@tinycloud/sdk-core 2.4.0-beta.9 → 2.4.0

package/dist/bootstrap/index.cjs

@@ -0,0 +1,25 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/bootstrap/index.ts
+var bootstrap_exports = {};
+module.exports = __toCommonJS(bootstrap_exports);
+__reExport(bootstrap_exports, require("@tinycloud/bootstrap"), module.exports);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ...require("@tinycloud/bootstrap")
+});
+//# sourceMappingURL=index.cjs.map

package/dist/bootstrap/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/bootstrap/index.ts"],"sourcesContent":["export * from \"@tinycloud/bootstrap\";\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA,8BAAc,iCAAd;","names":[]}

package/dist/bootstrap/index.d.cts

@@ -0,0 +1 @@
+export * from '@tinycloud/bootstrap';

package/dist/bootstrap/index.d.ts

@@ -0,0 +1 @@
+export * from '@tinycloud/bootstrap';

package/dist/bootstrap/index.js

@@ -0,0 +1,3 @@
+// src/bootstrap/index.ts
+export * from "@tinycloud/bootstrap";
+//# sourceMappingURL=index.js.map

package/dist/bootstrap/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/bootstrap/index.ts"],"sourcesContent":["export * from \"@tinycloud/bootstrap\";\n"],"mappings":";AAAA,cAAc;","names":[]}

