@tinycloud/sdk-core 2.11.0-beta.1 → 2.11.0-beta.4

package/dist/index.d.cts

@@ -680,8 +680,11 @@ interface SubsetCheckResult {
  * - Action containment: every requested URN must be matched exactly or by a
  *   service-scoped wildcard such as `tinycloud.kv/*`.
  *
- * Any `requested` entry that does not find a matching `granted` entry is
- * added to `missing` and the overall result is non-subset.
+ * Grant entries with the same service, space, path coverage, and caveats are
+ * considered together. This matters because ReCap parsers may return one
+ * entry per action even when the original manifest grouped those actions.
+ * Any `requested` entry whose actions are not collectively covered is added
+ * to `missing` and the overall result is non-subset.
  *
  * Both sides are expected to be in the canonical long-form shape (service
  * starts with `tinycloud.`, actions are full URNs). Use {@link parseRecapCapabilities}
@@ -2523,6 +2526,20 @@ interface AccountIndexedReadOptions {
     refreshIndex?: boolean;
 }
 type AccountApplicationListOptions = AccountIndexedReadOptions;
+interface AccountApplicationRegisterOptions {
+    /**
+     * Skip the `application_state` manifest-hash pre-read that normally
+     * short-circuits a redundant write.
+     *
+     * The pre-read is a saving only when the application is already registered
+     * with the same manifest hash. On a freshly bootstrapped account it is
+     * definitionally a miss, so it costs a round trip and buys nothing — and the
+     * write it guards is an `INSERT OR REPLACE`, so performing it unconditionally
+     * is idempotent. Set this only when the caller knows the record cannot
+     * already be current (i.e. the account bootstrap path).
+     */
+    assumeUnregistered?: boolean;
+}
 type AccountSpaceListOptions = AccountIndexedReadOptions;
 interface AccountDelegationListOptions {
     direction?: "granted" | "received" | "all";
@@ -2546,12 +2563,28 @@ interface AccountServiceConfig {
 }
 declare class AccountService {
     private readonly config;
+    /**
+     * Per-account-space memo for {@link ensureAccountIndex}.
+     *
+     * Applying the index migration is a no-op once the schema exists, but the
+     * SQL service still spends two round trips discovering that (create the
+     * migrations table, then read the applied-migration rows). Account bootstrap
+     * touches the index eight times, so without a memo that is ~14 wasted
+     * requests on the cold sign-in path. The in-flight dedupe inside SQLService
+     * never helps here: the node SDK builds a fresh SQLService per
+     * `getAccountDb()` call, so its lock map is always empty.
+     *
+     * Keyed by account space id, so a different account never reuses this entry.
+     * Failures are evicted so a later call retries instead of inheriting a
+     * permanently poisoned result.
+     */
+    private readonly accountIndexReady;
     constructor(config: AccountServiceConfig);
     status(): Promise<Result<AccountStatus>>;
     readonly applications: {
         list: (options?: AccountApplicationListOptions) => Promise<Result<AccountApplication[]>>;
         get: (appId: string) => Promise<Result<AccountApplication>>;
-        register: (manifest: Manifest | Manifest[]) => Promise<Result<AccountApplication>>;
+        register: (manifest: Manifest | Manifest[], options?: AccountApplicationRegisterOptions) => Promise<Result<AccountApplication>>;
         remove: (appId: string) => Promise<Result<void>>;
     };
     readonly spaces: {
@@ -2596,7 +2629,19 @@ declare class AccountService {
     private replaceApplicationsIndexQuietly;
     private replaceSpacesIndexQuietly;
     private replaceDelegationsIndexQuietly;
+    /**
+     * Apply the account index schema at most once per account space.
+     *
+     * The index is a cache over canonical KV state, and every caller already
+     * tolerates it being absent (`ignoreIndexFailure` / `isMissingIndexError`),
+     * so a memo that is wrong in the "already applied" direction degrades to a
+     * `no such table` read that the caller handles. A memo that is wrong in the
+     * other direction would be a real bug, so failures are never cached.
