sdk_core7.BOOTSTRAP_SESSION_REQUESTS.default : this.config.capabilityRequest,
+      includeAccountRegistryPermissions: useBootstrapSignInRequest ? false : this.config.includeAccountRegistryPermissions
     });
-    this.tc = new import_sdk_core6.TinyCloud(this.auth, {
+    this.tc = new import_sdk_core7.TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
       telemetry: this.config.telemetry
     });
@@ -19348,28 +19842,28 @@ var _TinyCloudNode = class _TinyCloudNode {
       return;
     }
     this.tc.initializeServices(this.invokeWithRuntimePermissions, [this.config.host]);
-    this._serviceContext = new import_sdk_core6.ServiceContext({
+    this._serviceContext = new import_sdk_core7.ServiceContext({
       invoke: this.invokeWithRuntimePermissions,
       invokeAny: this.invokeAnyWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis),
       hosts: [this.config.host],
       telemetry: this.config.telemetry
     });
-    this._kv = new import_sdk_core6.KVService({});
+    this._kv = new import_sdk_core7.KVService({});
     this._kv.initialize(this._serviceContext);
     this._serviceContext.registerService("kv", this._kv);
     const features = this.nodeFeatures;
     if (features.length === 0 || features.includes("sql")) {
-      this._sql = new import_sdk_core6.SQLService({});
+      this._sql = new import_sdk_core7.SQLService({});
       this._sql.initialize(this._serviceContext);
       this._serviceContext.registerService("sql", this._sql);
     }
     if (features.length === 0 || features.includes("duckdb")) {
-      this._duckdb = new import_sdk_core6.DuckDbService({});
+      this._duckdb = new import_sdk_core7.DuckDbService({});
       this._duckdb.initialize(this._serviceContext);
       this._serviceContext.registerService("duckdb", this._duckdb);
     }
-    this._hooks = new import_sdk_core6.HooksService({});
+    this._hooks = new import_sdk_core7.HooksService({});
     this._hooks.initialize(this._serviceContext);
     this._serviceContext.registerService("hooks", this._hooks);
     const serviceSession = {
@@ -19387,9 +19881,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.initializeV2Services(serviceSession);
   }
   createSpaceScopedKVService(spaceId) {
-    const kvService = new import_sdk_core6.KVService({});
+    const kvService = new import_sdk_core7.KVService({});
     if (this._serviceContext) {
-      const spaceScopedContext = new import_sdk_core6.ServiceContext({
+      const spaceScopedContext = new import_sdk_core7.ServiceContext({
         invoke: this._serviceContext.invoke,
         fetch: this._serviceContext.fetch,
         hosts: this._serviceContext.hosts,
@@ -19406,6 +19900,20 @@ var _TinyCloudNode = class _TinyCloudNode {
   getDefaultEncryptionNetworkId(name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
     return `urn:tinycloud:encryption:${this.did}:${name}`;
   }
+  getEncryptionNetworkIdForSpace(spaceId, name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
+    const ownerDid = this.ownerDidFromSpaceId(spaceId) ?? this.did;
+    return `urn:tinycloud:encryption:${ownerDid}:${name}`;
+  }
+  ownerDidFromSpaceId(spaceId) {
+    if (!spaceId.startsWith("tinycloud:")) return void 0;
+    const body = spaceId.slice("tinycloud:".length);
+    const lastSeparator = body.lastIndexOf(":");
+    if (lastSeparator <= 0) return void 0;
+    const owner = body.slice(0, lastSeparator);
+    if (owner.startsWith("did:")) return owner;
+    if (!owner.includes(":")) return void 0;
+    return `did:${owner}`;
+  }
   requireServiceSession() {
     const session = this._serviceContext?.session;
     if (!session) {
@@ -19454,7 +19962,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         const shared = wasm.vault_x25519_dh(receiverPrivateKey, peerPublic);
         return columnDecrypt(shared, ciphertext);
       },
-      verifyNodeSignature: (nodeId, message, signature2) => (0, import_sdk_core6.verifyDidKeyEd25519Signature)(nodeId, message, signature2)
+      verifyNodeSignature: (nodeId, message, signature2) => (0, import_sdk_core7.verifyDidKeyEd25519Signature)(nodeId, message, signature2)
     };
   }
   async fetchNodeId() {
@@ -19525,7 +20033,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return await response.json();
       }
     };
-    return new import_sdk_core6.EncryptionService({
+    return new import_sdk_core7.EncryptionService({
       crypto: crypto2,
       signer: {
