@tinycloud/sdk-core 2.4.0-beta.8 → 2.4.0

package/dist/index.js

@@ -188,7 +188,15 @@ var PersistedSessionDataSchema = z2.object({
   /** Schema version for migrations */
   version: z2.string(),
   /** Optional ENS data */
-  ens: EnsDataSchema2.optional()
+  ens: EnsDataSchema2.optional(),
+  /**
+   * TinyCloud hosts this session was created against. Persisted so a
+   * restored session resolves to the same node without re-running the
+   * registry/fallback resolution (or the wallet sign-in flow). Optional
+   * for backward compatibility with sessions persisted before this field
+   * existed — those restore and lazily re-resolve their hosts.
+   */
+  tinycloudHosts: z2.array(z2.string()).optional()
 });
 var TinyCloudSessionSchema = z2.object({
   /** User's Ethereum address */
@@ -2172,6 +2180,7 @@ import {
 // src/manifest.ts
 import ms from "ms";
 import { resolveSecretPath, SECRET_NAME_RE } from "@tinycloud/sdk-services";
+var DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
 var ManifestValidationError = class extends Error {
   constructor(message) {
     super(`Manifest validation failed: ${message}`);
@@ -2226,7 +2235,7 @@ var DEFAULT_ADMIN_ENTRIES = [
     service: "tinycloud.sql",
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
-    actions: ["read", "write", "ddl"]
+    actions: ["read", "write", "schema"]
   }
 ];
 var DEFAULT_ALL_ENTRIES = [
@@ -2240,7 +2249,7 @@ var DEFAULT_ALL_ENTRIES = [
     service: "tinycloud.sql",
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
-    actions: ["read", "write", "ddl"]
+    actions: ["read", "write", "schema"]
   },
   {
     service: "tinycloud.duckdb",
@@ -2398,6 +2407,9 @@ function validateManifest(input) {
   if (m.expiry !== void 0) {
     parseExpiry(m.expiry);
   }
+  if (m.knowledge !== void 0) {
+    resolveManifestKnowledgeRoot(m.knowledge);
+  }
   if (m.permissions !== void 0) {
     if (!Array.isArray(m.permissions)) {
       throw new ManifestValidationError(
@@ -2413,6 +2425,25 @@ function validateManifest(input) {
   }
   return m;
 }
+function resolveManifestKnowledgeRoot(knowledge) {
+  if (knowledge === void 0) {
+    return void 0;
+  }
+  if (knowledge === true) {
+    return DEFAULT_KNOWLEDGE_ROOT;
+  }
+  if (typeof knowledge !== "string" || knowledge.length === 0) {
+    throw new ManifestValidationError(
+      "manifest.knowledge must be true or a knowledge/*.md root path"
+    );
+  }
+  if (!/^knowledge\/.+\.md$/.test(knowledge)) {
+    throw new ManifestValidationError(
+      "manifest.knowledge must be true or a knowledge/*.md root path"
+    );
+  }
+  return knowledge;
+}
 function validateManifestSecrets(secrets) {
   if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
     throw new ManifestValidationError("manifest.secrets must be an object");
@@ -2812,7 +2843,7 @@ function accountRegistryIndexPermission() {
     service: "tinycloud.sql",
     space: ACCOUNT_REGISTRY_SPACE,
     path: "account",
-    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/ddl"]
+    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema"]
   };
 }
 function composeManifestRequest(inputs, options = {}) {
@@ -2917,14 +2948,26 @@ function manifestAbilitiesUnion(resolved) {
 }
 
 // src/account/AccountService.ts
+import { ACCOUNT_INDEX_SCHEMA } from "@tinycloud/bootstrap";
 var SERVICE_NAME2 = "account";
 var ACCOUNT_INDEX_DB = "account";
+var ACCOUNT_INDEX_NAMESPACE = "tinycloud.account.index";
 var ACCOUNT_SPACES_PATH = "spaces/";
 var AccountService = class {
   constructor(config) {
     this.config = config;
     this.applications = {
-      list: async () => {
+      list: async (options = {}) => {
+        if (options.preferIndex) {
+          const indexed = await this.index.applications.list();
+          if (indexed.ok && indexed.data.length > 0) return indexed;
+          if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
+          const canonical = await this.applications.list();
+          if (canonical.ok && options.refreshIndex !== false) {
+            await this.replaceApplicationsIndexQuietly(canonical.data);
