@tinycloud/sdk-core 2.4.0-beta.9 → 2.5.0-beta.1

package/dist/index.cjs

@@ -30,10 +30,21 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACCOUNT_INDEX_SCHEMA: () => import_bootstrap2.ACCOUNT_INDEX_SCHEMA,
   ACCOUNT_REGISTRY_PATH: () => ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE: () => ACCOUNT_REGISTRY_SPACE,
   AccountService: () => AccountService,
   AutoApproveSpaceCreationHandler: () => AutoApproveSpaceCreationHandler,
+  BOOTSTRAP_ALLOWLIST: () => import_bootstrap2.BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_SPACE: () => import_bootstrap2.BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME: () => import_bootstrap2.BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE: () => import_bootstrap2.BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST: () => import_bootstrap2.BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS: () => import_bootstrap2.BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE: () => import_bootstrap2.BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS: () => import_bootstrap2.BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS: () => import_bootstrap2.BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES: () => import_bootstrap2.BOOTSTRAP_SPACE_NAMES,
   CapabilityKeyRegistry: () => CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes: () => CapabilityKeyRegistryErrorCodes,
   ClientSessionSchema: () => ClientSessionSchema,
@@ -45,6 +56,7 @@ __export(index_exports, {
   DEFAULT_ENCRYPTION_ALG: () => import_sdk_services7.DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY: () => DEFAULT_EXPIRY,
   DEFAULT_KEY_VERSION: () => import_sdk_services7.DEFAULT_KEY_VERSION,
+  DEFAULT_KNOWLEDGE_ROOT: () => DEFAULT_KNOWLEDGE_ROOT,
   DEFAULT_MANIFEST_SPACE: () => DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION: () => DEFAULT_MANIFEST_VERSION,
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
@@ -77,7 +89,9 @@ __export(index_exports, {
   PermissionNotInManifestError: () => PermissionNotInManifestError,
   PrefixedKVService: () => import_sdk_services7.PrefixedKVService,
   ProtocolMismatchError: () => ProtocolMismatchError,
+  SECRETS_SPACE: () => SECRETS_SPACE,
   SECRET_NAME_RE: () => import_sdk_services7.SECRET_NAME_RE,
+  SECRET_RECORDS_SCHEMA: () => import_bootstrap2.SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT: () => SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG: () => SERVICE_SHORT_TO_LONG,
   SQLAction: () => import_sdk_services7.SQLAction,
@@ -92,7 +106,13 @@ __export(index_exports, {
   Space: () => Space,
   SpaceErrorCodes: () => SpaceErrorCodes,
   SpaceService: () => SpaceService,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST: () => import_bootstrap2.TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST: () => import_bootstrap2.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud: () => TinyCloud,
+  TinyCloudDebugLogger: () => import_sdk_services7.TinyCloudDebugLogger,
   UnsupportedFeatureError: () => UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE: () => VAULT_PERMISSION_SERVICE,
   VaultHeaders: () => import_sdk_services7.VaultHeaders,
@@ -101,6 +121,9 @@ __export(index_exports, {
   activateSessionWithHost: () => activateSessionWithHost,
   addressStorageKey: () => addressStorageKey,
   applyPrefix: () => applyPrefix,
+  bootstrapEncryptionNetworkId: () => import_bootstrap2.bootstrapEncryptionNetworkId,
+  bootstrapSpaceId: () => import_bootstrap2.bootstrapSpaceId,
+  bootstrapSteps: () => import_bootstrap2.bootstrapSteps,
   buildCanonicalDecryptRequest: () => import_sdk_services7.buildCanonicalDecryptRequest,
   buildDecryptAttenuation: () => import_sdk_services7.buildDecryptAttenuation,
   buildDecryptFacts: () => import_sdk_services7.buildDecryptFacts,
@@ -118,8 +141,11 @@ __export(index_exports, {
   canonicalizeSecretScope: () => import_sdk_services7.canonicalizeSecretScope,
   checkDecryptInvocationInput: () => import_sdk_services7.checkDecryptInvocationInput,
   checkNodeInfo: () => checkNodeInfo,
+  clearTinyCloudDebugLogs: () => import_sdk_services7.clearTinyCloudDebugLogs,
+  composeBootstrapSpaceManifest: () => import_bootstrap2.composeBootstrapSpaceManifest,
   composeManifestRequest: () => composeManifestRequest,
