@tinycloud/sdk-core 2.4.0-beta.8 → 2.4.0

package/dist/index.cjs

@@ -30,10 +30,21 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACCOUNT_INDEX_SCHEMA: () => import_bootstrap2.ACCOUNT_INDEX_SCHEMA,
   ACCOUNT_REGISTRY_PATH: () => ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE: () => ACCOUNT_REGISTRY_SPACE,
   AccountService: () => AccountService,
   AutoApproveSpaceCreationHandler: () => AutoApproveSpaceCreationHandler,
+  BOOTSTRAP_ALLOWLIST: () => import_bootstrap2.BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_SPACE: () => import_bootstrap2.BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME: () => import_bootstrap2.BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE: () => import_bootstrap2.BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST: () => import_bootstrap2.BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS: () => import_bootstrap2.BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE: () => import_bootstrap2.BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS: () => import_bootstrap2.BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS: () => import_bootstrap2.BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES: () => import_bootstrap2.BOOTSTRAP_SPACE_NAMES,
   CapabilityKeyRegistry: () => CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes: () => CapabilityKeyRegistryErrorCodes,
   ClientSessionSchema: () => ClientSessionSchema,
@@ -45,6 +56,7 @@ __export(index_exports, {
   DEFAULT_ENCRYPTION_ALG: () => import_sdk_services7.DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY: () => DEFAULT_EXPIRY,
   DEFAULT_KEY_VERSION: () => import_sdk_services7.DEFAULT_KEY_VERSION,
+  DEFAULT_KNOWLEDGE_ROOT: () => DEFAULT_KNOWLEDGE_ROOT,
   DEFAULT_MANIFEST_SPACE: () => DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION: () => DEFAULT_MANIFEST_VERSION,
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
@@ -77,7 +89,9 @@ __export(index_exports, {
   PermissionNotInManifestError: () => PermissionNotInManifestError,
   PrefixedKVService: () => import_sdk_services7.PrefixedKVService,
   ProtocolMismatchError: () => ProtocolMismatchError,
+  SECRETS_SPACE: () => SECRETS_SPACE,
   SECRET_NAME_RE: () => import_sdk_services7.SECRET_NAME_RE,
+  SECRET_RECORDS_SCHEMA: () => import_bootstrap2.SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT: () => SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG: () => SERVICE_SHORT_TO_LONG,
   SQLAction: () => import_sdk_services7.SQLAction,
@@ -92,7 +106,13 @@ __export(index_exports, {
   Space: () => Space,
   SpaceErrorCodes: () => SpaceErrorCodes,
   SpaceService: () => SpaceService,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST: () => import_bootstrap2.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud: () => TinyCloud,
+  TinyCloudDebugLogger: () => import_sdk_services7.TinyCloudDebugLogger,
   UnsupportedFeatureError: () => UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE: () => VAULT_PERMISSION_SERVICE,
   VaultHeaders: () => import_sdk_services7.VaultHeaders,
@@ -101,6 +121,9 @@ __export(index_exports, {
   activateSessionWithHost: () => activateSessionWithHost,
   addressStorageKey: () => addressStorageKey,
   applyPrefix: () => applyPrefix,
+  bootstrapEncryptionNetworkId: () => import_bootstrap2.bootstrapEncryptionNetworkId,
+  bootstrapSpaceId: () => import_bootstrap2.bootstrapSpaceId,
+  bootstrapSteps: () => import_bootstrap2.bootstrapSteps,
   buildCanonicalDecryptRequest: () => import_sdk_services7.buildCanonicalDecryptRequest,
   buildDecryptAttenuation: () => import_sdk_services7.buildDecryptAttenuation,