+     */
     private ensureAccountIndex;
+    /** Drop the memo so the next {@link ensureAccountIndex} re-applies the schema. */
+    private invalidateAccountIndexMemo;
+    private applyAccountIndex;
 }
 interface AccountIndexStatus {
     database: string;
@@ -2731,7 +2776,7 @@ interface LocationRecord extends LocationRecordPayload {
 type LocationSource = "explicit" | "local-loopback" | "local-link" | "blockchain" | "centralized" | "fallback";
 declare const DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 declare const DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
-/** Default local loopback node URL probed before registry/fallback resolution. */
+/** Conventional local loopback node URL. Probed only when explicitly configured. */
 declare const DEFAULT_LOCAL_NODE_URL = "http://127.0.0.1:8000";
 /** Probe timeout for the local loopback candidate. No retries. */
 declare const LOCAL_LOOPBACK_PROBE_TIMEOUT_MS = 250;
@@ -2818,7 +2863,7 @@ interface DiscoverLocalTinyCloudNodeOptions {
     subject?: string;
     /** Enable local-node auto-discovery. Default true. */
     autoDiscoverLocalNode?: boolean;
-    /** Local loopback node URL to probe. Default http://127.0.0.1:8000. */
+    /** Local loopback node URL to probe. Omit to avoid probing loopback. */
     localNodeUrl?: string;
     /** Known `*.local.tinycloud.link` subdomain name, probed directly. */
     localLinkName?: string;
@@ -2852,12 +2897,12 @@ interface ResolveTinyCloudHostsOptions {
     /** Verify centralized/blockchain record signatures. Default true. */
     verifyRecords?: boolean;
     /**
-     * Probe for a locally-running TinyCloud node before falling back to
-     * registry/hosted resolution. Default true. Setting false restores the
-     * exact pre-TC-106 resolution order (registry → fallback).
+     * Probe configured and registered local TinyCloud node endpoints before
+     * falling back to registry/hosted resolution. Default true. The loopback
+     * URL is probed only when `localNodeUrl` is explicitly configured.
      */
     autoDiscoverLocalNode?: boolean;
-    /** Local loopback node URL to probe. Default http://127.0.0.1:8000. */
+    /** Local loopback node URL to probe. Omit to avoid probing loopback. */
     localNodeUrl?: string;
     /** Known `*.local.tinycloud.link` subdomain name, probed directly. */
     localLinkName?: string;
@@ -2943,4 +2988,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, discoverLocalTinyCloudNode, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, discoverLocalTinyCloudNode, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };

package/dist/index.d.ts

@@ -680,8 +680,11 @@ interface SubsetCheckResult {
  * - Action containment: every requested URN must be matched exactly or by a
  *   service-scoped wildcard such as `tinycloud.kv/*`.
  *
- * Any `requested` entry that does not find a matching `granted` entry is
- * added to `missing` and the overall result is non-subset.
+ * Grant entries with the same service, space, path coverage, and caveats are
+ * considered together. This matters because ReCap parsers may return one
+ * entry per action even when the original manifest grouped those actions.
+ * Any `requested` entry whose actions are not collectively covered is added
+ * to `missing` and the overall result is non-subset.
  *
  * Both sides are expected to be in the canonical long-form shape (service
  * starts with `tinycloud.`, actions are full URNs). Use {@link parseRecapCapabilities}
@@ -2523,6 +2526,20 @@ interface AccountIndexedReadOptions {
     refreshIndex?: boolean;
 }
 type AccountApplicationListOptions = AccountIndexedReadOptions;
+interface AccountApplicationRegisterOptions {
+    /**
+     * Skip the `application_state` manifest-hash pre-read that normally
+     * short-circuits a redundant write.
