@tinycloud/sdk-core 2.4.0-beta.9 → 2.4.0

package/dist/index.js

@@ -188,7 +188,15 @@ var PersistedSessionDataSchema = z2.object({
   /** Schema version for migrations */
   version: z2.string(),
   /** Optional ENS data */
-  ens: EnsDataSchema2.optional()
+  ens: EnsDataSchema2.optional(),
+  /**
+   * TinyCloud hosts this session was created against. Persisted so a
+   * restored session resolves to the same node without re-running the
+   * registry/fallback resolution (or the wallet sign-in flow). Optional
+   * for backward compatibility with sessions persisted before this field
+   * existed — those restore and lazily re-resolve their hosts.
+   */
+  tinycloudHosts: z2.array(z2.string()).optional()
 });
 var TinyCloudSessionSchema = z2.object({
   /** User's Ethereum address */
@@ -2172,6 +2180,7 @@ import {
 // src/manifest.ts
 import ms from "ms";
 import { resolveSecretPath, SECRET_NAME_RE } from "@tinycloud/sdk-services";
+var DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
 var ManifestValidationError = class extends Error {
   constructor(message) {
     super(`Manifest validation failed: ${message}`);
@@ -2226,7 +2235,7 @@ var DEFAULT_ADMIN_ENTRIES = [
     service: "tinycloud.sql",
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
-    actions: ["read", "write", "ddl"]
+    actions: ["read", "write", "schema"]
   }
 ];
 var DEFAULT_ALL_ENTRIES = [
@@ -2240,7 +2249,7 @@ var DEFAULT_ALL_ENTRIES = [
     service: "tinycloud.sql",
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
-    actions: ["read", "write", "ddl"]
+    actions: ["read", "write", "schema"]
   },
   {
     service: "tinycloud.duckdb",
@@ -2398,6 +2407,9 @@ function validateManifest(input) {
   if (m.expiry !== void 0) {
     parseExpiry(m.expiry);
   }
+  if (m.knowledge !== void 0) {
+    resolveManifestKnowledgeRoot(m.knowledge);
+  }
   if (m.permissions !== void 0) {
     if (!Array.isArray(m.permissions)) {
       throw new ManifestValidationError(
@@ -2413,6 +2425,25 @@ function validateManifest(input) {
   }
   return m;
 }
+function resolveManifestKnowledgeRoot(knowledge) {
+  if (knowledge === void 0) {
+    return void 0;
+  }
+  if (knowledge === true) {
+    return DEFAULT_KNOWLEDGE_ROOT;
+  }
+  if (typeof knowledge !== "string" || knowledge.length === 0) {
+    throw new ManifestValidationError(
+      "manifest.knowledge must be true or a knowledge/*.md root path"
+    );
+  }
+  if (!/^knowledge\/.+\.md$/.test(knowledge)) {
+    throw new ManifestValidationError(
+      "manifest.knowledge must be true or a knowledge/*.md root path"
+    );
+  }
+  return knowledge;
+}
 function validateManifestSecrets(secrets) {
   if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
     throw new ManifestValidationError("manifest.secrets must be an object");
@@ -2812,7 +2843,7 @@ function accountRegistryIndexPermission() {
     service: "tinycloud.sql",
     space: ACCOUNT_REGISTRY_SPACE,
     path: "account",
-    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/ddl"]
+    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema"]
   };
 }
 function composeManifestRequest(inputs, options = {}) {
@@ -2917,8 +2948,10 @@ function manifestAbilitiesUnion(resolved) {
 }
 
 // src/account/AccountService.ts
+import { ACCOUNT_INDEX_SCHEMA } from "@tinycloud/bootstrap";
 var SERVICE_NAME2 = "account";
 var ACCOUNT_INDEX_DB = "account";
+var ACCOUNT_INDEX_NAMESPACE = "tinycloud.account.index";
 var ACCOUNT_SPACES_PATH = "spaces/";
 var AccountService = class {
   constructor(config) {
@@ -3113,6 +3146,13 @@ var AccountService = class {
       }
     };
     this.index = {
+      ensure: async () => {
+        const dbResult = this.accountDb();
+        if (!dbResult.ok) return dbResult;
+        const schema = await this.ensureAccountIndex(dbResult.data);
+        if (!schema.ok) return schema;
+        return ok3({ database: ACCOUNT_INDEX_DB });
+      },
       rebuild: async () => {
         const dbResult = this.accountDb();
         if (!dbResult.ok) return dbResult;
@@ -3123,8 +3163,9 @@ var AccountService = class {