   buildDecryptFacts: () => import_sdk_services7.buildDecryptFacts,
@@ -118,8 +141,11 @@ __export(index_exports, {
   canonicalizeSecretScope: () => import_sdk_services7.canonicalizeSecretScope,
   checkDecryptInvocationInput: () => import_sdk_services7.checkDecryptInvocationInput,
   checkNodeInfo: () => checkNodeInfo,
+  clearTinyCloudDebugLogs: () => import_sdk_services7.clearTinyCloudDebugLogs,
+  composeBootstrapSpaceManifest: () => import_bootstrap2.composeBootstrapSpaceManifest,
   composeManifestRequest: () => composeManifestRequest,
   createCapabilityKeyRegistry: () => createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy: () => createOpenKeyCallbackSigningStrategy,
   createSharingService: () => createSharingService,
   createSpaceService: () => createSpaceService,
   createVaultCrypto: () => import_sdk_services7.createVaultCrypto,
@@ -130,7 +156,9 @@ __export(index_exports, {
   deriveSignedReceiverKey: () => import_sdk_services7.deriveSignedReceiverKey,
   didCacheKey: () => didCacheKey,
   didEquals: () => didEquals,
+  disableTinyCloudDebug: () => import_sdk_services7.disableTinyCloudDebug,
   discoverNetwork: () => import_sdk_services7.discoverNetwork,
+  enableTinyCloudDebug: () => import_sdk_services7.enableTinyCloudDebug,
   encryptToNetwork: () => import_sdk_services7.encryptToNetwork,
   encryptionBase64Decode: () => import_sdk_services7.base64Decode,
   encryptionBase64Encode: () => import_sdk_services7.base64Encode,
@@ -145,9 +173,11 @@ __export(index_exports, {
   fetchLocationRecord: () => fetchLocationRecord,
   fetchPeerId: () => fetchPeerId,
   generateRandomReceiverKey: () => import_sdk_services7.generateRandomReceiverKey,
+  getTinyCloudDebugLogs: () => import_sdk_services7.getTinyCloudDebugLogs,
   hexDecode: () => import_sdk_services7.hexDecode,
   hexEncode: () => import_sdk_services7.hexEncode,
   httpUrlToMultiaddr: () => httpUrlToMultiaddr,
+  installTinyCloudDebugGlobals: () => import_sdk_services7.installTinyCloudDebugGlobals,
   isCapabilitySubset: () => isCapabilitySubset,
   isEvmAddress: () => isEvmAddress,
   isNetworkId: () => import_sdk_services7.isNetworkId,
@@ -172,6 +202,7 @@ __export(index_exports, {
   principalDidEquals: () => principalDidEquals,
   resolveCloudLocation: () => resolveCloudLocation,
   resolveManifest: () => resolveManifest,
+  resolveManifestKnowledgeRoot: () => resolveManifestKnowledgeRoot,
   resolveSecretListPrefix: () => import_sdk_services7.resolveSecretListPrefix,
   resolveSecretPath: () => import_sdk_services7.resolveSecretPath,
   resolveTinyCloudHosts: () => resolveTinyCloudHosts,
@@ -180,6 +211,7 @@ __export(index_exports, {
   serviceError: () => import_sdk_services7.serviceError,
   signLocationRecord: () => signLocationRecord,
   submitHostDelegation: () => submitHostDelegation,
+  tinyCloudDebugLogger: () => import_sdk_services7.tinyCloudDebugLogger,
   validateClientSession: () => validateClientSession,
   validateEnvelope: () => import_sdk_services7.validateEnvelope,
   validateLocationRecord: () => validateLocationRecord,
@@ -379,7 +411,15 @@ var PersistedSessionDataSchema = import_zod2.z.object({
   /** Schema version for migrations */
   version: import_zod2.z.string(),
   /** Optional ENS data */
-  ens: EnsDataSchema2.optional()
+  ens: EnsDataSchema2.optional(),
+  /**
+   * TinyCloud hosts this session was created against. Persisted so a
+   * restored session resolves to the same node without re-running the
+   * registry/fallback resolution (or the wallet sign-in flow). Optional
+   * for backward compatibility with sessions persisted before this field
+   * existed — those restore and lazily re-resolve their hosts.