+          }
+          return canonical;
+        }
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
         const listed = await kvResult.data.list({ prefix: ACCOUNT_REGISTRY_PATH });
@@ -2983,8 +3026,7 @@ var AccountService = class {
           const written = await kvResult.data.put(record.key, stored);
           if (!written.ok) return accountErr(written.error);
           registered = applicationFromRecord(record.key, stored);
-          const indexed = await this.upsertApplicationIndex(registered);
-          if (!indexed.ok) return indexed;
+          await this.upsertApplicationIndexQuietly(registered);
         }
         return ok3(registered);
       },
@@ -2993,13 +3035,22 @@ var AccountService = class {
         if (!kvResult.ok) return kvResult;
         const removed = await kvResult.data.delete(applicationKey(appId));
         if (!removed.ok) return accountErr(removed.error);
-        const indexed = await this.deleteApplicationIndex(appId);
-        if (!indexed.ok) return indexed;
+        await this.deleteApplicationIndexQuietly(appId);
         return ok3(void 0);
       }
     };
     this.spaces = {
-      list: async () => {
+      list: async (options = {}) => {
+        if (options.preferIndex) {
+          const indexed = await this.index.spaces.list();
+          if (indexed.ok && indexed.data.length > 0) return indexed;
+          if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
+          const canonical = await this.spaces.syncAccessible();
+          if (canonical.ok && options.refreshIndex !== false) {
+            await this.replaceSpacesIndexQuietly(canonical.data);
+          }
+          return canonical;
+        }
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
         const listed = await kvResult.data.list({ prefix: ACCOUNT_SPACES_PATH });
@@ -3028,8 +3079,7 @@ var AccountService = class {
         const written = await kvResult.data.put(spaceKey(stored.space_id), stored);
         if (!written.ok) return accountErr(written.error);
         const registered = spaceFromRecord(spaceKey(stored.space_id), stored);
-        const indexed = await this.upsertSpaceIndex(registered);
-        if (!indexed.ok) return indexed;
+        await this.upsertSpaceIndexQuietly(registered);
         return ok3(registered);
       },
       syncAccessible: async () => {
@@ -3048,13 +3098,25 @@ var AccountService = class {
         if (!kvResult.ok) return kvResult;
         const removed = await kvResult.data.delete(spaceKey(spaceId));
         if (!removed.ok) return accountErr(removed.error);
-        const indexed = await this.deleteSpaceIndex(spaceId);
-        if (!indexed.ok) return indexed;
+        await this.deleteSpaceIndexQuietly(spaceId);
         return ok3(void 0);
       }
     };
     this.delegations = {
       list: async (options = {}) => {
+        if (options.preferIndex) {
+          const indexed = await this.index.delegations.list(options);
+          if (indexed.ok && indexed.data.length > 0) return indexed;
+          if (!indexed.ok && !isMissingIndexError(indexed.error)) return indexed;
+          const live = await this.delegations.list({
+            direction: options.direction,
+            space: options.space
+          });
+          if (live.ok && options.refreshIndex !== false) {
+            await this.replaceDelegationsIndexQuietly(live.data);
+          }
+          return live;
+        }
         const spaces = await this.config.getSpaces().list();
         if (!spaces.ok) return accountErr(spaces.error);
         const targetSpaces = options.space ? spaces.data.filter((space) => space.id === options.space || space.name === options.space) : spaces.data;
@@ -3084,6 +3146,13 @@ var AccountService = class {
       }
     };
     this.index = {
+      ensure: async () => {
+        const dbResult = this.accountDb();
+        if (!dbResult.ok) return dbResult;
+        const schema = await this.ensureAccountIndex(dbResult.data);
+        if (!schema.ok) return schema;
+        return ok3({ database: ACCOUNT_INDEX_DB });
+      },