package/dist/index.cjs

@@ -30,10 +30,21 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACCOUNT_INDEX_SCHEMA: () => import_bootstrap2.ACCOUNT_INDEX_SCHEMA,
   ACCOUNT_REGISTRY_PATH: () => ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE: () => ACCOUNT_REGISTRY_SPACE,
   AccountService: () => AccountService,
   AutoApproveSpaceCreationHandler: () => AutoApproveSpaceCreationHandler,
+  BOOTSTRAP_ALLOWLIST: () => import_bootstrap2.BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_SPACE: () => import_bootstrap2.BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME: () => import_bootstrap2.BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE: () => import_bootstrap2.BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST: () => import_bootstrap2.BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS: () => import_bootstrap2.BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE: () => import_bootstrap2.BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS: () => import_bootstrap2.BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS: () => import_bootstrap2.BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES: () => import_bootstrap2.BOOTSTRAP_SPACE_NAMES,
   CapabilityKeyRegistry: () => CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes: () => CapabilityKeyRegistryErrorCodes,
   ClientSessionSchema: () => ClientSessionSchema,
@@ -45,6 +56,7 @@ __export(index_exports, {
   DEFAULT_ENCRYPTION_ALG: () => import_sdk_services7.DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY: () => DEFAULT_EXPIRY,
   DEFAULT_KEY_VERSION: () => import_sdk_services7.DEFAULT_KEY_VERSION,
+  DEFAULT_KNOWLEDGE_ROOT: () => DEFAULT_KNOWLEDGE_ROOT,
   DEFAULT_MANIFEST_SPACE: () => DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION: () => DEFAULT_MANIFEST_VERSION,
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
@@ -77,7 +89,9 @@ __export(index_exports, {
   PermissionNotInManifestError: () => PermissionNotInManifestError,
   PrefixedKVService: () => import_sdk_services7.PrefixedKVService,
   ProtocolMismatchError: () => ProtocolMismatchError,
+  SECRETS_SPACE: () => SECRETS_SPACE,
   SECRET_NAME_RE: () => import_sdk_services7.SECRET_NAME_RE,
+  SECRET_RECORDS_SCHEMA: () => import_bootstrap2.SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT: () => SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG: () => SERVICE_SHORT_TO_LONG,
   SQLAction: () => import_sdk_services7.SQLAction,
@@ -92,7 +106,13 @@ __export(index_exports, {
   Space: () => Space,
   SpaceErrorCodes: () => SpaceErrorCodes,
   SpaceService: () => SpaceService,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST: () => import_bootstrap2.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud: () => TinyCloud,
+  TinyCloudDebugLogger: () => import_sdk_services7.TinyCloudDebugLogger,
   UnsupportedFeatureError: () => UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE: () => VAULT_PERMISSION_SERVICE,
   VaultHeaders: () => import_sdk_services7.VaultHeaders,
@@ -101,6 +121,9 @@ __export(index_exports, {
   activateSessionWithHost: () => activateSessionWithHost,
   addressStorageKey: () => addressStorageKey,
   applyPrefix: () => applyPrefix,
+  bootstrapEncryptionNetworkId: () => import_bootstrap2.bootstrapEncryptionNetworkId,
+  bootstrapSpaceId: () => import_bootstrap2.bootstrapSpaceId,
+  bootstrapSteps: () => import_bootstrap2.bootstrapSteps,
   buildCanonicalDecryptRequest: () => import_sdk_services7.buildCanonicalDecryptRequest,
   buildDecryptAttenuation: () => import_sdk_services7.buildDecryptAttenuation,
   buildDecryptFacts: () => import_sdk_services7.buildDecryptFacts,
@@ -118,8 +141,11 @@ __export(index_exports, {
   canonicalizeSecretScope: () => import_sdk_services7.canonicalizeSecretScope,
   checkDecryptInvocationInput: () => import_sdk_services7.checkDecryptInvocationInput,
   checkNodeInfo: () => checkNodeInfo,
+  clearTinyCloudDebugLogs: () => import_sdk_services7.clearTinyCloudDebugLogs,
+  composeBootstrapSpaceManifest: () => import_bootstrap2.composeBootstrapSpaceManifest,
   composeManifestRequest: () => composeManifestRequest,
   createCapabilityKeyRegistry: () => createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy: () => createOpenKeyCallbackSigningStrategy,
   createSharingService: () => createSharingService,
   createSpaceService: () => createSpaceService,
   createVaultCrypto: () => import_sdk_services7.createVaultCrypto,
@@ -130,7 +156,9 @@ __export(index_exports, {
   deriveSignedReceiverKey: () => import_sdk_services7.deriveSignedReceiverKey,
   didCacheKey: () => didCacheKey,
   didEquals: () => didEquals,
+  disableTinyCloudDebug: () => import_sdk_services7.disableTinyCloudDebug,
   discoverNetwork: () => import_sdk_services7.discoverNetwork,
+  enableTinyCloudDebug: () => import_sdk_services7.enableTinyCloudDebug,
   encryptToNetwork: () => import_sdk_services7.encryptToNetwork,
   encryptionBase64Decode: () => import_sdk_services7.base64Decode,