+   */
+  tinycloudHosts: import_zod2.z.array(import_zod2.z.string()).optional()
 });
 var TinyCloudSessionSchema = import_zod2.z.object({
   /** User's Ethereum address */
@@ -2349,6 +2389,7 @@ var import_sdk_services5 = require("@tinycloud/sdk-services");
 // src/manifest.ts
 var import_ms = __toESM(require("ms"), 1);
 var import_sdk_services4 = require("@tinycloud/sdk-services");
+var DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
 var ManifestValidationError = class extends Error {
   constructor(message) {
     super(`Manifest validation failed: ${message}`);
@@ -2403,7 +2444,7 @@ var DEFAULT_ADMIN_ENTRIES = [
     service: "tinycloud.sql",
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
-    actions: ["read", "write", "ddl"]
+    actions: ["read", "write", "schema"]
   }
 ];
 var DEFAULT_ALL_ENTRIES = [
@@ -2417,7 +2458,7 @@ var DEFAULT_ALL_ENTRIES = [
     service: "tinycloud.sql",
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
-    actions: ["read", "write", "ddl"]
+    actions: ["read", "write", "schema"]
   },
   {
     service: "tinycloud.duckdb",
@@ -2575,6 +2616,9 @@ function validateManifest(input) {
   if (m.expiry !== void 0) {
     parseExpiry(m.expiry);
   }
+  if (m.knowledge !== void 0) {
+    resolveManifestKnowledgeRoot(m.knowledge);
+  }
   if (m.permissions !== void 0) {
     if (!Array.isArray(m.permissions)) {
       throw new ManifestValidationError(
@@ -2590,6 +2634,25 @@ function validateManifest(input) {
   }
   return m;
 }
+function resolveManifestKnowledgeRoot(knowledge) {
+  if (knowledge === void 0) {
+    return void 0;
+  }
+  if (knowledge === true) {
+    return DEFAULT_KNOWLEDGE_ROOT;
+  }
+  if (typeof knowledge !== "string" || knowledge.length === 0) {
+    throw new ManifestValidationError(
+      "manifest.knowledge must be true or a knowledge/*.md root path"
+    );
+  }
+  if (!/^knowledge\/.+\.md$/.test(knowledge)) {
+    throw new ManifestValidationError(
+      "manifest.knowledge must be true or a knowledge/*.md root path"
+    );
+  }
+  return knowledge;
+}
 function validateManifestSecrets(secrets) {
   if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
     throw new ManifestValidationError("manifest.secrets must be an object");
@@ -2989,7 +3052,7 @@ function accountRegistryIndexPermission() {
     service: "tinycloud.sql",
     space: ACCOUNT_REGISTRY_SPACE,
     path: "account",
-    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/ddl"]
+    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema"]
   };
 }
 function composeManifestRequest(inputs, options = {}) {
@@ -3094,14 +3157,26 @@ function manifestAbilitiesUnion(resolved) {
 }
 
 // src/account/AccountService.ts
+var import_bootstrap = require("@tinycloud/bootstrap");
 var SERVICE_NAME2 = "account";
 var ACCOUNT_INDEX_DB = "account";
+var ACCOUNT_INDEX_NAMESPACE = "tinycloud.account.index";
 var ACCOUNT_SPACES_PATH = "spaces/";
 var AccountService = class {
   constructor(config) {
     this.config = config;
     this.applications = {
-      list: async () => {
+      list: async (options = {}) => {
+        if (options.preferIndex) {
+          const indexed = await this.index.applications.list();
+          if (indexed.ok && indexed.data.length > 0) return indexed;
+          if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
+          const canonical = await this.applications.list();
+          if (canonical.ok && options.refreshIndex !== false) {
+            await this.replaceApplicationsIndexQuietly(canonical.data);
+          }
+          return canonical;
+        }
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
         const listed = await kvResult.data.list({ prefix: ACCOUNT_REGISTRY_PATH });
@@ -3160,8 +3235,7 @@ var AccountService = class {
           const written = await kvResult.data.put(record.key, stored);
           if (!written.ok) return accountErr(written.error);
           registered = applicationFromRecord(record.key, stored);
-          const indexed = await this.upsertApplicationIndex(registered);
-          if (!indexed.ok) return indexed;
+          await this.upsertApplicationIndexQuietly(registered);
         }
         return (0, import_sdk_services5.ok)(registered);
       },
@@ -3170,13 +3244,22 @@ var AccountService = class {
         if (!kvResult.ok) return kvResult;
         const removed = await kvResult.data.delete(applicationKey(appId));
         if (!removed.ok) return accountErr(removed.error);
-        const indexed = await this.deleteApplicationIndex(appId);
-        if (!indexed.ok) return indexed;
+        await this.deleteApplicationIndexQuietly(appId);
         return (0, import_sdk_services5.ok)(void 0);
       }
     };
     this.spaces = {