       rebuild: async () => {
         const dbResult = this.accountDb();
         if (!dbResult.ok) return dbResult;
@@ -3094,8 +3163,9 @@ var AccountService = class {
         const delegations = await this.delegations.list();
         if (!delegations.ok) return delegations;
         const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+        const schema = await this.ensureAccountIndex(dbResult.data);
+        if (!schema.ok) return schema;
         const statements = [
-          ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
           { sql: "DELETE FROM applications" },
           { sql: "DELETE FROM application_state" },
           { sql: "DELETE FROM spaces" },
@@ -3227,9 +3297,15 @@ var AccountService = class {
         const queried = await dbResult.data.query(
           "SELECT source, synced_at, count FROM sync_state ORDER BY source"
         );
-        if (!queried.ok) return accountErr(queried.error);
+        if (!queried.ok) {
+          if (isMissingIndexError(queried.error)) {
+            return ok3({ database: ACCOUNT_INDEX_DB, state: "missing", sources: [] });
+          }
+          return accountErr(queried.error);
+        }
         return ok3({
           database: ACCOUNT_INDEX_DB,
+          state: "ready",
           sources: queried.data.rows.map(([source, syncedAt, count]) => ({
             source,
             syncedAt,
@@ -3286,7 +3362,7 @@ var AccountService = class {
   async indexHasApplicationHash(appId, manifestHash) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return false;
-    const schema = await dbResult.data.batch(ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })));
+    const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return false;
     const queried = await dbResult.data.query(
       "SELECT 1 FROM application_state WHERE app_id = ? AND manifest_hash = ? LIMIT 1",
@@ -3294,13 +3370,17 @@ var AccountService = class {
     );
     return queried.ok && queried.data.rows.length > 0;
   }
+  async upsertApplicationIndexQuietly(app) {
+    await ignoreIndexFailure(() => this.upsertApplicationIndex(app));
+  }
   async upsertApplicationIndex(app) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return ok3(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const updatedAt = app.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
     const manifestHash = app.manifestHash ?? hashJson(app.manifests);
     const written = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       {
         sql: "INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)",
         params: [
@@ -3319,23 +3399,31 @@ var AccountService = class {
     if (!written.ok) return accountErr(written.error);
     return ok3(void 0);
   }
+  async deleteApplicationIndexQuietly(appId) {
+    await ignoreIndexFailure(() => this.deleteApplicationIndex(appId));
+  }
   async deleteApplicationIndex(appId) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return ok3(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       { sql: "DELETE FROM applications WHERE app_id = ?", params: [appId] },
       { sql: "DELETE FROM application_state WHERE app_id = ?", params: [appId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
     return ok3(void 0);
   }
+  async upsertSpaceIndexQuietly(space) {
+    await ignoreIndexFailure(() => this.upsertSpaceIndex(space));
+  }
   async upsertSpaceIndex(space) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return ok3(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const updatedAt = space.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
     const written = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       {
         sql: "INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
         params: [
@@ -3354,11 +3442,15 @@ var AccountService = class {
     if (!written.ok) return accountErr(written.error);
     return ok3(void 0);
   }
+  async deleteSpaceIndexQuietly(spaceId) {
+    await ignoreIndexFailure(() => this.deleteSpaceIndex(spaceId));
+  }
