@tinycloud/operations 0.3.2-beta.9 → 0.3.3-beta.0

package/dist/artifacts.cjs

@@ -209,9 +209,6 @@ var import_zod2 = require("zod");
 // ../sdk-core/src/manifest.ts
 var import_ms = __toESM(require_ms(), 1);
 
-// ../sdk-services/dist/index.js
-var import_zod = require("zod");
-
 // ../bootstrap/dist/index.js
 var CAPABILITIES = [
   { urn: "tinycloud.kv/get", service: "tinycloud.kv", status: "active" },
@@ -620,28 +617,6 @@ function withCapabilitiesReadForSpaces(resources) {
     }))
   ]);
 }
-function accountRegistryPermissions() {
-  return [
-    {
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: ACCOUNT_REGISTRY_PATH,
-      actions: [KV.GET, KV.PUT, KV.LIST]
-    },
-    {
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "spaces/",
-      actions: [KV.GET, KV.PUT, KV.LIST]
-    },
-    {
-      service: "tinycloud.sql",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "account",
-      actions: [SQL.READ, SQL.WRITE, SQL.SCHEMA]
-    }
-  ];
-}
 function composeManifestRequest(inputs, options = {}) {
   if (!Array.isArray(inputs) || inputs.length === 0) {
     throw new Error("composeManifestRequest requires at least one manifest");
@@ -655,7 +630,12 @@ function composeManifestRequest(inputs, options = {}) {
     return explicit.flatMap((entry) => expandPermissionEntry(entry, prefix, space));
   });
   if (includeAccountRegistryPermissions) {
-    resources.push(...accountRegistryPermissions());
+    resources.push(
+      ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+        ...resource,
+        actions: [...resource.actions]
+      }))
+    );
   }
   const manifestsByAppId = /* @__PURE__ */ new Map();
   for (const manifest of manifests) {
@@ -683,11 +663,60 @@ function composeBootstrapSpaceManifest(space) {
     includeAccountRegistryPermissions: false
   });
 }
+var ACCOUNT_MANIFEST_PERMISSIONS = Object.freeze([
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: ACCOUNT_REGISTRY_PATH,
+    actions: [KV.GET, KV.PUT, KV.LIST]
+  },
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "spaces/",
+    actions: [KV.GET, KV.PUT, KV.LIST]
+  },
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "system/bootstrap/complete",
+    actions: [KV.GET, KV.PUT]
+  },
+  {
+    service: "tinycloud.delegation",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "",
+    actions: ["tinycloud.delegation/list"]
+  },
+  {
+    service: "tinycloud.sql",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "account",
+    actions: [SQL.READ, SQL.WRITE, SQL.SCHEMA]
+  },
+  {
+    service: "tinycloud.capabilities",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "",
+    actions: [CAPABILITIES2.READ]
+  }
+]);
+var BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST = composeBootstrapSpaceManifest(BOOTSTRAP_DEFAULT_SPACE);
+var BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST = {
+  ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST,
+  resources: [
+    ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST.resources,
+    ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+      ...resource,
+      actions: [...resource.actions]
+    }))
+  ]
+};
 var BOOTSTRAP_SESSION_REQUESTS = Object.freeze(
   Object.fromEntries(
     BOOTSTRAP_SPACE_NAMES.map((space) => [
       space,
-      composeBootstrapSpaceManifest(space)
+      space === BOOTSTRAP_DEFAULT_SPACE ? BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST : composeBootstrapSpaceManifest(space)
     ])
   )
 );
@@ -718,6 +747,7 @@ var BOOTSTRAP_ALLOWLIST = Object.freeze(
 );
 
 // ../sdk-services/dist/index.js
+var import_zod = require("zod");
 var import_decrypt_transport_response_error = __toESM(require_decrypt_transport_response_error(), 1);
 var ErrorCodes = {
   // Common errors
@@ -6532,7 +6562,10 @@ var EncryptionService = class extends BaseService {
       const descriptor = usable.data;
       const networkPublicKey = base64Decode2(descriptor.publicEncryptionKey);
       const result = encryptToNetwork(this.crypto, {
-        networkId,
+        // Discovery returns the node's canonical network identifier. Persist
+        // that spelling in the envelope so a later response can be compared
+        // byte-for-byte (notably for checksummed did:pkh principals).
+        networkId: descriptor.networkId,
         networkPublicKey,
         plaintext,
         ...options?.aad !== void 0 ? { aad: options.aad } : {},