   createCapabilityKeyRegistry: () => createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy: () => createOpenKeyCallbackSigningStrategy,
   createSharingService: () => createSharingService,
   createSpaceService: () => createSpaceService,
   createVaultCrypto: () => import_sdk_services7.createVaultCrypto,
@@ -130,7 +156,9 @@ __export(index_exports, {
   deriveSignedReceiverKey: () => import_sdk_services7.deriveSignedReceiverKey,
   didCacheKey: () => didCacheKey,
   didEquals: () => didEquals,
+  disableTinyCloudDebug: () => import_sdk_services7.disableTinyCloudDebug,
   discoverNetwork: () => import_sdk_services7.discoverNetwork,
+  enableTinyCloudDebug: () => import_sdk_services7.enableTinyCloudDebug,
   encryptToNetwork: () => import_sdk_services7.encryptToNetwork,
   encryptionBase64Decode: () => import_sdk_services7.base64Decode,
   encryptionBase64Encode: () => import_sdk_services7.base64Encode,
@@ -145,9 +173,11 @@ __export(index_exports, {
   fetchLocationRecord: () => fetchLocationRecord,
   fetchPeerId: () => fetchPeerId,
   generateRandomReceiverKey: () => import_sdk_services7.generateRandomReceiverKey,
+  getTinyCloudDebugLogs: () => import_sdk_services7.getTinyCloudDebugLogs,
   hexDecode: () => import_sdk_services7.hexDecode,
   hexEncode: () => import_sdk_services7.hexEncode,
   httpUrlToMultiaddr: () => httpUrlToMultiaddr,
+  installTinyCloudDebugGlobals: () => import_sdk_services7.installTinyCloudDebugGlobals,
   isCapabilitySubset: () => isCapabilitySubset,
   isEvmAddress: () => isEvmAddress,
   isNetworkId: () => import_sdk_services7.isNetworkId,
@@ -172,6 +202,7 @@ __export(index_exports, {
   principalDidEquals: () => principalDidEquals,
   resolveCloudLocation: () => resolveCloudLocation,
   resolveManifest: () => resolveManifest,
+  resolveManifestKnowledgeRoot: () => resolveManifestKnowledgeRoot,
   resolveSecretListPrefix: () => import_sdk_services7.resolveSecretListPrefix,
   resolveSecretPath: () => import_sdk_services7.resolveSecretPath,
   resolveTinyCloudHosts: () => resolveTinyCloudHosts,
@@ -180,6 +211,7 @@ __export(index_exports, {
   serviceError: () => import_sdk_services7.serviceError,
   signLocationRecord: () => signLocationRecord,
   submitHostDelegation: () => submitHostDelegation,
+  tinyCloudDebugLogger: () => import_sdk_services7.tinyCloudDebugLogger,
   validateClientSession: () => validateClientSession,
   validateEnvelope: () => import_sdk_services7.validateEnvelope,
   validateLocationRecord: () => validateLocationRecord,
@@ -379,7 +411,15 @@ var PersistedSessionDataSchema = import_zod2.z.object({
   /** Schema version for migrations */
   version: import_zod2.z.string(),
   /** Optional ENS data */
-  ens: EnsDataSchema2.optional()
+  ens: EnsDataSchema2.optional(),
+  /**
+   * TinyCloud hosts this session was created against. Persisted so a
+   * restored session resolves to the same node without re-running the
+   * registry/fallback resolution (or the wallet sign-in flow). Optional
+   * for backward compatibility with sessions persisted before this field
+   * existed — those restore and lazily re-resolve their hosts.
+   */
+  tinycloudHosts: import_zod2.z.array(import_zod2.z.string()).optional()
 });
 var TinyCloudSessionSchema = import_zod2.z.object({
   /** User's Ethereum address */
@@ -430,6 +470,15 @@ var import_sdk_services3 = require("@tinycloud/sdk-services");
 var import_sdk_services2 = require("@tinycloud/sdk-services");
 
 // src/spaces/Space.ts
+function unavailableSecretsService() {
+  return new Proxy({}, {
+    get: () => {
+      throw new Error(
+        "Secrets service factory not configured. Provide createSecrets in SpaceConfig."
+      );
+    }
+  });
+}
 var Space = class {
   /**
    * Create a new Space instance.
@@ -441,6 +490,7 @@ var Space = class {
     this._name = config.name;
     this._kv = config.createKV(config.id);
     this._vault = config.createVault(config.id);
+    this._secrets = config.createSecrets?.(config.id) ?? unavailableSecretsService();
     this._delegations = config.createDelegations(config.id);
     this._sharing = config.createSharing(config.id);
     this._getInfo = config.getInfo;
@@ -469,6 +519,12 @@ var Space = class {
   get vault() {
     return this._vault;
   }
+  /**
+   * Secrets operations scoped to this space.