+     *
+     * The pre-read is a saving only when the application is already registered
+     * with the same manifest hash. On a freshly bootstrapped account it is
+     * definitionally a miss, so it costs a round trip and buys nothing — and the
+     * write it guards is an `INSERT OR REPLACE`, so performing it unconditionally
+     * is idempotent. Set this only when the caller knows the record cannot
+     * already be current (i.e. the account bootstrap path).
+     */
+    assumeUnregistered?: boolean;
+}
 type AccountSpaceListOptions = AccountIndexedReadOptions;
 interface AccountDelegationListOptions {
     direction?: "granted" | "received" | "all";
@@ -2546,12 +2563,28 @@ interface AccountServiceConfig {
 }
 declare class AccountService {
     private readonly config;
+    /**
+     * Per-account-space memo for {@link ensureAccountIndex}.
+     *
+     * Applying the index migration is a no-op once the schema exists, but the
+     * SQL service still spends two round trips discovering that (create the
+     * migrations table, then read the applied-migration rows). Account bootstrap
+     * touches the index eight times, so without a memo that is ~14 wasted
+     * requests on the cold sign-in path. The in-flight dedupe inside SQLService
+     * never helps here: the node SDK builds a fresh SQLService per
+     * `getAccountDb()` call, so its lock map is always empty.
+     *
+     * Keyed by account space id, so a different account never reuses this entry.
+     * Failures are evicted so a later call retries instead of inheriting a
+     * permanently poisoned result.
+     */
+    private readonly accountIndexReady;
     constructor(config: AccountServiceConfig);
     status(): Promise<Result<AccountStatus>>;
     readonly applications: {
         list: (options?: AccountApplicationListOptions) => Promise<Result<AccountApplication[]>>;
         get: (appId: string) => Promise<Result<AccountApplication>>;
-        register: (manifest: Manifest | Manifest[]) => Promise<Result<AccountApplication>>;
+        register: (manifest: Manifest | Manifest[], options?: AccountApplicationRegisterOptions) => Promise<Result<AccountApplication>>;
         remove: (appId: string) => Promise<Result<void>>;
     };
     readonly spaces: {
@@ -2596,7 +2629,19 @@ declare class AccountService {
     private replaceApplicationsIndexQuietly;
     private replaceSpacesIndexQuietly;
     private replaceDelegationsIndexQuietly;
+    /**
+     * Apply the account index schema at most once per account space.
+     *
+     * The index is a cache over canonical KV state, and every caller already
+     * tolerates it being absent (`ignoreIndexFailure` / `isMissingIndexError`),
+     * so a memo that is wrong in the "already applied" direction degrades to a
+     * `no such table` read that the caller handles. A memo that is wrong in the
+     * other direction would be a real bug, so failures are never cached.
+     */
     private ensureAccountIndex;
+    /** Drop the memo so the next {@link ensureAccountIndex} re-applies the schema. */
+    private invalidateAccountIndexMemo;
+    private applyAccountIndex;
 }
 interface AccountIndexStatus {
     database: string;
@@ -2731,7 +2776,7 @@ interface LocationRecord extends LocationRecordPayload {
 type LocationSource = "explicit" | "local-loopback" | "local-link" | "blockchain" | "centralized" | "fallback";
 declare const DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 declare const DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
-/** Default local loopback node URL probed before registry/fallback resolution. */
+/** Conventional local loopback node URL. Probed only when explicitly configured. */
 declare const DEFAULT_LOCAL_NODE_URL = "http://127.0.0.1:8000";
 /** Probe timeout for the local loopback candidate. No retries. */
 declare const LOCAL_LOOPBACK_PROBE_TIMEOUT_MS = 250;
@@ -2818,7 +2863,7 @@ interface DiscoverLocalTinyCloudNodeOptions {
     subject?: string;
     /** Enable local-node auto-discovery. Default true. */
     autoDiscoverLocalNode?: boolean;
-    /** Local loopback node URL to probe. Default http://127.0.0.1:8000. */
+    /** Local loopback node URL to probe. Omit to avoid probing loopback. */
     localNodeUrl?: string;
     /** Known `*.local.tinycloud.link` subdomain name, probed directly. */
     localLinkName?: string;
@@ -2852,12 +2897,12 @@ interface ResolveTinyCloudHostsOptions {
     /** Verify centralized/blockchain record signatures. Default true. */
     verifyRecords?: boolean;
     /**
-     * Probe for a locally-running TinyCloud node before falling back to
-     * registry/hosted resolution. Default true. Setting false restores the
-     * exact pre-TC-106 resolution order (registry → fallback).