-      list: async () => {
+      list: async (options = {}) => {
+        if (options.preferIndex) {
+          const indexed = await this.index.spaces.list();
+          if (indexed.ok && indexed.data.length > 0) return indexed;
+          if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
+          const canonical = await this.spaces.syncAccessible();
+          if (canonical.ok && options.refreshIndex !== false) {
+            await this.replaceSpacesIndexQuietly(canonical.data);
+          }
+          return canonical;
+        }
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
         const listed = await kvResult.data.list({ prefix: ACCOUNT_SPACES_PATH });
@@ -3205,8 +3288,7 @@ var AccountService = class {
         const written = await kvResult.data.put(spaceKey(stored.space_id), stored);
         if (!written.ok) return accountErr(written.error);
         const registered = spaceFromRecord(spaceKey(stored.space_id), stored);
-        const indexed = await this.upsertSpaceIndex(registered);
-        if (!indexed.ok) return indexed;
+        await this.upsertSpaceIndexQuietly(registered);
         return (0, import_sdk_services5.ok)(registered);
       },
       syncAccessible: async () => {
@@ -3225,13 +3307,25 @@ var AccountService = class {
         if (!kvResult.ok) return kvResult;
         const removed = await kvResult.data.delete(spaceKey(spaceId));
         if (!removed.ok) return accountErr(removed.error);
-        const indexed = await this.deleteSpaceIndex(spaceId);
-        if (!indexed.ok) return indexed;
+        await this.deleteSpaceIndexQuietly(spaceId);
         return (0, import_sdk_services5.ok)(void 0);
       }
     };
     this.delegations = {
       list: async (options = {}) => {
+        if (options.preferIndex) {
+          const indexed = await this.index.delegations.list(options);
+          if (indexed.ok && indexed.data.length > 0) return indexed;
+          if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
+          const live = await this.delegations.list({
+            direction: options.direction,
+            space: options.space
+          });
+          if (live.ok && options.refreshIndex !== false) {
+            await this.replaceDelegationsIndexQuietly(live.data);
+          }
+          return live;
+        }
         const spaces = await this.config.getSpaces().list();
         if (!spaces.ok) return accountErr(spaces.error);
         const targetSpaces = options.space ? spaces.data.filter((space) => space.id === options.space || space.name === options.space) : spaces.data;
@@ -3261,6 +3355,13 @@ var AccountService = class {
       }
     };
     this.index = {
+      ensure: async () => {
+        const dbResult = this.accountDb();
+        if (!dbResult.ok) return dbResult;
+        const schema = await this.ensureAccountIndex(dbResult.data);
+        if (!schema.ok) return schema;
+        return (0, import_sdk_services5.ok)({ database: ACCOUNT_INDEX_DB });
+      },
       rebuild: async () => {
         const dbResult = this.accountDb();
         if (!dbResult.ok) return dbResult;
@@ -3271,8 +3372,9 @@ var AccountService = class {
         const delegations = await this.delegations.list();
         if (!delegations.ok) return delegations;
         const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+        const schema = await this.ensureAccountIndex(dbResult.data);
+        if (!schema.ok) return schema;
         const statements = [
-          ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
           { sql: "DELETE FROM applications" },
           { sql: "DELETE FROM application_state" },
           { sql: "DELETE FROM spaces" },
@@ -3404,9 +3506,15 @@ var AccountService = class {
         const queried = await dbResult.data.query(
           "SELECT source, synced_at, count FROM sync_state ORDER BY source"
         );
-        if (!queried.ok) return accountErr(queried.error);
+        if (!queried.ok) {
+          if (isMissingIndexError(queried.error)) {
+            return (0, import_sdk_services5.ok)({ database: ACCOUNT_INDEX_DB, state: "missing", sources: [] });
+          }
+          return accountErr(queried.error);
+        }
         return (0, import_sdk_services5.ok)({
           database: ACCOUNT_INDEX_DB,
+          state: "ready",
           sources: queried.data.rows.map(([source, syncedAt, count]) => ({
             source,
             syncedAt,
@@ -3463,7 +3571,7 @@ var AccountService = class {
   async indexHasApplicationHash(appId, manifestHash) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return false;
-    const schema = await dbResult.data.batch(ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })));