+   */
+  get secrets() {
+    return this._secrets;
+  }
   /**
    * Delegation operations scoped to this space.
    */
@@ -854,6 +910,8 @@ var SpaceConfigSchema = import_zod4.z.object({
   createKV: import_zod4.z.function(),
   /** Factory function to create a space-scoped Data Vault service */
   createVault: import_zod4.z.function(),
+  /** Optional factory function to create a space-scoped secrets service */
+  createSecrets: import_zod4.z.function().optional(),
   /** Factory function to create space-scoped delegations */
   createDelegations: import_zod4.z.function(),
   /** Factory function to create space-scoped sharing */
@@ -876,6 +934,8 @@ var SpaceServiceConfigSchema = import_zod4.z.object({
   createKVService: import_zod4.z.function().optional(),
   /** Factory function to create a space-scoped Data Vault service */
   createVaultService: import_zod4.z.function().optional(),
+  /** Factory function to create a space-scoped secrets service */
+  createSecretsService: import_zod4.z.function().optional(),
   /** User's PKH DID (derived from address or provided explicitly) */
   userDid: import_zod4.z.string().optional(),
   /** Optional SharingService for v2 sharing links (client-side) */
@@ -1148,6 +1208,7 @@ var SpaceService = class {
     this.capabilityRegistry = config.capabilityRegistry;
     this.createKVServiceFn = config.createKVService;
     this.createVaultServiceFn = config.createVaultService;
+    this.createSecretsServiceFn = config.createSecretsService;
     this._userDid = config.userDid;
     this.sharingService = config.sharingService;
     this.createDelegationFn = config.createDelegation;
@@ -1164,6 +1225,7 @@ var SpaceService = class {
     if (config.capabilityRegistry) this.capabilityRegistry = config.capabilityRegistry;
     if (config.createKVService) this.createKVServiceFn = config.createKVService;
     if (config.createVaultService) this.createVaultServiceFn = config.createVaultService;
+    if (config.createSecretsService) this.createSecretsServiceFn = config.createSecretsService;
     if (config.userDid !== void 0) this._userDid = config.userDid;
     if (config.sharingService) this.sharingService = config.sharingService;
     if (config.createDelegation) this.createDelegationFn = config.createDelegation;
@@ -1457,6 +1519,7 @@ var SpaceService = class {
       name,
       createKV: this.createSpaceScopedKV.bind(this),
       createVault: this.createSpaceScopedVault.bind(this),
+      createSecrets: this.createSpaceScopedSecrets.bind(this),
       createDelegations: this.createSpaceScopedDelegations.bind(this),
       createSharing: this.createSpaceScopedSharing.bind(this),
       getInfo: this.getSpaceInfo.bind(this)
@@ -1601,6 +1664,21 @@ var SpaceService = class {
       }
     });
   }
+  /**
+   * Create a space-scoped secrets service.
+   */
+  createSpaceScopedSecrets(spaceId) {
+    if (this.createSecretsServiceFn) {
+      return this.createSecretsServiceFn(spaceId);
+    }
+    return new Proxy({}, {
+      get: () => {
+        throw new Error(
+          "Secrets service factory not configured. Provide createSecretsService in SpaceServiceConfig."
+        );
+      }
+    });
+  }
   /**
    * Create space-scoped delegation operations.