   async deleteSpaceIndex(spaceId) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return ok3(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       { sql: "DELETE FROM spaces WHERE space_id = ?", params: [spaceId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
@@ -3375,57 +3467,115 @@ var AccountService = class {
     }
     return ok3(found);
   }
+  async replaceApplicationsIndexQuietly(applications) {
+    await ignoreIndexFailure(async () => {
+      const dbResult = this.accountDb();
+      if (!dbResult.ok) return;
+      const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
+      await dbResult.data.batch([
+        { sql: "DELETE FROM applications" },
+        { sql: "DELETE FROM application_state" },
+        ...applications.map((app) => ({
+          sql: "INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)",
+          params: [
+            app.appId,
+            app.name ?? null,
+            app.description ?? null,
+            app.updatedAt ?? syncedAt,
+            JSON.stringify(app.manifests)
+          ]
+        })),
+        ...applications.map((app) => ({
+          sql: "INSERT OR REPLACE INTO application_state (app_id, manifest_hash, indexed_at) VALUES (?, ?, ?)",
+          params: [app.appId, app.manifestHash ?? hashJson(app.manifests), syncedAt]
+        })),
+        {
+          sql: "INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)",
+          params: ["applications", syncedAt, applications.length]
+        }
+      ]);
+    });
+  }
+  async replaceSpacesIndexQuietly(spaces) {
+    await ignoreIndexFailure(async () => {
+      const dbResult = this.accountDb();
+      if (!dbResult.ok) return;
+      const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
+      await dbResult.data.batch([
+        { sql: "DELETE FROM spaces" },
+        ...spaces.map((space) => ({
+          sql: "INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+          params: [
+            space.spaceId,
+            space.name,
+            space.ownerDid,
+            space.type,
+            JSON.stringify(space.permissions),
+            space.status,
+            space.registeredAt ?? syncedAt,
+            space.updatedAt ?? syncedAt,
+            space.expiresAt?.toISOString() ?? null
+          ]
+        })),
+        {
+          sql: "INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)",
+          params: ["spaces", syncedAt, spaces.length]
+        }
+      ]);
+    });
+  }
+  async replaceDelegationsIndexQuietly(delegations) {
+    await ignoreIndexFailure(async () => {
+      const dbResult = this.accountDb();
+      if (!dbResult.ok) return;
+      const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
+      await dbResult.data.batch([
+        { sql: "DELETE FROM delegations" },
+        ...delegations.map((delegation) => ({
+          sql: "INSERT OR REPLACE INTO delegations (cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+          params: [
+            delegation.cid,
+            delegation.direction,
+            delegation.spaceId,
+            delegation.spaceName ?? null,
+            delegation.counterpartyDid,
+            delegation.delegateDid,
+            delegation.delegatorDid ?? null,
+            delegation.path,
+            JSON.stringify(delegation.actions),
+            delegation.expiry.toISOString(),
+            delegation.status,
+            delegation.createdAt?.toISOString() ?? null,
+            syncedAt
+          ]
+        })),
+        {
+          sql: "INSERT OR REPLACE INTO sync_state (source, synced_at, count) VALUES (?, ?, ?)",
+          params: ["delegations", syncedAt, delegations.length]
+        }
+      ]);
+    });
+  }
+  async ensureAccountIndex(db) {
+    const migrated = await db.migrations.apply({
+      namespace: ACCOUNT_INDEX_NAMESPACE,
+      migrations: [
+        {
+          id: "001_initial",
+          sql: [...ACCOUNT_INDEX_SCHEMA]
+        }
+      ]
+    });
+    if (!migrated.ok) return accountErr(migrated.error);
+    return ok3(void 0);
+  }
 };
-var ACCOUNT_INDEX_SCHEMA = [
-  `CREATE TABLE IF NOT EXISTS applications (