   encryptionBase64Encode: () => import_sdk_services7.base64Encode,
@@ -145,9 +173,11 @@ __export(index_exports, {
   fetchLocationRecord: () => fetchLocationRecord,
   fetchPeerId: () => fetchPeerId,
   generateRandomReceiverKey: () => import_sdk_services7.generateRandomReceiverKey,
+  getTinyCloudDebugLogs: () => import_sdk_services7.getTinyCloudDebugLogs,
   hexDecode: () => import_sdk_services7.hexDecode,
   hexEncode: () => import_sdk_services7.hexEncode,
   httpUrlToMultiaddr: () => httpUrlToMultiaddr,
+  installTinyCloudDebugGlobals: () => import_sdk_services7.installTinyCloudDebugGlobals,
   isCapabilitySubset: () => isCapabilitySubset,
   isEvmAddress: () => isEvmAddress,
   isNetworkId: () => import_sdk_services7.isNetworkId,
@@ -172,6 +202,7 @@ __export(index_exports, {
   principalDidEquals: () => principalDidEquals,
   resolveCloudLocation: () => resolveCloudLocation,
   resolveManifest: () => resolveManifest,
+  resolveManifestKnowledgeRoot: () => resolveManifestKnowledgeRoot,
   resolveSecretListPrefix: () => import_sdk_services7.resolveSecretListPrefix,
   resolveSecretPath: () => import_sdk_services7.resolveSecretPath,
   resolveTinyCloudHosts: () => resolveTinyCloudHosts,
@@ -180,6 +211,7 @@ __export(index_exports, {
   serviceError: () => import_sdk_services7.serviceError,
   signLocationRecord: () => signLocationRecord,
   submitHostDelegation: () => submitHostDelegation,
+  tinyCloudDebugLogger: () => import_sdk_services7.tinyCloudDebugLogger,
   validateClientSession: () => validateClientSession,
   validateEnvelope: () => import_sdk_services7.validateEnvelope,
   validateLocationRecord: () => validateLocationRecord,
@@ -379,7 +411,15 @@ var PersistedSessionDataSchema = import_zod2.z.object({
   /** Schema version for migrations */
   version: import_zod2.z.string(),
   /** Optional ENS data */
-  ens: EnsDataSchema2.optional()
+  ens: EnsDataSchema2.optional(),
+  /**
+   * TinyCloud hosts this session was created against. Persisted so a
+   * restored session resolves to the same node without re-running the
+   * registry/fallback resolution (or the wallet sign-in flow). Optional
+   * for backward compatibility with sessions persisted before this field
+   * existed — those restore and lazily re-resolve their hosts.
+   */
+  tinycloudHosts: import_zod2.z.array(import_zod2.z.string()).optional()
 });
 var TinyCloudSessionSchema = import_zod2.z.object({
   /** User's Ethereum address */
@@ -2349,6 +2389,7 @@ var import_sdk_services5 = require("@tinycloud/sdk-services");
 // src/manifest.ts
 var import_ms = __toESM(require("ms"), 1);
 var import_sdk_services4 = require("@tinycloud/sdk-services");
+var DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
 var ManifestValidationError = class extends Error {
   constructor(message) {
     super(`Manifest validation failed: ${message}`);
@@ -2403,7 +2444,7 @@ var DEFAULT_ADMIN_ENTRIES = [
     service: "tinycloud.sql",
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
-    actions: ["read", "write", "ddl"]
+    actions: ["read", "write", "schema"]
   }
 ];
 var DEFAULT_ALL_ENTRIES = [
@@ -2417,7 +2458,7 @@ var DEFAULT_ALL_ENTRIES = [
     service: "tinycloud.sql",
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
-    actions: ["read", "write", "ddl"]
+    actions: ["read", "write", "schema"]
   },
   {
     service: "tinycloud.duckdb",
@@ -2575,6 +2616,9 @@ function validateManifest(input) {
   if (m.expiry !== void 0) {
     parseExpiry(m.expiry);
   }
+  if (m.knowledge !== void 0) {
+    resolveManifestKnowledgeRoot(m.knowledge);
+  }
   if (m.permissions !== void 0) {
     if (!Array.isArray(m.permissions)) {
       throw new ManifestValidationError(
@@ -2590,6 +2634,25 @@ function validateManifest(input) {
   }
   return m;
 }
+function resolveManifestKnowledgeRoot(knowledge) {
+  if (knowledge === void 0) {
+    return void 0;
+  }
+  if (knowledge === true) {
+    return DEFAULT_KNOWLEDGE_ROOT;
+  }
+  if (typeof knowledge !== "string" || knowledge.length === 0) {
+    throw new ManifestValidationError(
+      "manifest.knowledge must be true or a knowledge/*.md root path"
+    );
+  }
+  if (!/^knowledge\/.+\.md$/.test(knowledge)) {
+    throw new ManifestValidationError(
+      "manifest.knowledge must be true or a knowledge/*.md root path"
+    );
+  }
+  return knowledge;
+}
 function validateManifestSecrets(secrets) {
   if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
     throw new ManifestValidationError("manifest.secrets must be an object");
@@ -2989,7 +3052,7 @@ function accountRegistryIndexPermission() {
     service: "tinycloud.sql",
     space: ACCOUNT_REGISTRY_SPACE,
     path: "account",
-    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/ddl"]
+    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema"]
   };
 }
 function composeManifestRequest(inputs, options = {}) {
@@ -3094,8 +3157,10 @@ function manifestAbilitiesUnion(resolved) {
 }
 