+     * Probe configured and registered local TinyCloud node endpoints before
+     * falling back to registry/hosted resolution. Default true. The loopback
+     * URL is probed only when `localNodeUrl` is explicitly configured.
      */
     autoDiscoverLocalNode?: boolean;
-    /** Local loopback node URL to probe. Default http://127.0.0.1:8000. */
+    /** Local loopback node URL to probe. Omit to avoid probing loopback. */
     localNodeUrl?: string;
     /** Known `*.local.tinycloud.link` subdomain name, probed directly. */
     localLinkName?: string;
@@ -2943,4 +2988,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, discoverLocalTinyCloudNode, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, discoverLocalTinyCloudNode, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };

package/dist/index.js

@@ -6360,15 +6360,28 @@ function normalizeSpace(space) {
 function isCapabilitySubset(requested, granted) {
   const missing = [];
   for (const req of requested) {
-    const match = granted.find((g) => canonicalizeEntryMatches(req, g));
-    if (match === void 0) {
+    const matchingScope = granted.filter(
+      (entry) => canonicalizeEntryScopeMatches(req, entry)
+    );
+    const requestedActions = expandActionShortNames(
+      req.service,
+      req.actions
+    );
+    const grantedActions = matchingScope.flatMap(
+      (entry) => expandActionShortNames(entry.service, entry.actions)
+    );
+    const covered = requestedActions.every(
+      (requestedAction) => grantedActions.some(
+        (grantedAction) => actionContains(grantedAction, requestedAction)
+      )
+    );
+    if (!covered) {
       missing.push(cloneEntry(req));
-      continue;
     }
   }
   return { subset: missing.length === 0, missing };
 }
-function canonicalizeEntryMatches(requested, granted) {
+function canonicalizeEntryScopeMatches(requested, granted) {
   if (requested.service !== granted.service) {
     return false;
   }
@@ -6378,15 +6391,6 @@ function canonicalizeEntryMatches(requested, granted) {
   if (!pathContains2(granted.path, requested.path)) {
     return false;
   }
-  const reqActions = new Set(
-    expandActionShortNames(requested.service, requested.actions)
-  );
-  const grantedActions = expandActionShortNames(granted.service, granted.actions);
-  for (const a of reqActions) {
-    if (!grantedActions.some((grantedAction) => actionContains(grantedAction, a))) {
-      return false;
-    }
-  }
   if (!recapCaveatsEqual(requested.caveats, granted.caveats)) {
     return false;
   }
@@ -11799,6 +11803,22 @@ var ACCOUNT_SPACES_PATH = "spaces/";
 var AccountService = class {
   constructor(config) {
     this.config = config;
+    /**
+     * Per-account-space memo for {@link ensureAccountIndex}.
+     *
+     * Applying the index migration is a no-op once the schema exists, but the
+     * SQL service still spends two round trips discovering that (create the
+     * migrations table, then read the applied-migration rows). Account bootstrap
+     * touches the index eight times, so without a memo that is ~14 wasted
+     * requests on the cold sign-in path. The in-flight dedupe inside SQLService
+     * never helps here: the node SDK builds a fresh SQLService per
+     * `getAccountDb()` call, so its lock map is always empty.
+     *
+     * Keyed by account space id, so a different account never reuses this entry.