         const delegations = await this.delegations.list();
         if (!delegations.ok) return delegations;
         const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+        const schema = await this.ensureAccountIndex(dbResult.data);
+        if (!schema.ok) return schema;
         const statements = [
-          ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
           { sql: "DELETE FROM applications" },
           { sql: "DELETE FROM application_state" },
           { sql: "DELETE FROM spaces" },
@@ -3321,7 +3362,7 @@ var AccountService = class {
   async indexHasApplicationHash(appId, manifestHash) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return false;
-    const schema = await dbResult.data.batch(ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })));
+    const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return false;
     const queried = await dbResult.data.query(
       "SELECT 1 FROM application_state WHERE app_id = ? AND manifest_hash = ? LIMIT 1",
@@ -3335,10 +3376,11 @@ var AccountService = class {
   async upsertApplicationIndex(app) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return ok3(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const updatedAt = app.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
     const manifestHash = app.manifestHash ?? hashJson(app.manifests);
     const written = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       {
         sql: "INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)",
         params: [
@@ -3363,8 +3405,9 @@ var AccountService = class {
   async deleteApplicationIndex(appId) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return ok3(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       { sql: "DELETE FROM applications WHERE app_id = ?", params: [appId] },
       { sql: "DELETE FROM application_state WHERE app_id = ?", params: [appId] }
     ]);
@@ -3377,9 +3420,10 @@ var AccountService = class {
   async upsertSpaceIndex(space) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return ok3(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const updatedAt = space.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
     const written = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       {
         sql: "INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
         params: [
@@ -3404,8 +3448,9 @@ var AccountService = class {
   async deleteSpaceIndex(spaceId) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return ok3(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       { sql: "DELETE FROM spaces WHERE space_id = ?", params: [spaceId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
@@ -3427,8 +3472,9 @@ var AccountService = class {
       const dbResult = this.accountDb();
       if (!dbResult.ok) return;
       const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
       await dbResult.data.batch([
-        ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
         { sql: "DELETE FROM applications" },
         { sql: "DELETE FROM application_state" },
         ...applications.map((app) => ({
@@ -3457,8 +3503,9 @@ var AccountService = class {
       const dbResult = this.accountDb();
       if (!dbResult.ok) return;
       const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
       await dbResult.data.batch([
-        ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
         { sql: "DELETE FROM spaces" },
         ...spaces.map((space) => ({
           sql: "INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
@@ -3486,8 +3533,9 @@ var AccountService = class {
       const dbResult = this.accountDb();
       if (!dbResult.ok) return;
       const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
       await dbResult.data.batch([
-        ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
         { sql: "DELETE FROM delegations" },
         ...delegations.map((delegation) => ({
           sql: "INSERT OR REPLACE INTO delegations (cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
@@ -3514,57 +3562,20 @@ var AccountService = class {