         signDecryptInvocation: async (input) => {
@@ -19537,7 +20045,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           });
           return {
             ...signed2,
-            canonicalBody: (0, import_sdk_core6.canonicalizeEncryptionJson)(
+            canonicalBody: (0, import_sdk_core7.canonicalizeEncryptionJson)(
               input.body
             )
           };
@@ -19555,8 +20063,8 @@ var _TinyCloudNode = class _TinyCloudNode {
           if (!this.config.host) {
             return null;
           }
-          const publicSpaceId = (0, import_sdk_core6.makePublicSpaceId)(this._address, this._chainId);
-          const result = await import_sdk_core6.TinyCloud.readPublicSpace(this.config.host, publicSpaceId, discoveryKey);
+          const publicSpaceId = (0, import_sdk_core7.makePublicSpaceId)(this._address, this._chainId);
+          const result = await import_sdk_core7.TinyCloud.readPublicSpace(this.config.host, publicSpaceId, discoveryKey);
           if (!result.ok) {
             return null;
           }
@@ -19579,7 +20087,7 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   createVaultService(spaceId, kv) {
     const wasm = this.wasmBindings;
-    const vaultCrypto = (0, import_sdk_core6.createVaultCrypto)({
+    const vaultCrypto = (0, import_sdk_core7.createVaultCrypto)({
       vault_encrypt: wasm.vault_encrypt,
       vault_decrypt: wasm.vault_decrypt,
       vault_derive_key: wasm.vault_derive_key,
@@ -19589,11 +20097,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       vault_sha256: wasm.vault_sha256
     });
     const self2 = this;
-    return new import_sdk_core6.DataVaultService({
+    return new import_sdk_core7.DataVaultService({
       spaceId,
       crypto: vaultCrypto,
       encryption: {
-        networkId: this.getDefaultEncryptionNetworkId(),
+        networkId: this.getEncryptionNetworkIdForSpace(spaceId),
         service: this.getEncryptionService(),
         decryptCapabilityProof: () => ({
           proofs: [this.requireServiceSession().delegationCid]
@@ -19612,8 +20120,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         get publicKV() {
           return self2._publicKV ?? self2.tc.publicKV;
         },
-        readPublicSpace: (host, targetSpaceId, key2) => import_sdk_core6.TinyCloud.readPublicSpace(host, targetSpaceId, key2),
-        makePublicSpaceId: import_sdk_core6.TinyCloud.makePublicSpaceId,
+        readPublicSpace: (host, targetSpaceId, key2) => import_sdk_core7.TinyCloud.readPublicSpace(host, targetSpaceId, key2),
+        makePublicSpaceId: import_sdk_core7.TinyCloud.makePublicSpaceId,
         did: this.did,
         address: this._address ?? "",
         chainId: this._chainId,
@@ -19626,7 +20134,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @internal
    */
   initializeV2Services(serviceSession) {
-    this._capabilityRegistry = new import_sdk_core6.CapabilityKeyRegistry();
+    this._capabilityRegistry = new import_sdk_core7.CapabilityKeyRegistry();
     const tcSession = this.auth?.tinyCloudSession;
     if (tcSession && this._address) {
       const sessionKey = {
@@ -19700,13 +20208,13 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       this._capabilityRegistry.registerKey(sessionKey, delegations);
     }
-    this._delegationManager = new import_sdk_core6.DelegationManager({
+    this._delegationManager = new import_sdk_core7.DelegationManager({
       hosts: [this.config.host],
       session: serviceSession,
       invoke: this.invokeWithRuntimePermissions,
       fetch: globalThis.fetch.bind(globalThis)
     });
-    this._spaceService = new import_sdk_core6.SpaceService({
+    this._spaceService = new import_sdk_core7.SpaceService({
       hosts: [this.config.host],
       session: serviceSession,
       invoke: this.wasmBindings.invoke,
@@ -19724,6 +20232,9 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
         return vaultService;
       },
+      createSecretsService: (spaceId) => {
+        return this.secretsForSpace(spaceId);
+      },
       // Enable space.delegations.create() via SIWE-based delegation
       createDelegation: async (params) => {
         try {
@@ -19846,11 +20357,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     try {
       const host = this.config.host;
       const now = /* @__PURE__ */ new Date();
-      const abilities = {
-        kv: {
-          [params.path]: params.actions
-        }
-      };