-    app_id TEXT PRIMARY KEY,
-    name TEXT,
-    description TEXT,
-    updated_at TEXT,
-    manifest_json TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS application_state (
-    app_id TEXT PRIMARY KEY,
-    manifest_hash TEXT NOT NULL,
-    indexed_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS spaces (
-    space_id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    owner_did TEXT NOT NULL,
-    type TEXT NOT NULL,
-    permissions_json TEXT NOT NULL,
-    status TEXT NOT NULL,
-    registered_at TEXT,
-    updated_at TEXT NOT NULL,
-    expires_at TEXT
-  )`,
-  `CREATE TABLE IF NOT EXISTS delegations (
-    cid TEXT PRIMARY KEY,
-    direction TEXT NOT NULL,
-    space_id TEXT NOT NULL,
-    space_name TEXT,
-    counterparty_did TEXT NOT NULL,
-    delegate_did TEXT NOT NULL,
-    delegator_did TEXT,
-    path TEXT NOT NULL,
-    actions_json TEXT NOT NULL,
-    expiry TEXT NOT NULL,
-    status TEXT NOT NULL,
-    created_at TEXT,
-    updated_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS sync_state (
-    source TEXT PRIMARY KEY,
-    synced_at TEXT NOT NULL,
-    count INTEGER NOT NULL
-  )`,
-  "CREATE INDEX IF NOT EXISTS idx_delegations_direction ON delegations(direction)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_space ON delegations(space_id)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_counterparty ON delegations(counterparty_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_type ON spaces(type)"
-];
 function applicationKey(appId) {
   return `${ACCOUNT_REGISTRY_PATH}${appId}`;
 }
@@ -3581,6 +3731,15 @@ function mapDelegation(delegation, space, direction) {
 function accountErr(error) {
   return err3(serviceError3(error.code, error.message, SERVICE_NAME2, { cause: error.cause, meta: error.meta }));
 }
+function isMissingIndexError(error) {
+  return /no such table:/i.test(error.message);
+}
+async function ignoreIndexFailure(task) {
+  try {
+    await task();
+  } catch {
+  }
+}
 
 // src/index.ts
 import {
@@ -3591,6 +3750,13 @@ import {
   err as err5,
   serviceError as serviceError5,
   ErrorCodes as ErrorCodes2,
+  TinyCloudDebugLogger,
+  tinyCloudDebugLogger,
+  enableTinyCloudDebug,
+  disableTinyCloudDebug,
+  getTinyCloudDebugLogs,
+  clearTinyCloudDebugLogs,
+  installTinyCloudDebugGlobals,
   defaultRetryPolicy as defaultRetryPolicy2,
   SQLService as SQLService2,
   DatabaseHandle,
@@ -5391,6 +5557,76 @@ function createCapabilityKeyRegistry() {
 }
 
 // src/authorization/strategies.ts
+async function resolveOpenKeyToken(token) {
+  return typeof token === "function" ? token() : token;
+}
+async function resolveOpenKeyHeaders(headers) {
+  return typeof headers === "function" ? headers() : headers ?? {};
+}
+function openKeyApprovalReason(body) {
+  if (body.reason) return body.reason;
+  if (body.error) return body.error;
+  if (body.approvalUrl) {
+    return `OpenKey explicit approval required: ${body.approvalUrl}`;
+  }
+  return "OpenKey explicit approval required";
+}
+function createOpenKeyCallbackSigningStrategy(options) {
+  return {
+    type: "callback",
+    openKeyAutoSign: true,
+    handler: async (request) => {
+      const fetchImpl = options.fetch ?? globalThis.fetch;
+      if (!fetchImpl) {
+        throw new Error("OpenKey signing strategy requires a fetch implementation");
+      }
+      const token = await resolveOpenKeyToken(options.token);
+      const extraHeaders = await resolveOpenKeyHeaders(options.headers);
+      const body = {
+        ...request,
+        ...options.keyId ? { keyId: options.keyId } : {}
+      };
+      const response = await fetchImpl(options.endpoint, {
+        method: "POST",
+        credentials: options.credentials,
+        headers: {
+          "content-type": "application/json",
+          ...token ? { authorization: `Bearer ${token}` } : {},
+          ...extraHeaders
+        },
+        body: JSON.stringify(body)
+      });
+      let parsed;
+      try {
+        parsed = await response.json();
+      } catch {
+        parsed = void 0;
+      }
+      if (!response.ok) {