       ]);
     });
   }
+  async ensureAccountIndex(db) {
+    const migrated = await db.migrations.apply({
+      namespace: ACCOUNT_INDEX_NAMESPACE,
+      migrations: [
+        {
+          id: "001_initial",
+          sql: [...ACCOUNT_INDEX_SCHEMA]
+        }
+      ]
+    });
+    if (!migrated.ok) return accountErr(migrated.error);
+    return ok3(void 0);
+  }
 };
-var ACCOUNT_INDEX_SCHEMA = [
-  `CREATE TABLE IF NOT EXISTS applications (
-    app_id TEXT PRIMARY KEY,
-    name TEXT,
-    description TEXT,
-    updated_at TEXT,
-    manifest_json TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS application_state (
-    app_id TEXT PRIMARY KEY,
-    manifest_hash TEXT NOT NULL,
-    indexed_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS spaces (
-    space_id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    owner_did TEXT NOT NULL,
-    type TEXT NOT NULL,
-    permissions_json TEXT NOT NULL,
-    status TEXT NOT NULL,
-    registered_at TEXT,
-    updated_at TEXT NOT NULL,
-    expires_at TEXT
-  )`,
-  `CREATE TABLE IF NOT EXISTS delegations (
-    cid TEXT PRIMARY KEY,
-    direction TEXT NOT NULL,
-    space_id TEXT NOT NULL,
-    space_name TEXT,
-    counterparty_did TEXT NOT NULL,
-    delegate_did TEXT NOT NULL,
-    delegator_did TEXT,
-    path TEXT NOT NULL,
-    actions_json TEXT NOT NULL,
-    expiry TEXT NOT NULL,
-    status TEXT NOT NULL,
-    created_at TEXT,
-    updated_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS sync_state (
-    source TEXT PRIMARY KEY,
-    synced_at TEXT NOT NULL,
-    count INTEGER NOT NULL
-  )`,
-  "CREATE INDEX IF NOT EXISTS idx_delegations_direction ON delegations(direction)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_space ON delegations(space_id)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_counterparty ON delegations(counterparty_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_type ON spaces(type)"
-];
 function applicationKey(appId) {
   return `${ACCOUNT_REGISTRY_PATH}${appId}`;
 }
@@ -3739,6 +3750,13 @@ import {
   err as err5,
   serviceError as serviceError5,
   ErrorCodes as ErrorCodes2,
+  TinyCloudDebugLogger,
+  tinyCloudDebugLogger,
+  enableTinyCloudDebug,
+  disableTinyCloudDebug,
+  getTinyCloudDebugLogs,
+  clearTinyCloudDebugLogs,
+  installTinyCloudDebugGlobals,
   defaultRetryPolicy as defaultRetryPolicy2,
   SQLService as SQLService2,
   DatabaseHandle,
@@ -5539,6 +5557,76 @@ function createCapabilityKeyRegistry() {
 }
 
 // src/authorization/strategies.ts
+async function resolveOpenKeyToken(token) {
+  return typeof token === "function" ? token() : token;
+}
+async function resolveOpenKeyHeaders(headers) {
+  return typeof headers === "function" ? headers() : headers ?? {};
+}
+function openKeyApprovalReason(body) {
+  if (body.reason) return body.reason;
+  if (body.error) return body.error;
+  if (body.approvalUrl) {
+    return `OpenKey explicit approval required: ${body.approvalUrl}`;
+  }
+  return "OpenKey explicit approval required";
+}
+function createOpenKeyCallbackSigningStrategy(options) {
+  return {
+    type: "callback",
+    openKeyAutoSign: true,
+    handler: async (request) => {
+      const fetchImpl = options.fetch ?? globalThis.fetch;
+      if (!fetchImpl) {
+        throw new Error("OpenKey signing strategy requires a fetch implementation");
+      }
+      const token = await resolveOpenKeyToken(options.token);
+      const extraHeaders = await resolveOpenKeyHeaders(options.headers);
+      const body = {
+        ...request,
+        ...options.keyId ? { keyId: options.keyId } : {}
+      };
+      const response = await fetchImpl(options.endpoint, {
+        method: "POST",
+        credentials: options.credentials,
+        headers: {
+          "content-type": "application/json",
+          ...token ? { authorization: `Bearer ${token}` } : {},
+          ...extraHeaders
+        },
+        body: JSON.stringify(body)
+      });
+      let parsed;
+      try {
+        parsed = await response.json();
+      } catch {
+        parsed = void 0;
+      }
+      if (!response.ok) {