+      const abilities = sharingActionsToAbilities(params.path, params.actions);
+      if (!abilities) {
+        return void 0;
+      }
       const prepared = this.wasmBindings.prepareSession({
         abilities,
         address: this.wasmBindings.ensureEip55(session.address),
@@ -19866,7 +20376,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...prepared,
         signature: signature2
       });
-      const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
+      const activateResult = await (0, import_sdk_core7.activateSessionWithHost)(
         host,
         delegationSession.delegationHeader
       );
@@ -19876,7 +20386,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       return {
         cid: delegationSession.delegationCid,
         delegateDID: params.shareKeyDID,
-        delegatorDID: (0, import_sdk_core6.pkhDid)(session.address, session.chainId),
+        delegatorDID: (0, import_sdk_core7.pkhDid)(session.address, session.chainId),
         spaceId: params.spaceId,
         path: params.path,
         actions: params.actions,
@@ -19933,7 +20443,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._sql) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("sql")) {
-        throw new import_sdk_core6.UnsupportedFeatureError("sql", this.config.host, features);
+        throw new import_sdk_core7.UnsupportedFeatureError("sql", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -19957,8 +20467,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._serviceContext || !this._serviceContext.session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    const sql = new import_sdk_core6.SQLService({});
-    const spaceScopedContext = new import_sdk_core6.ServiceContext({
+    const sql = new import_sdk_core7.SQLService({});
+    const spaceScopedContext = new import_sdk_core7.ServiceContext({
       invoke: this._serviceContext.invoke,
       fetch: this._serviceContext.fetch,
       hosts: this._serviceContext.hosts,
@@ -19986,8 +20496,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._serviceContext || !this._serviceContext.session) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    const kv = new import_sdk_core6.KVService({});
-    const spaceScopedContext = new import_sdk_core6.ServiceContext({
+    const kv = new import_sdk_core7.KVService({});
+    const spaceScopedContext = new import_sdk_core7.ServiceContext({
       invoke: this._serviceContext.invoke,
       fetch: this._serviceContext.fetch,
       hosts: this._serviceContext.hosts
@@ -20003,7 +20513,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._duckdb) {
       const features = this.nodeFeatures;
       if (features.length > 0 && !features.includes("duckdb")) {
-        throw new import_sdk_core6.UnsupportedFeatureError("duckdb", this.config.host, features);
+        throw new import_sdk_core7.UnsupportedFeatureError("duckdb", this.config.host, features);
       }
       throw new Error("Not signed in. Call signIn() first.");
     }
@@ -20055,7 +20565,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       type: NETWORK_ADMIN_TYPE,
       targetNode,
       networkId,
-      bodyHash: (0, import_sdk_core6.canonicalHashHex)(
+      bodyHash: (0, import_sdk_core7.canonicalHashHex)(
         crypto2.sha256,
         body
       ),
@@ -20073,7 +20583,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         Authorization: signed2.authorization,
         "Content-Type": "application/json"
       },
-      body: (0, import_sdk_core6.canonicalizeEncryptionJson)(
+      body: (0, import_sdk_core7.canonicalizeEncryptionJson)(
         body
       )
     });
@@ -20091,7 +20601,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (existing) {
       return existing;
     }
-    const parsed = (0, import_sdk_core6.parseNetworkId)(networkId);
+    const parsed = (0, import_sdk_core7.parseNetworkId)(networkId);
     if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {
       throw new Error(
         `Cannot create encryption network ${networkId}: owner ${parsed.ownerDid} does not match signed-in DID ${this.did}`
@@ -20106,27 +20616,49 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this._spaceService) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    if (!this._secrets) {
-      this._secrets = new NodeSecretsService({
-        getService: () => this.getBaseSecrets(),
+    return this.secretsForSpace("secrets");
+  }
+  /**
+   * App-facing secrets API backed by the requested space's vault.