+        return {
+          approved: false,
+          reason: parsed?.reason ?? parsed?.error ?? `OpenKey signing failed with HTTP ${response.status}`
+        };
+      }
+      if (parsed?.needsApproval || parsed?.approved === false) {
+        return {
+          approved: false,
+          reason: openKeyApprovalReason(parsed)
+        };
+      }
+      if (typeof parsed?.signature === "string" && parsed.signature.length > 0) {
+        return {
+          approved: true,
+          signature: parsed.signature
+        };
+      }
+      return {
+        approved: false,
+        reason: "OpenKey signing response did not include a signature"
+      };
+    }
+  };
+}
 var defaultSignStrategy = { type: "auto-sign" };
 
 // src/authorization/spaceCreation.ts
@@ -5466,6 +5702,31 @@ async function checkNodeInfo(host, sdkProtocol, fetchFn = globalThis.fetch.bind(
   };
 }
 
+// src/index.ts
+import {
+  ACCOUNT_INDEX_SCHEMA as ACCOUNT_INDEX_SCHEMA2,
+  BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES,
+  SECRET_RECORDS_SCHEMA,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+  bootstrapEncryptionNetworkId,
+  bootstrapSpaceId,
+  bootstrapSteps,
+  composeBootstrapSpaceManifest
+} from "@tinycloud/bootstrap";
+
 // src/location.ts
 import { multiaddr } from "@multiformats/multiaddr";
 import { multiaddrToUri } from "@multiformats/multiaddr-to-uri";
@@ -5975,10 +6236,21 @@ function parseRecapCapabilities(parseWasm, siwe) {
   return normalized;
 }
 export {
+  ACCOUNT_INDEX_SCHEMA2 as ACCOUNT_INDEX_SCHEMA,
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE,
   AccountService,
   AutoApproveSpaceCreationHandler,
+  BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES,
   CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
   ClientSessionSchema,
@@ -5990,6 +6262,7 @@ export {
   DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY,
   DEFAULT_KEY_VERSION,
+  DEFAULT_KNOWLEDGE_ROOT,
   DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION,
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
@@ -6022,7 +6295,9 @@ export {
   PermissionNotInManifestError,
   PrefixedKVService,
   ProtocolMismatchError,
+  SECRETS_SPACE,
   SECRET_NAME_RE2 as SECRET_NAME_RE,
+  SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG,
   SQLAction,
@@ -6037,7 +6312,13 @@ export {
   Space,
   SpaceErrorCodes,
   SpaceService,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud,
+  TinyCloudDebugLogger,
   UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE,
   VaultHeaders,
@@ -6046,6 +6327,9 @@ export {
   activateSessionWithHost,
   addressStorageKey,
   applyPrefix,
+  bootstrapEncryptionNetworkId,
+  bootstrapSpaceId,
+  bootstrapSteps,
   buildCanonicalDecryptRequest,
   buildDecryptAttenuation,
   buildDecryptFacts,
@@ -6063,8 +6347,11 @@ export {
   canonicalizeSecretScope,
   checkDecryptInvocationInput,
   checkNodeInfo,
+  clearTinyCloudDebugLogs,
+  composeBootstrapSpaceManifest,
   composeManifestRequest,
   createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy,
   createSharingService,
   createSpaceService,
   createVaultCrypto,
@@ -6075,7 +6362,9 @@ export {
   deriveSignedReceiverKey,
   didCacheKey,
   didEquals,
+  disableTinyCloudDebug,
   discoverNetwork,
+  enableTinyCloudDebug,
   encryptToNetwork,
   base64Decode as encryptionBase64Decode,
   base64Encode as encryptionBase64Encode,
@@ -6090,9 +6379,11 @@ export {
   fetchLocationRecord,
   fetchPeerId,
   generateRandomReceiverKey,
+  getTinyCloudDebugLogs,
   hexDecode,
   hexEncode,
   httpUrlToMultiaddr,
+  installTinyCloudDebugGlobals,
   isCapabilitySubset,
   isEvmAddress,
   isNetworkId,
@@ -6117,6 +6408,7 @@ export {
   principalDidEquals,
   resolveCloudLocation,
   resolveManifest,
+  resolveManifestKnowledgeRoot,
   resolveSecretListPrefix,
   resolveSecretPath2 as resolveSecretPath,
   resolveTinyCloudHosts,
@@ -6125,6 +6417,7 @@ export {
   serviceError5 as serviceError,
   signLocationRecord,
   submitHostDelegation,
+  tinyCloudDebugLogger,
   validateClientSession,
   validateEnvelope,
   validateLocationRecord,