 // src/account/AccountService.ts
+var import_bootstrap = require("@tinycloud/bootstrap");
 var SERVICE_NAME2 = "account";
 var ACCOUNT_INDEX_DB = "account";
+var ACCOUNT_INDEX_NAMESPACE = "tinycloud.account.index";
 var ACCOUNT_SPACES_PATH = "spaces/";
 var AccountService = class {
   constructor(config) {
@@ -3290,6 +3355,13 @@ var AccountService = class {
       }
     };
     this.index = {
+      ensure: async () => {
+        const dbResult = this.accountDb();
+        if (!dbResult.ok) return dbResult;
+        const schema = await this.ensureAccountIndex(dbResult.data);
+        if (!schema.ok) return schema;
+        return (0, import_sdk_services5.ok)({ database: ACCOUNT_INDEX_DB });
+      },
       rebuild: async () => {
         const dbResult = this.accountDb();
         if (!dbResult.ok) return dbResult;
@@ -3300,8 +3372,9 @@ var AccountService = class {
         const delegations = await this.delegations.list();
         if (!delegations.ok) return delegations;
         const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+        const schema = await this.ensureAccountIndex(dbResult.data);
+        if (!schema.ok) return schema;
         const statements = [
-          ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
           { sql: "DELETE FROM applications" },
           { sql: "DELETE FROM application_state" },
           { sql: "DELETE FROM spaces" },
@@ -3498,7 +3571,7 @@ var AccountService = class {
   async indexHasApplicationHash(appId, manifestHash) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return false;
-    const schema = await dbResult.data.batch(ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })));
+    const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return false;
     const queried = await dbResult.data.query(
       "SELECT 1 FROM application_state WHERE app_id = ? AND manifest_hash = ? LIMIT 1",
@@ -3512,10 +3585,11 @@ var AccountService = class {
   async upsertApplicationIndex(app) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const updatedAt = app.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
     const manifestHash = app.manifestHash ?? hashJson(app.manifests);
     const written = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       {
         sql: "INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)",
         params: [
@@ -3540,8 +3614,9 @@ var AccountService = class {
   async deleteApplicationIndex(appId) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       { sql: "DELETE FROM applications WHERE app_id = ?", params: [appId] },
       { sql: "DELETE FROM application_state WHERE app_id = ?", params: [appId] }
     ]);
@@ -3554,9 +3629,10 @@ var AccountService = class {
   async upsertSpaceIndex(space) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const updatedAt = space.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
     const written = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       {
         sql: "INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
         params: [
@@ -3581,8 +3657,9 @@ var AccountService = class {
   async deleteSpaceIndex(spaceId) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       { sql: "DELETE FROM spaces WHERE space_id = ?", params: [spaceId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
@@ -3604,8 +3681,9 @@ var AccountService = class {
       const dbResult = this.accountDb();
       if (!dbResult.ok) return;
       const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
       await dbResult.data.batch([
-        ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
         { sql: "DELETE FROM applications" },
         { sql: "DELETE FROM application_state" },
         ...applications.map((app) => ({
@@ -3634,8 +3712,9 @@ var AccountService = class {
       const dbResult = this.accountDb();
       if (!dbResult.ok) return;
       const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
       await dbResult.data.batch([
-        ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
         { sql: "DELETE FROM spaces" },
         ...spaces.map((space) => ({
           sql: "INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
@@ -3663,8 +3742,9 @@ var AccountService = class {
       const dbResult = this.accountDb();
       if (!dbResult.ok) return;
       const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
       await dbResult.data.batch([
-        ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
         { sql: "DELETE FROM delegations" },
         ...delegations.map((delegation) => ({
           sql: "INSERT OR REPLACE INTO delegations (cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
@@ -3691,57 +3771,20 @@ var AccountService = class {
       ]);
     });
   }
+  async ensureAccountIndex(db) {
+    const migrated = await db.migrations.apply({
+      namespace: ACCOUNT_INDEX_NAMESPACE,
+      migrations: [
+        {
+          id: "001_initial",
+          sql: [...import_bootstrap.ACCOUNT_INDEX_SCHEMA]
+        }
+      ]
+    });
+    if (!migrated.ok) return accountErr(migrated.error);
+    return (0, import_sdk_services5.ok)(void 0);
+  }
 };
-var ACCOUNT_INDEX_SCHEMA = [
-  `CREATE TABLE IF NOT EXISTS applications (
-    app_id TEXT PRIMARY KEY,
-    name TEXT,
-    description TEXT,
-    updated_at TEXT,
-    manifest_json TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS application_state (
-    app_id TEXT PRIMARY KEY,
-    manifest_hash TEXT NOT NULL,
-    indexed_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS spaces (
-    space_id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    owner_did TEXT NOT NULL,
-    type TEXT NOT NULL,
-    permissions_json TEXT NOT NULL,
-    status TEXT NOT NULL,
-    registered_at TEXT,
-    updated_at TEXT NOT NULL,
-    expires_at TEXT
-  )`,
-  `CREATE TABLE IF NOT EXISTS delegations (
-    cid TEXT PRIMARY KEY,
-    direction TEXT NOT NULL,
-    space_id TEXT NOT NULL,
-    space_name TEXT,
-    counterparty_did TEXT NOT NULL,
-    delegate_did TEXT NOT NULL,
-    delegator_did TEXT,
-    path TEXT NOT NULL,
-    actions_json TEXT NOT NULL,
-    expiry TEXT NOT NULL,
-    status TEXT NOT NULL,
-    created_at TEXT,
-    updated_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS sync_state (
-    source TEXT PRIMARY KEY,
-    synced_at TEXT NOT NULL,
-    count INTEGER NOT NULL
-  )`,
-  "CREATE INDEX IF NOT EXISTS idx_delegations_direction ON delegations(direction)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_space ON delegations(space_id)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_counterparty ON delegations(counterparty_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_type ON spaces(type)"
-];
 function applicationKey(appId) {
   return `${ACCOUNT_REGISTRY_PATH}${appId}`;
 }
@@ -5651,6 +5694,76 @@ function createCapabilityKeyRegistry() {
 }
 