+   */
+  secretsForSpace(spaceId) {
+    if (!this._spaceService) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
+    const resolvedSpace = spaceId.startsWith("tinycloud:") ? spaceId : this.ownedSpaceId(spaceId);
+    let secrets = this._secrets.get(resolvedSpace);
+    if (!secrets) {
+      secrets = new NodeSecretsService({
+        getService: () => this.getBaseSecrets(resolvedSpace),
+        space: resolvedSpace,
         getManifest: () => this.manifest,
         hasPermissions: (permissions) => this.hasRuntimePermissions(permissions),
         grantPermissions: (additional) => this.grantRuntimePermissions(additional),
         canEscalate: () => this.signer !== void 0 && this.tc !== void 0,
-        getEncryptionNetworkId: () => this.getDefaultEncryptionNetworkId(),
+        getEncryptionNetworkId: () => this.getEncryptionNetworkIdForSpace(resolvedSpace),
+        resolveSpace: (space) => space.startsWith("tinycloud:") ? space : this.ownedSpaceId(space),
         getUnlockSigner: () => this.signer ?? void 0
       });
+      this._secrets.set(resolvedSpace, secrets);
     }
-    return this._secrets;
+    return secrets;
   }
-  getBaseSecrets() {
+  getBaseSecrets(spaceId) {
     if (!this._spaceService) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    if (!this._baseSecrets) {
-      this._baseSecrets = new import_sdk_core6.SecretsService(() => this.space("secrets").vault);
+    const resolvedSpace = spaceId.startsWith("tinycloud:") ? spaceId : this.ownedSpaceId(spaceId);
+    let secrets = this._baseSecrets.get(resolvedSpace);
+    if (!secrets) {
+      const kvService = this.createSpaceScopedKVService(resolvedSpace);
+      const vaultService = this.createVaultService(resolvedSpace, kvService);
+      if (this._serviceContext) {
+        vaultService.initialize(this._serviceContext);
+      }
+      secrets = new import_sdk_core7.SecretsService(() => vaultService);
+      this._baseSecrets.set(resolvedSpace, secrets);
     }
-    return this._baseSecrets;
+    return secrets;
   }
   /**
    * Hooks write stream subscription API.
@@ -20239,10 +20771,10 @@ var _TinyCloudNode = class _TinyCloudNode {
   async useRuntimeDelegation(delegation) {
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core6.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core7.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     if (delegation.expiry.getTime() <= Date.now()) {
-      throw new import_sdk_core6.SessionExpiredError(delegation.expiry);
+      throw new import_sdk_core7.SessionExpiredError(delegation.expiry);
     }
     const expectedDids = [session.verificationMethod, this.sessionDid];
     if (!expectedDids.some((did) => didPrincipalMatches2(delegation.delegateDID, did))) {
@@ -20251,7 +20783,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     const targetHost = delegation.host ?? this.config.host;
-    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core7.activateSessionWithHost)(
       targetHost,
       delegation.delegationHeader
     );
@@ -20278,13 +20810,13 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core6.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core7.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     const sessionExpiry = extractSiweExpiration(session.siwe);
     if (sessionExpiry !== void 0) {
       const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
       if (sessionExpiry.getTime() <= Date.now() + marginMs) {
-        throw new import_sdk_core6.SessionExpiredError(sessionExpiry);
+        throw new import_sdk_core7.SessionExpiredError(sessionExpiry);
       }
     }
     const expanded = this.expandPermissionEntries(permissions);
@@ -20347,7 +20879,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...prepared,
         signature: signature2
       });
-      const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
+      const activateResult = await (0, import_sdk_core7.activateSessionWithHost)(
         this.config.host,
         delegatedSession.delegationHeader
       );
@@ -20520,7 +21052,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     ];
     const abilities = { kv: { "": kvActions } };
     const now = /* @__PURE__ */ new Date();