    */
@@ -2349,6 +2427,7 @@ var import_sdk_services5 = require("@tinycloud/sdk-services");
 // src/manifest.ts
 var import_ms = __toESM(require("ms"), 1);
 var import_sdk_services4 = require("@tinycloud/sdk-services");
+var DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
 var ManifestValidationError = class extends Error {
   constructor(message) {
     super(`Manifest validation failed: ${message}`);
@@ -2403,7 +2482,7 @@ var DEFAULT_ADMIN_ENTRIES = [
     service: "tinycloud.sql",
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
-    actions: ["read", "write", "ddl"]
+    actions: ["read", "write", "schema"]
   }
 ];
 var DEFAULT_ALL_ENTRIES = [
@@ -2417,7 +2496,7 @@ var DEFAULT_ALL_ENTRIES = [
     service: "tinycloud.sql",
     space: DEFAULT_MANIFEST_SPACE,
     path: "/",
-    actions: ["read", "write", "ddl"]
+    actions: ["read", "write", "schema"]
   },
   {
     service: "tinycloud.duckdb",
@@ -2575,6 +2654,9 @@ function validateManifest(input) {
   if (m.expiry !== void 0) {
     parseExpiry(m.expiry);
   }
+  if (m.knowledge !== void 0) {
+    resolveManifestKnowledgeRoot(m.knowledge);
+  }
   if (m.permissions !== void 0) {
     if (!Array.isArray(m.permissions)) {
       throw new ManifestValidationError(
@@ -2590,6 +2672,25 @@ function validateManifest(input) {
   }
   return m;
 }
+function resolveManifestKnowledgeRoot(knowledge) {
+  if (knowledge === void 0) {
+    return void 0;
+  }
+  if (knowledge === true) {
+    return DEFAULT_KNOWLEDGE_ROOT;
+  }
+  if (typeof knowledge !== "string" || knowledge.length === 0) {
+    throw new ManifestValidationError(
+      "manifest.knowledge must be true or a knowledge/*.md root path"
+    );
+  }
+  if (!/^knowledge\/.+\.md$/.test(knowledge)) {
+    throw new ManifestValidationError(
+      "manifest.knowledge must be true or a knowledge/*.md root path"
+    );
+  }
+  return knowledge;
+}
 function validateManifestSecrets(secrets) {
   if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
     throw new ManifestValidationError("manifest.secrets must be an object");
@@ -2989,7 +3090,7 @@ function accountRegistryIndexPermission() {
     service: "tinycloud.sql",
     space: ACCOUNT_REGISTRY_SPACE,
     path: "account",
-    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/ddl"]
+    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema"]
   };
 }
 function composeManifestRequest(inputs, options = {}) {
@@ -3094,8 +3195,10 @@ function manifestAbilitiesUnion(resolved) {
 }
 
 // src/account/AccountService.ts
+var import_bootstrap = require("@tinycloud/bootstrap");
 var SERVICE_NAME2 = "account";
 var ACCOUNT_INDEX_DB = "account";
+var ACCOUNT_INDEX_NAMESPACE = "tinycloud.account.index";
 var ACCOUNT_SPACES_PATH = "spaces/";
 var AccountService = class {
   constructor(config) {
@@ -3290,6 +3393,13 @@ var AccountService = class {
       }
     };
     this.index = {
+      ensure: async () => {
+        const dbResult = this.accountDb();
+        if (!dbResult.ok) return dbResult;
+        const schema = await this.ensureAccountIndex(dbResult.data);
+        if (!schema.ok) return schema;
+        return (0, import_sdk_services5.ok)({ database: ACCOUNT_INDEX_DB });
+      },
       rebuild: async () => {
         const dbResult = this.accountDb();
         if (!dbResult.ok) return dbResult;
@@ -3300,8 +3410,9 @@ var AccountService = class {
         const delegations = await this.delegations.list();
         if (!delegations.ok) return delegations;
         const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+        const schema = await this.ensureAccountIndex(dbResult.data);
+        if (!schema.ok) return schema;
         const statements = [
-          ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
           { sql: "DELETE FROM applications" },
           { sql: "DELETE FROM application_state" },
           { sql: "DELETE FROM spaces" },
@@ -3498,7 +3609,7 @@ var AccountService = class {
   async indexHasApplicationHash(appId, manifestHash) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return false;
-    const schema = await dbResult.data.batch(ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })));
+    const schema = await this.ensureAccountIndex(dbResult.data);
     if (!schema.ok) return false;
     const queried = await dbResult.data.query(
       "SELECT 1 FROM application_state WHERE app_id = ? AND manifest_hash = ? LIMIT 1",
@@ -3512,10 +3623,11 @@ var AccountService = class {
   async upsertApplicationIndex(app) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const updatedAt = app.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
     const manifestHash = app.manifestHash ?? hashJson(app.manifests);
     const written = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       {
         sql: "INSERT OR REPLACE INTO applications (app_id, name, description, updated_at, manifest_json) VALUES (?, ?, ?, ?, ?)",
         params: [
@@ -3540,8 +3652,9 @@ var AccountService = class {