+    const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return false;
     const queried = await dbResult.data.query(
       "SELECT 1 FROM application_state WHERE app_id = ? AND manifest_hash = ? LIMIT 1",
@@ -3471,13 +3579,17 @@ var AccountService = class {
     );
     return queried.ok && queried.data.rows.length > 0;
   }
+  async upsertApplicationIndexQuietly(app) {
+    await ignoreIndexFailure(() => this.upsertApplicationIndex(app));
+  }
   async upsertApplicationIndex(app) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const updatedAt = app.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
     const manifestHash = app.manifestHash ?? hashJson(app.manifests);
     const written = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       {
         sql: "INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)",
         params: [
@@ -3496,23 +3608,31 @@ var AccountService = class {
     if (!written.ok) return accountErr(written.error);
     return (0, import_sdk_services5.ok)(void 0);
   }
+  async deleteApplicationIndexQuietly(appId) {
+    await ignoreIndexFailure(() => this.deleteApplicationIndex(appId));
+  }
   async deleteApplicationIndex(appId) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       { sql: "DELETE FROM applications WHERE app_id = ?", params: [appId] },
       { sql: "DELETE FROM application_state WHERE app_id = ?", params: [appId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
     return (0, import_sdk_services5.ok)(void 0);
   }
+  async upsertSpaceIndexQuietly(space) {
+    await ignoreIndexFailure(() => this.upsertSpaceIndex(space));
+  }
   async upsertSpaceIndex(space) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const updatedAt = space.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
     const written = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       {
         sql: "INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
         params: [
@@ -3531,11 +3651,15 @@ var AccountService = class {
     if (!written.ok) return accountErr(written.error);
     return (0, import_sdk_services5.ok)(void 0);
   }
+  async deleteSpaceIndexQuietly(spaceId) {
+    await ignoreIndexFailure(() => this.deleteSpaceIndex(spaceId));
+  }
   async deleteSpaceIndex(spaceId) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       { sql: "DELETE FROM spaces WHERE space_id = ?", params: [spaceId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
@@ -3552,57 +3676,115 @@ var AccountService = class {
     }
     return (0, import_sdk_services5.ok)(found);
   }
+  async replaceApplicationsIndexQuietly(applications) {
+    await ignoreIndexFailure(async () => {
+      const dbResult = this.accountDb();
+      if (!dbResult.ok) return;
+      const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
+      await dbResult.data.batch([
+        { sql: "DELETE FROM applications" },
+        { sql: "DELETE FROM application_state" },
+        ...applications.map((app) => ({
+          sql: "INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)",
+          params: [
+            app.appId,
+            app.name ?? null,
+            app.description ?? null,
+            app.updatedAt ?? syncedAt,
+            JSON.stringify(app.manifests)
+          ]
+        })),
+        ...applications.map((app) => ({
+          sql: "INSERT OR REPLACE INTO application_state (app_id, manifest_hash, indexed_at) VALUES (?, ?, ?)",
+          params: [app.appId, app.manifestHash ?? hashJson(app.manifests), syncedAt]
+        })),
+        {
+          sql: "INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)",
+          params: ["applications", syncedAt, applications.length]
+        }
+      ]);
+    });
+  }
+  async replaceSpacesIndexQuietly(spaces) {
+    await ignoreIndexFailure(async () => {
+      const dbResult = this.accountDb();
+      if (!dbResult.ok) return;
+      const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
+      await dbResult.data.batch([
+        { sql: "DELETE FROM spaces" },
+        ...spaces.map((space) => ({
+          sql: "INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+          params: [
+            space.spaceId,
+            space.name,
+            space.ownerDid,
+            space.type,
+            JSON.stringify(space.permissions),
+            space.status,
+            space.registeredAt ?? syncedAt,
+            space.updatedAt ?? syncedAt,
+            space.expiresAt?.toISOString() ?? null
+          ]
+        })),
+        {
+          sql: "INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)",
+          params: ["spaces", syncedAt, spaces.length]
+        }
+      ]);
+    });
+  }
+  async replaceDelegationsIndexQuietly(delegations) {