-    const expiryMs = import_sdk_core6.EXPIRY.EPHEMERAL_MS;
+    const expiryMs = import_sdk_core7.EXPIRY.EPHEMERAL_MS;
     const expirationTime = new Date(now.getTime() + expiryMs);
     const prepared = this.wasmBindings.prepareSession({
       abilities,
@@ -20538,7 +21070,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core7.activateSessionWithHost)(
       this.config.host,
       delegationSession.delegationHeader
     );
@@ -20565,8 +21097,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       }]);
     }
     if (this._serviceContext) {
-      const publicKV = new import_sdk_core6.KVService({ prefix: "" });
-      const publicContext = new import_sdk_core6.ServiceContext({
+      const publicKV = new import_sdk_core7.KVService({ prefix: "" });
+      const publicContext = new import_sdk_core7.ServiceContext({
         invoke: this.invokeWithRuntimePermissions,
         fetch: this._serviceContext.fetch,
         hosts: this._serviceContext.hosts,
@@ -20693,14 +21225,14 @@ var _TinyCloudNode = class _TinyCloudNode {
   async delegateTo(did, permissions, options) {
     const session = this.currentTinyCloudSession();
     if (!session) {
-      throw new import_sdk_core6.SessionExpiredError(/* @__PURE__ */ new Date(0));
+      throw new import_sdk_core7.SessionExpiredError(/* @__PURE__ */ new Date(0));
     }
     const sessionExpiry = extractSiweExpiration(session.siwe);
     if (sessionExpiry !== void 0) {
       const now2 = Date.now();
       const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
       if (sessionExpiry.getTime() <= now2 + marginMs) {
-        throw new import_sdk_core6.SessionExpiredError(sessionExpiry);
+        throw new import_sdk_core7.SessionExpiredError(sessionExpiry);
       }
     }
     if (!Array.isArray(permissions) || permissions.length === 0) {
@@ -20729,11 +21261,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return { delegation: delegation2, prompted: true };
     }
-    const granted = (0, import_sdk_core6.parseRecapCapabilities)(
+    const granted = (0, import_sdk_core7.parseRecapCapabilities)(
       (siwe) => this.wasmBindings.parseRecapFromSiwe(siwe),
       session.siwe
     );
-    const { subset, missing } = (0, import_sdk_core6.isCapabilitySubset)(expandedEntries, granted);
+    const { subset, missing } = (0, import_sdk_core7.isCapabilitySubset)(expandedEntries, granted);
     if (!subset) {
       const runtimeGrant = this.findGrantForOperations(
         this.permissionEntriesToOperations(expandedEntries, session)
@@ -20741,7 +21273,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (runtimeGrant) {
         const marginMs = _TinyCloudNode.SESSION_EXPIRY_SAFETY_MARGIN_MS;
         if (runtimeGrant.expiresAt.getTime() <= Date.now() + marginMs) {
-          throw new import_sdk_core6.SessionExpiredError(runtimeGrant.expiresAt);
+          throw new import_sdk_core7.SessionExpiredError(runtimeGrant.expiresAt);
         }
         const runtimeExpiration = runtimeGrant.expiresAt < effectiveExpiration ? runtimeGrant.expiresAt : effectiveExpiration;
         const delegation2 = await this.createDelegationViaRuntimeGrant(
@@ -20752,7 +21284,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         return { delegation: delegation2, prompted: false };
       }
-      throw new import_sdk_core6.PermissionNotInManifestError(missing, granted);
+      throw new import_sdk_core7.PermissionNotInManifestError(missing, granted);
     }
     const delegation = await this.createDelegationViaWasmPath(
       did,
@@ -20834,7 +21366,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const spaceId = resolvedSpaces.size === 1 ? [...resolvedSpaces][0] : session.spaceId;
     const abilities = {};
     for (const entry of entries) {
-      const shortService = import_sdk_core6.SERVICE_LONG_TO_SHORT[entry.service];
+      const shortService = import_sdk_core7.SERVICE_LONG_TO_SHORT[entry.service];
       if (shortService === void 0) {
         throw new Error(
           `delegateTo: unknown service '${entry.service}' \u2014 no short-form mapping`
@@ -20874,7 +21406,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     const primary = result.resources[0];
     const delegationHeader = { Authorization: result.delegation };
