@tinycloud/operations 0.3.2-beta.9 → 0.3.3-beta.0

package/dist/artifacts.js

@@ -185,9 +185,6 @@ import { z as z2 } from "zod";
 // ../sdk-core/src/manifest.ts
 var import_ms = __toESM(require_ms(), 1);
 
-// ../sdk-services/dist/index.js
-import { z } from "zod";
-
 // ../bootstrap/dist/index.js
 var CAPABILITIES = [
   { urn: "tinycloud.kv/get", service: "tinycloud.kv", status: "active" },
@@ -596,28 +593,6 @@ function withCapabilitiesReadForSpaces(resources) {
     }))
   ]);
 }
-function accountRegistryPermissions() {
-  return [
-    {
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: ACCOUNT_REGISTRY_PATH,
-      actions: [KV.GET, KV.PUT, KV.LIST]
-    },
-    {
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "spaces/",
-      actions: [KV.GET, KV.PUT, KV.LIST]
-    },
-    {
-      service: "tinycloud.sql",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "account",
-      actions: [SQL.READ, SQL.WRITE, SQL.SCHEMA]
-    }
-  ];
-}
 function composeManifestRequest(inputs, options = {}) {
   if (!Array.isArray(inputs) || inputs.length === 0) {
     throw new Error("composeManifestRequest requires at least one manifest");
@@ -631,7 +606,12 @@ function composeManifestRequest(inputs, options = {}) {
     return explicit.flatMap((entry) => expandPermissionEntry(entry, prefix, space));
   });
   if (includeAccountRegistryPermissions) {
-    resources.push(...accountRegistryPermissions());
+    resources.push(
+      ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+        ...resource,
+        actions: [...resource.actions]
+      }))
+    );
   }
   const manifestsByAppId = /* @__PURE__ */ new Map();
   for (const manifest of manifests) {
@@ -659,11 +639,60 @@ function composeBootstrapSpaceManifest(space) {
     includeAccountRegistryPermissions: false
   });
 }
+var ACCOUNT_MANIFEST_PERMISSIONS = Object.freeze([
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: ACCOUNT_REGISTRY_PATH,
+    actions: [KV.GET, KV.PUT, KV.LIST]
+  },
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "spaces/",
+    actions: [KV.GET, KV.PUT, KV.LIST]
+  },
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "system/bootstrap/complete",
+    actions: [KV.GET, KV.PUT]
+  },
+  {
+    service: "tinycloud.delegation",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "",
+    actions: ["tinycloud.delegation/list"]
+  },
+  {
+    service: "tinycloud.sql",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "account",
+    actions: [SQL.READ, SQL.WRITE, SQL.SCHEMA]
+  },
+  {
+    service: "tinycloud.capabilities",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "",
+    actions: [CAPABILITIES2.READ]
+  }
+]);
+var BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST = composeBootstrapSpaceManifest(BOOTSTRAP_DEFAULT_SPACE);
+var BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST = {
+  ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST,
+  resources: [
+    ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST.resources,
+    ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+      ...resource,
+      actions: [...resource.actions]
+    }))
+  ]
+};
 var BOOTSTRAP_SESSION_REQUESTS = Object.freeze(
   Object.fromEntries(
     BOOTSTRAP_SPACE_NAMES.map((space) => [
       space,
-      composeBootstrapSpaceManifest(space)
+      space === BOOTSTRAP_DEFAULT_SPACE ? BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST : composeBootstrapSpaceManifest(space)
     ])
   )
 );
@@ -694,6 +723,7 @@ var BOOTSTRAP_ALLOWLIST = Object.freeze(
 );
 
 // ../sdk-services/dist/index.js
+import { z } from "zod";
 var import_decrypt_transport_response_error = __toESM(require_decrypt_transport_response_error(), 1);
 var ErrorCodes = {
   // Common errors
@@ -6508,7 +6538,10 @@ var EncryptionService = class extends BaseService {
       const descriptor = usable.data;
       const networkPublicKey = base64Decode2(descriptor.publicEncryptionKey);
       const result = encryptToNetwork(this.crypto, {
-        networkId,
+        // Discovery returns the node's canonical network identifier. Persist
+        // that spelling in the envelope so a later response can be compared
+        // byte-for-byte (notably for checksummed did:pkh principals).
+        networkId: descriptor.networkId,
         networkPublicKey,
         plaintext,
         ...options?.aad !== void 0 ? { aad: options.aad } : {},