+    await ignoreIndexFailure(async () => {
+      const dbResult = this.accountDb();
+      if (!dbResult.ok) return;
+      const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
+      await dbResult.data.batch([
+        { sql: "DELETE FROM delegations" },
+        ...delegations.map((delegation) => ({
+          sql: "INSERT OR REPLACE INTO delegations (cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+          params: [
+            delegation.cid,
+            delegation.direction,
+            delegation.spaceId,
+            delegation.spaceName ?? null,
+            delegation.counterpartyDid,
+            delegation.delegateDid,
+            delegation.delegatorDid ?? null,
+            delegation.path,
+            JSON.stringify(delegation.actions),
+            delegation.expiry.toISOString(),
+            delegation.status,
+            delegation.createdAt?.toISOString() ?? null,
+            syncedAt
+          ]
+        })),
+        {
+          sql: "INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)",
+          params: ["delegations", syncedAt, delegations.length]
+        }
+      ]);
+    });
+  }
+  async ensureAccountIndex(db) {
+    const migrated = await db.migrations.apply({
+      namespace: ACCOUNT_INDEX_NAMESPACE,
+      migrations: [
+        {
+          id: "001_initial",
+          sql: [...import_bootstrap.ACCOUNT_INDEX_SCHEMA]
+        }
+      ]
+    });
+    if (!migrated.ok) return accountErr(migrated.error);
+    return (0, import_sdk_services5.ok)(void 0);
+  }
 };
-var ACCOUNT_INDEX_SCHEMA = [
-  `CREATE TABLE IF NOT EXISTS applications (
-    app_id TEXT PRIMARY KEY,
-    name TEXT,
-    description TEXT,
-    updated_at TEXT,
-    manifest_json TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS application_state (
-    app_id TEXT PRIMARY KEY,
-    manifest_hash TEXT NOT NULL,
-    indexed_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS spaces (
-    space_id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    owner_did TEXT NOT NULL,
-    type TEXT NOT NULL,
-    permissions_json TEXT NOT NULL,
-    status TEXT NOT NULL,
-    registered_at TEXT,
-    updated_at TEXT NOT NULL,
-    expires_at TEXT
-  )`,
-  `CREATE TABLE IF NOT EXISTS delegations (
-    cid TEXT PRIMARY KEY,
-    direction TEXT NOT NULL,
-    space_id TEXT NOT NULL,
-    space_name TEXT,
-    counterparty_did TEXT NOT NULL,
-    delegate_did TEXT NOT NULL,
-    delegator_did TEXT,
-    path TEXT NOT NULL,
-    actions_json TEXT NOT NULL,
-    expiry TEXT NOT NULL,
-    status TEXT NOT NULL,
-    created_at TEXT,
-    updated_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS sync_state (
-    source TEXT PRIMARY KEY,
-    synced_at TEXT NOT NULL,
-    count INTEGER NOT NULL
-  )`,
-  "CREATE INDEX IF NOT EXISTS idx_delegations_direction ON delegations(direction)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_space ON delegations(space_id)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_counterparty ON delegations(counterparty_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_type ON spaces(type)"
-];
 function applicationKey(appId) {
   return `${ACCOUNT_REGISTRY_PATH}${appId}`;
 }
@@ -3758,6 +3940,15 @@ function mapDelegation(delegation, space, direction) {
 function accountErr(error) {
   return (0, import_sdk_services5.err)((0, import_sdk_services5.serviceError)(error.code, error.message, SERVICE_NAME2, { cause: error.cause, meta: error.meta }));
 }
+function isMissingIndexError(error) {
+  return /no such table:/i.test(error.message);
+}
+async function ignoreIndexFailure(task) {
+  try {
+    await task();
+  } catch {
+  }
+}
 
 // src/index.ts
 var import_sdk_services7 = require("@tinycloud/sdk-services");
@@ -5503,6 +5694,76 @@ function createCapabilityKeyRegistry() {
 }
 
 // src/authorization/strategies.ts
+async function resolveOpenKeyToken(token) {
+  return typeof token === "function" ? token() : token;
+}
+async function resolveOpenKeyHeaders(headers) {
+  return typeof headers === "function" ? headers() : headers ?? {};
+}
+function openKeyApprovalReason(body) {
+  if (body.reason) return body.reason;
+  if (body.error) return body.error;
+  if (body.approvalUrl) {
+    return `OpenKey explicit approval required: ${body.approvalUrl}`;
+  }
+  return "OpenKey explicit approval required";
+}
+function createOpenKeyCallbackSigningStrategy(options) {
+  return {
+    type: "callback",
+    openKeyAutoSign: true,
+    handler: async (request) => {
+      const fetchImpl = options.fetch ?? globalThis.fetch;
+      if (!fetchImpl) {
+        throw new Error("OpenKey signing strategy requires a fetch implementation");
+      }
+      const token = await resolveOpenKeyToken(options.token);