 // src/authorization/strategies.ts
+async function resolveOpenKeyToken(token) {
+  return typeof token === "function" ? token() : token;
+}
+async function resolveOpenKeyHeaders(headers) {
+  return typeof headers === "function" ? headers() : headers ?? {};
+}
+function openKeyApprovalReason(body) {
+  if (body.reason) return body.reason;
+  if (body.error) return body.error;
+  if (body.approvalUrl) {
+    return `OpenKey explicit approval required: ${body.approvalUrl}`;
+  }
+  return "OpenKey explicit approval required";
+}
+function createOpenKeyCallbackSigningStrategy(options) {
+  return {
+    type: "callback",
+    openKeyAutoSign: true,
+    handler: async (request) => {
+      const fetchImpl = options.fetch ?? globalThis.fetch;
+      if (!fetchImpl) {
+        throw new Error("OpenKey signing strategy requires a fetch implementation");
+      }
+      const token = await resolveOpenKeyToken(options.token);
+      const extraHeaders = await resolveOpenKeyHeaders(options.headers);
+      const body = {
+        ...request,
+        ...options.keyId ? { keyId: options.keyId } : {}
+      };
+      const response = await fetchImpl(options.endpoint, {
+        method: "POST",
+        credentials: options.credentials,
+        headers: {
+          "content-type": "application/json",
+          ...token ? { authorization: `Bearer ${token}` } : {},
+          ...extraHeaders
+        },
+        body: JSON.stringify(body)
+      });
+      let parsed;
+      try {
+        parsed = await response.json();
+      } catch {
+        parsed = void 0;
+      }
+      if (!response.ok) {
+        return {
+          approved: false,
+          reason: parsed?.reason ?? parsed?.error ?? `OpenKey signing failed with HTTP ${response.status}`
+        };
+      }
+      if (parsed?.needsApproval || parsed?.approved === false) {
+        return {
+          approved: false,
+          reason: openKeyApprovalReason(parsed)
+        };
+      }
+      if (typeof parsed?.signature === "string" && parsed.signature.length > 0) {
+        return {
+          approved: true,
+          signature: parsed.signature
+        };
+      }
+      return {
+        approved: false,
+        reason: "OpenKey signing response did not include a signature"
+      };
+    }
+  };
+}
 var defaultSignStrategy = { type: "auto-sign" };
 