-    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core7.activateSessionWithHost)(
       this.config.host,
       delegationHeader
     );
@@ -20909,7 +21441,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primary = result.resources[0];
     const delegationHeader = { Authorization: result.delegation };
     const targetHost = grant.delegation.host ?? this.config.host;
-    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core7.activateSessionWithHost)(
       targetHost,
       delegationHeader
     );
@@ -20950,10 +21482,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this.wasmBindings.makeSpaceId(session.address, session.chainId, space);
   }
   expandPermissionEntries(permissions) {
-    return (0, import_sdk_core6.expandPermissionEntries)(permissions);
+    return (0, import_sdk_core7.expandPermissionEntries)(permissions);
   }
   shortServiceName(service) {
-    const short = import_sdk_core6.SERVICE_LONG_TO_SHORT[service];
+    const short = import_sdk_core7.SERVICE_LONG_TO_SHORT[service];
     if (short === void 0) {
       throw new Error(
         `unknown service '${service}' \u2014 no short-form mapping`
@@ -20979,7 +21511,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     return abilities;
   }
   isEncryptionPermissionEntry(entry) {
-    return entry.service === import_sdk_core6.ENCRYPTION_PERMISSION_SERVICE && entry.path.startsWith("urn:tinycloud:encryption:");
+    return entry.service === import_sdk_core7.ENCRYPTION_PERMISSION_SERVICE && entry.path.startsWith("urn:tinycloud:encryption:");
   }
   permissionsToRawAbilities(entries) {
     const rawAbilities = {};
@@ -21012,11 +21544,11 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   sessionCoversPermissionEntries(session, entries) {
     try {
-      const granted = (0, import_sdk_core6.parseRecapCapabilities)(
+      const granted = (0, import_sdk_core7.parseRecapCapabilities)(
         (siwe) => this.wasmBindings.parseRecapFromSiwe(siwe),
         session.siwe
       );
-      return (0, import_sdk_core6.isCapabilitySubset)(entries, granted).subset;
+      return (0, import_sdk_core7.isCapabilitySubset)(entries, granted).subset;
     } catch {
       return false;
     }
@@ -21347,7 +21879,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (resolvedDelegateDID.endsWith(".eth") && this.config.ensResolver) {
       const address = await this.config.ensResolver.resolveAddress(resolvedDelegateDID);
       if (!address) throw new Error(`Could not resolve ENS name: ${resolvedDelegateDID}`);
-      resolvedDelegateDID = (0, import_sdk_core6.pkhDid)(address, 1);
+      resolvedDelegateDID = (0, import_sdk_core7.pkhDid)(address, 1);
     }
     const entries = legacyParamsToPermissionEntries(
       params.actions,
@@ -21362,7 +21894,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
       return result.delegation;
     } catch (err) {
-      if (err instanceof import_sdk_core6.PermissionNotInManifestError) {
+      if (err instanceof import_sdk_core7.PermissionNotInManifestError) {
       } else {
         throw err;
       }
@@ -21419,7 +21951,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core7.activateSessionWithHost)(
       this.config.host,
       delegationSession.delegationHeader
     );
@@ -21441,7 +21973,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
     const hasKvActions = params.actions.some((a) => a.startsWith("tinycloud.kv/"));
     if (hasKvActions && params.includePublicSpace !== false) {
-      const publicSpaceId = (0, import_sdk_core6.makePublicSpaceId)(
+      const publicSpaceId = (0, import_sdk_core7.makePublicSpaceId)(
         this.wasmBindings.ensureEip55(session.address),
         session.chainId
       );
@@ -21464,7 +21996,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...publicPrepared,
         signature: publicSignature
       });
-      const publicActivateResult = await (0, import_sdk_core6.activateSessionWithHost)(
+      const publicActivateResult = await (0, import_sdk_core7.activateSessionWithHost)(
         this.config.host,
         publicSession.delegationHeader
       );
@@ -21540,6 +22072,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         delegation,
         targetHost,