+        return {
+          approved: false,
+          reason: parsed?.reason ?? parsed?.error ?? `OpenKey signing failed with HTTP ${response.status}`
+        };
+      }
+      if (parsed?.needsApproval || parsed?.approved === false) {
+        return {
+          approved: false,
+          reason: openKeyApprovalReason(parsed)
+        };
+      }
+      if (typeof parsed?.signature === "string" && parsed.signature.length > 0) {
+        return {
+          approved: true,
+          signature: parsed.signature
+        };
+      }
+      return {
+        approved: false,
+        reason: "OpenKey signing response did not include a signature"
+      };
+    }
+  };
+}
 var defaultSignStrategy = { type: "auto-sign" };
 
 // src/authorization/spaceCreation.ts
@@ -5614,6 +5702,31 @@ async function checkNodeInfo(host, sdkProtocol, fetchFn = globalThis.fetch.bind(
   };
 }
 
+// src/index.ts
+import {
+  ACCOUNT_INDEX_SCHEMA as ACCOUNT_INDEX_SCHEMA2,
+  BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES,
+  SECRET_RECORDS_SCHEMA,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+  bootstrapEncryptionNetworkId,
+  bootstrapSpaceId,
+  bootstrapSteps,
+  composeBootstrapSpaceManifest
+} from "@tinycloud/bootstrap";
+
 // src/location.ts
 import { multiaddr } from "@multiformats/multiaddr";
 import { multiaddrToUri } from "@multiformats/multiaddr-to-uri";
@@ -6123,10 +6236,21 @@ function parseRecapCapabilities(parseWasm, siwe) {
   return normalized;
 }
 export {
+  ACCOUNT_INDEX_SCHEMA2 as ACCOUNT_INDEX_SCHEMA,
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE,
   AccountService,
   AutoApproveSpaceCreationHandler,
+  BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES,
   CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
   ClientSessionSchema,
@@ -6138,6 +6262,7 @@ export {
   DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY,
   DEFAULT_KEY_VERSION,
+  DEFAULT_KNOWLEDGE_ROOT,
   DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION,
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
@@ -6170,7 +6295,9 @@ export {
   PermissionNotInManifestError,
   PrefixedKVService,
   ProtocolMismatchError,
+  SECRETS_SPACE,
   SECRET_NAME_RE2 as SECRET_NAME_RE,
+  SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG,
   SQLAction,
@@ -6185,7 +6312,13 @@ export {
   Space,
   SpaceErrorCodes,
   SpaceService,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud,
+  TinyCloudDebugLogger,
   UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE,
   VaultHeaders,
@@ -6194,6 +6327,9 @@ export {
   activateSessionWithHost,
   addressStorageKey,
   applyPrefix,
+  bootstrapEncryptionNetworkId,
+  bootstrapSpaceId,
+  bootstrapSteps,
   buildCanonicalDecryptRequest,
   buildDecryptAttenuation,
   buildDecryptFacts,
@@ -6211,8 +6347,11 @@ export {
   canonicalizeSecretScope,
   checkDecryptInvocationInput,
   checkNodeInfo,
+  clearTinyCloudDebugLogs,
+  composeBootstrapSpaceManifest,
   composeManifestRequest,
   createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy,
   createSharingService,
   createSpaceService,
   createVaultCrypto,
@@ -6223,7 +6362,9 @@ export {
   deriveSignedReceiverKey,
   didCacheKey,
   didEquals,
+  disableTinyCloudDebug,
   discoverNetwork,
+  enableTinyCloudDebug,
   encryptToNetwork,
   base64Decode as encryptionBase64Decode,
   base64Encode as encryptionBase64Encode,
@@ -6238,9 +6379,11 @@ export {
   fetchLocationRecord,
   fetchPeerId,
   generateRandomReceiverKey,
+  getTinyCloudDebugLogs,
   hexDecode,
   hexEncode,
   httpUrlToMultiaddr,
+  installTinyCloudDebugGlobals,
   isCapabilitySubset,
   isEvmAddress,
   isNetworkId,
@@ -6265,6 +6408,7 @@ export {
   principalDidEquals,
   resolveCloudLocation,
   resolveManifest,
+  resolveManifestKnowledgeRoot,
   resolveSecretListPrefix,
   resolveSecretPath2 as resolveSecretPath,
   resolveTinyCloudHosts,
@@ -6273,6 +6417,7 @@ export {
   serviceError5 as serviceError,
   signLocationRecord,
   submitHostDelegation,
+  tinyCloudDebugLogger,
   validateClientSession,
   validateEnvelope,
   validateLocationRecord,