+     * Failures are evicted so a later call retries instead of inheriting a
+     * permanently poisoned result.
+     */
+    this.accountIndexReady = /* @__PURE__ */ new Map();
     this.applications = {
       list: async (options2 = {}) => {
         if (options2.preferIndex) {
@@ -11832,7 +11852,7 @@ var AccountService = class {
         if (!loaded.ok) return accountErr(loaded.error);
         return ok3(applicationFromRecord(key, loaded.data.data));
       },
-      register: async (manifest) => {
+      register: async (manifest, options2 = {}) => {
         const manifests = Array.isArray(manifest) ? manifest : [manifest];
         const request = composeManifestRequest(manifests);
         if (request.registryRecords.length === 0) {
@@ -11850,7 +11870,7 @@ var AccountService = class {
         let registered;
         for (const record of request.registryRecords) {
           const manifestHash = hashJson(record.manifests);
-          if (await this.indexHasApplicationHash(record.app_id, manifestHash)) {
+          if (!options2.assumeUnregistered && await this.indexHasApplicationHash(record.app_id, manifestHash)) {
             registered = {
               appId: record.app_id,
               manifests: record.manifests,
@@ -12031,6 +12051,7 @@ var AccountService = class {
         const delegations = await this.delegations.list();
         if (!delegations.ok) return delegations;
         const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+        this.invalidateAccountIndexMemo();
         const schema = await this.ensureAccountIndex(dbResult.data);
         if (!schema.ok) return schema;
         const statements = [
@@ -12430,7 +12451,41 @@ var AccountService = class {
       ]);
     });
   }
+  /**
+   * Apply the account index schema at most once per account space.
+   *
+   * The index is a cache over canonical KV state, and every caller already
+   * tolerates it being absent (`ignoreIndexFailure` / `isMissingIndexError`),
+   * so a memo that is wrong in the "already applied" direction degrades to a
+   * `no such table` read that the caller handles. A memo that is wrong in the
+   * other direction would be a real bug, so failures are never cached.
+   */
   async ensureAccountIndex(db) {
+    const key = this.config.getAccountSpaceId() ?? "";
+    const cached = this.accountIndexReady.get(key);
+    if (cached) return cached;
+    const pending = this.applyAccountIndex(db);
+    this.accountIndexReady.set(key, pending);
+    const evict = () => {
+      if (this.accountIndexReady.get(key) === pending) {
+        this.accountIndexReady.delete(key);
+      }
+    };
+    let settled;
+    try {
+      settled = await pending;
+    } catch (error) {
+      evict();
+      throw error;
+    }
+    if (!settled.ok) evict();
+    return settled;
+  }
+  /** Drop the memo so the next {@link ensureAccountIndex} re-applies the schema. */
+  invalidateAccountIndexMemo() {
+    this.accountIndexReady.delete(this.config.getAccountSpaceId() ?? "");
+  }
+  async applyAccountIndex(db) {
     const migrated = await db.migrations.apply({
       namespace: ACCOUNT_INDEX_NAMESPACE,
       migrations: [
@@ -15077,13 +15132,14 @@ async function discoverLocalTinyCloudNode(options2 = {}) {
   }
   const fetchFn = options2.fetch ?? globalThis.fetch;
   const identityStore = options2.identityStore ?? defaultLocalNodeIdentityStore;
-  const staticCandidates = [
-    {
+  const staticCandidates = [];
+  if (options2.localNodeUrl) {
+    staticCandidates.push({
       source: "local-loopback",
-      url: options2.localNodeUrl ?? DEFAULT_LOCAL_NODE_URL,
+      url: options2.localNodeUrl,
       timeoutMs: LOCAL_LOOPBACK_PROBE_TIMEOUT_MS
-    }
-  ];
+    });
+  }
   if (options2.localLinkName) {
     if (isValidDnsLabel(options2.localLinkName)) {
       staticCandidates.push({