         this.wasmBindings.invoke,
+        this.wasmBindings.invokeAny,
         this.config.telemetry
       );
     }
@@ -21569,7 +22102,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core7.activateSessionWithHost)(
       targetHost,
       invokerSession.delegationHeader
     );
@@ -21605,6 +22138,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       delegation,
       targetHost,
       this.wasmBindings.invoke,
+      this.wasmBindings.invokeAny,
       this.config.telemetry
     );
   }
@@ -21675,7 +22209,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core6.activateSessionWithHost)(
+    const activateResult = await (0, import_sdk_core7.activateSessionWithHost)(
       targetHost,
       subDelegationSession.delegationHeader
     );
@@ -21717,11 +22251,11 @@ TinyCloudNode.registerNodeDefaults({
 });
 
 // src/index.ts
-var import_sdk_core8 = require("@tinycloud/sdk-core");
 var import_sdk_core9 = require("@tinycloud/sdk-core");
+var import_sdk_core10 = require("@tinycloud/sdk-core");
 
 // src/storage/FileSessionStorage.ts
-var import_sdk_core7 = require("@tinycloud/sdk-core");
+var import_sdk_core8 = require("@tinycloud/sdk-core");
 var import_fs = require("fs");
 var import_path = require("path");
 var FileSessionStorage = class {
@@ -21776,7 +22310,7 @@ var FileSessionStorage = class {
     try {
       const data = (0, import_fs.readFileSync)(filePath, "utf-8");
       const parsed = JSON.parse(data);
-      const validation = (0, import_sdk_core7.validatePersistedSessionData)(parsed);
+      const validation = (0, import_sdk_core8.validatePersistedSessionData)(parsed);
       if (!validation.ok) {
         console.warn(`Invalid session data for ${address}:`, validation.error.message);
         (0, import_fs.unlinkSync)(filePath);
@@ -21841,7 +22375,7 @@ var FileSessionStorage = class {
 };
 
 // src/index.ts
-var import_sdk_core10 = require("@tinycloud/sdk-core");
+var import_sdk_core11 = require("@tinycloud/sdk-core");
 
 // src/delegation.ts
 async function grantAuthRequest(authority, request, options) {
@@ -21886,7 +22420,6 @@ function deserializeDelegation(data) {
 }
 
 // src/index.ts
-var import_sdk_core11 = require("@tinycloud/sdk-core");
 var import_sdk_core12 = require("@tinycloud/sdk-core");
 var import_sdk_core13 = require("@tinycloud/sdk-core");
 var import_sdk_core14 = require("@tinycloud/sdk-core");
@@ -21897,6 +22430,7 @@ var import_sdk_core18 = require("@tinycloud/sdk-core");
 var import_sdk_core19 = require("@tinycloud/sdk-core");
 var import_sdk_core20 = require("@tinycloud/sdk-core");
 var import_sdk_core21 = require("@tinycloud/sdk-core");
+var import_sdk_core22 = require("@tinycloud/sdk-core");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACCOUNT_REGISTRY_PATH,
@@ -21952,6 +22486,7 @@ var import_sdk_core21 = require("@tinycloud/sdk-core");
   SpaceErrorCodes,
   SpaceService,
   TinyCloud,
+  TinyCloudDebugLogger,
   TinyCloudNode,
   UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE,
@@ -21976,8 +22511,10 @@ var import_sdk_core21 = require("@tinycloud/sdk-core");
   canonicalizeSecretScope,
   checkDecryptInvocationInput,
   checkNodeInfo,
+  clearTinyCloudDebugLogs,
   composeManifestRequest,
   createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy,
   createSharingService,
   createSpaceService,
   createVaultCrypto,
@@ -21989,7 +22526,9 @@ var import_sdk_core21 = require("@tinycloud/sdk-core");
   deserializeDelegation,
   didCacheKey,
   didEquals,
+  disableTinyCloudDebug,
   discoverNetwork,
+  enableTinyCloudDebug,
   encryptToNetwork,
   encryptionBase64Decode,
   encryptionBase64Encode,
@@ -22001,9 +22540,11 @@ var import_sdk_core21 = require("@tinycloud/sdk-core");
   expandPermissionEntries,
   expandPermissionEntry,
   generateRandomReceiverKey,
+  getTinyCloudDebugLogs,
   grantAuthRequest,
   hexDecode,
   hexEncode,
+  installTinyCloudDebugGlobals,
   isCapabilitySubset,
   isEvmAddress,
   isNetworkId,
@@ -22025,6 +22566,7 @@ var import_sdk_core21 = require("@tinycloud/sdk-core");
   resolveSecretPath,
   resourceCapabilitiesToSpaceAbilitiesMap,
   serializeDelegation,
+  tinyCloudDebugLogger,
   validateEnvelope,
   validateManifest,
   verifyDecryptResponse