 // src/authorization/spaceCreation.ts
@@ -5726,6 +5839,9 @@ async function checkNodeInfo(host, sdkProtocol, fetchFn = globalThis.fetch.bind(
   };
 }
 
+// src/index.ts
+var import_bootstrap2 = require("@tinycloud/bootstrap");
+
 // src/location.ts
 var import_multiaddr = require("@multiformats/multiaddr");
 var import_multiaddr_to_uri = require("@multiformats/multiaddr-to-uri");
@@ -6236,10 +6352,21 @@ function parseRecapCapabilities(parseWasm, siwe) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACCOUNT_INDEX_SCHEMA,
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE,
   AccountService,
   AutoApproveSpaceCreationHandler,
+  BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES,
   CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
   ClientSessionSchema,
@@ -6251,6 +6378,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY,
   DEFAULT_KEY_VERSION,
+  DEFAULT_KNOWLEDGE_ROOT,
   DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION,
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
@@ -6283,7 +6411,9 @@ function parseRecapCapabilities(parseWasm, siwe) {
   PermissionNotInManifestError,
   PrefixedKVService,
   ProtocolMismatchError,
+  SECRETS_SPACE,
   SECRET_NAME_RE,
+  SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG,
   SQLAction,
@@ -6298,7 +6428,13 @@ function parseRecapCapabilities(parseWasm, siwe) {
   Space,
   SpaceErrorCodes,
   SpaceService,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud,
+  TinyCloudDebugLogger,
   UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE,
   VaultHeaders,
@@ -6307,6 +6443,9 @@ function parseRecapCapabilities(parseWasm, siwe) {
   activateSessionWithHost,
   addressStorageKey,
   applyPrefix,
+  bootstrapEncryptionNetworkId,
+  bootstrapSpaceId,
+  bootstrapSteps,
   buildCanonicalDecryptRequest,
   buildDecryptAttenuation,
   buildDecryptFacts,
@@ -6324,8 +6463,11 @@ function parseRecapCapabilities(parseWasm, siwe) {
   canonicalizeSecretScope,
   checkDecryptInvocationInput,
   checkNodeInfo,
+  clearTinyCloudDebugLogs,
+  composeBootstrapSpaceManifest,
   composeManifestRequest,
   createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy,
   createSharingService,
   createSpaceService,
   createVaultCrypto,
@@ -6336,7 +6478,9 @@ function parseRecapCapabilities(parseWasm, siwe) {
   deriveSignedReceiverKey,
   didCacheKey,
   didEquals,
+  disableTinyCloudDebug,
   discoverNetwork,
+  enableTinyCloudDebug,
   encryptToNetwork,
   encryptionBase64Decode,
   encryptionBase64Encode,
@@ -6351,9 +6495,11 @@ function parseRecapCapabilities(parseWasm, siwe) {
   fetchLocationRecord,
   fetchPeerId,
   generateRandomReceiverKey,
+  getTinyCloudDebugLogs,
   hexDecode,
   hexEncode,
   httpUrlToMultiaddr,
+  installTinyCloudDebugGlobals,
   isCapabilitySubset,
   isEvmAddress,
   isNetworkId,
@@ -6378,6 +6524,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   principalDidEquals,
   resolveCloudLocation,
   resolveManifest,
+  resolveManifestKnowledgeRoot,
   resolveSecretListPrefix,
   resolveSecretPath,
   resolveTinyCloudHosts,
@@ -6386,6 +6533,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   serviceError,
   signLocationRecord,
   submitHostDelegation,
+  tinyCloudDebugLogger,
   validateClientSession,
   validateEnvelope,
   validateLocationRecord,