+      const extraHeaders = await resolveOpenKeyHeaders(options.headers);
+      const body = {
+        ...request,
+        ...options.keyId ? { keyId: options.keyId } : {}
+      };
+      const response = await fetchImpl(options.endpoint, {
+        method: "POST",
+        credentials: options.credentials,
+        headers: {
+          "content-type": "application/json",
+          ...token ? { authorization: `Bearer ${token}` } : {},
+          ...extraHeaders
+        },
+        body: JSON.stringify(body)
+      });
+      let parsed;
+      try {
+        parsed = await response.json();
+      } catch {
+        parsed = void 0;
+      }
+      if (!response.ok) {
+        return {
+          approved: false,
+          reason: parsed?.reason ?? parsed?.error ?? `OpenKey signing failed with HTTP ${response.status}`
+        };
+      }
+      if (parsed?.needsApproval || parsed?.approved === false) {
+        return {
+          approved: false,
+          reason: openKeyApprovalReason(parsed)
+        };
+      }
+      if (typeof parsed?.signature === "string" && parsed.signature.length > 0) {
+        return {
+          approved: true,
+          signature: parsed.signature
+        };
+      }
+      return {
+        approved: false,
+        reason: "OpenKey signing response did not include a signature"
+      };
+    }
+  };
+}
 var defaultSignStrategy = { type: "auto-sign" };
 
 // src/authorization/spaceCreation.ts
@@ -5578,6 +5839,9 @@ async function checkNodeInfo(host, sdkProtocol, fetchFn = globalThis.fetch.bind(
   };
 }
 
+// src/index.ts
+var import_bootstrap2 = require("@tinycloud/bootstrap");
+
 // src/location.ts
 var import_multiaddr = require("@multiformats/multiaddr");
 var import_multiaddr_to_uri = require("@multiformats/multiaddr-to-uri");
@@ -6088,10 +6352,21 @@ function parseRecapCapabilities(parseWasm, siwe) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACCOUNT_INDEX_SCHEMA,
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE,
   AccountService,
   AutoApproveSpaceCreationHandler,
+  BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES,
   CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
   ClientSessionSchema,
@@ -6103,6 +6378,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY,
   DEFAULT_KEY_VERSION,
+  DEFAULT_KNOWLEDGE_ROOT,
   DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION,
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
@@ -6135,7 +6411,9 @@ function parseRecapCapabilities(parseWasm, siwe) {
   PermissionNotInManifestError,
   PrefixedKVService,
   ProtocolMismatchError,
+  SECRETS_SPACE,
   SECRET_NAME_RE,
+  SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG,
   SQLAction,
@@ -6150,7 +6428,13 @@ function parseRecapCapabilities(parseWasm, siwe) {
   Space,
   SpaceErrorCodes,
   SpaceService,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud,
+  TinyCloudDebugLogger,
   UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE,
   VaultHeaders,
@@ -6159,6 +6443,9 @@ function parseRecapCapabilities(parseWasm, siwe) {
   activateSessionWithHost,
   addressStorageKey,
   applyPrefix,
+  bootstrapEncryptionNetworkId,
+  bootstrapSpaceId,
+  bootstrapSteps,
   buildCanonicalDecryptRequest,
   buildDecryptAttenuation,
   buildDecryptFacts,
@@ -6176,8 +6463,11 @@ function parseRecapCapabilities(parseWasm, siwe) {
   canonicalizeSecretScope,
   checkDecryptInvocationInput,
   checkNodeInfo,
+  clearTinyCloudDebugLogs,
+  composeBootstrapSpaceManifest,
   composeManifestRequest,
   createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy,
   createSharingService,
   createSpaceService,
   createVaultCrypto,
@@ -6188,7 +6478,9 @@ function parseRecapCapabilities(parseWasm, siwe) {
   deriveSignedReceiverKey,
   didCacheKey,
   didEquals,
+  disableTinyCloudDebug,
   discoverNetwork,
+  enableTinyCloudDebug,
   encryptToNetwork,
   encryptionBase64Decode,
   encryptionBase64Encode,
@@ -6203,9 +6495,11 @@ function parseRecapCapabilities(parseWasm, siwe) {
   fetchLocationRecord,
   fetchPeerId,
   generateRandomReceiverKey,
+  getTinyCloudDebugLogs,
   hexDecode,
   hexEncode,
   httpUrlToMultiaddr,
+  installTinyCloudDebugGlobals,
   isCapabilitySubset,
   isEvmAddress,
   isNetworkId,
@@ -6230,6 +6524,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   principalDidEquals,
   resolveCloudLocation,
   resolveManifest,
+  resolveManifestKnowledgeRoot,
   resolveSecretListPrefix,
   resolveSecretPath,
   resolveTinyCloudHosts,
@@ -6238,6 +6533,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   serviceError,
   signLocationRecord,
   submitHostDelegation,
+  tinyCloudDebugLogger,
   validateClientSession,
   validateEnvelope,
   validateLocationRecord,