   async deleteApplicationIndex(appId) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       { sql: "DELETE FROM applications WHERE app_id = ?", params: [appId] },
       { sql: "DELETE FROM application_state WHERE app_id = ?", params: [appId] }
     ]);
@@ -3554,9 +3667,10 @@ var AccountService = class {
   async upsertSpaceIndex(space) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const updatedAt = space.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
     const written = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       {
         sql: "INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
         params: [
@@ -3581,8 +3695,9 @@ var AccountService = class {
   async deleteSpaceIndex(spaceId) {
     const dbResult = this.accountDb();
     if (!dbResult.ok) return (0, import_sdk_services5.ok)(void 0);
+    const schema = await this.ensureAccountIndex(dbResult.data);
+    if (!schema.ok) return schema;
     const deleted = await dbResult.data.batch([
-      ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
       { sql: "DELETE FROM spaces WHERE space_id = ?", params: [spaceId] }
     ]);
     if (!deleted.ok) return accountErr(deleted.error);
@@ -3604,8 +3719,9 @@ var AccountService = class {
       const dbResult = this.accountDb();
       if (!dbResult.ok) return;
       const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
       await dbResult.data.batch([
-        ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
         { sql: "DELETE FROM applications" },
         { sql: "DELETE FROM application_state" },
         ...applications.map((app) => ({
@@ -3634,8 +3750,9 @@ var AccountService = class {
       const dbResult = this.accountDb();
       if (!dbResult.ok) return;
       const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
       await dbResult.data.batch([
-        ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
         { sql: "DELETE FROM spaces" },
         ...spaces.map((space) => ({
           sql: "INSERT OR REPLACE INTO spaces (space_id, name, owner_did, type, permissions_json, status, registered_at, updated_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
@@ -3663,8 +3780,9 @@ var AccountService = class {
       const dbResult = this.accountDb();
       if (!dbResult.ok) return;
       const syncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const schema = await this.ensureAccountIndex(dbResult.data);
+      if (!schema.ok) return;
       await dbResult.data.batch([
-        ...ACCOUNT_INDEX_SCHEMA.map((sql) => ({ sql })),
         { sql: "DELETE FROM delegations" },
         ...delegations.map((delegation) => ({
           sql: "INSERT OR REPLACE INTO delegations (cid, direction, space_id, space_name, counterparty_did, delegate_did, delegator_did, path, actions_json, expiry, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
@@ -3691,57 +3809,20 @@ var AccountService = class {
       ]);
     });
   }
+  async ensureAccountIndex(db) {
+    const migrated = await db.migrations.apply({
+      namespace: ACCOUNT_INDEX_NAMESPACE,
+      migrations: [
+        {
+          id: "001_initial",
+          sql: [...import_bootstrap.ACCOUNT_INDEX_SCHEMA]
+        }
+      ]
+    });
+    if (!migrated.ok) return accountErr(migrated.error);
+    return (0, import_sdk_services5.ok)(void 0);
+  }
 };
-var ACCOUNT_INDEX_SCHEMA = [
-  `CREATE TABLE IF NOT EXISTS applications (
-    app_id TEXT PRIMARY KEY,
-    name TEXT,
-    description TEXT,
-    updated_at TEXT,
-    manifest_json TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS application_state (
-    app_id TEXT PRIMARY KEY,
-    manifest_hash TEXT NOT NULL,
-    indexed_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS spaces (
-    space_id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    owner_did TEXT NOT NULL,
-    type TEXT NOT NULL,
-    permissions_json TEXT NOT NULL,
-    status TEXT NOT NULL,
-    registered_at TEXT,
-    updated_at TEXT NOT NULL,
-    expires_at TEXT
-  )`,
-  `CREATE TABLE IF NOT EXISTS delegations (
-    cid TEXT PRIMARY KEY,
-    direction TEXT NOT NULL,
-    space_id TEXT NOT NULL,
-    space_name TEXT,
-    counterparty_did TEXT NOT NULL,
-    delegate_did TEXT NOT NULL,
-    delegator_did TEXT,
-    path TEXT NOT NULL,
-    actions_json TEXT NOT NULL,
-    expiry TEXT NOT NULL,
-    status TEXT NOT NULL,
-    created_at TEXT,
-    updated_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS sync_state (
-    source TEXT PRIMARY KEY,
-    synced_at TEXT NOT NULL,
-    count INTEGER NOT NULL
-  )`,
-  "CREATE INDEX IF NOT EXISTS idx_delegations_direction ON delegations(direction)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_space ON delegations(space_id)",
-  "CREATE INDEX IF NOT EXISTS idx_delegations_counterparty ON delegations(counterparty_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_did)",
-  "CREATE INDEX IF NOT EXISTS idx_spaces_type ON spaces(type)"
-];
 function applicationKey(appId) {
   return `${ACCOUNT_REGISTRY_PATH}${appId}`;
 }
@@ -5651,6 +5732,76 @@ function createCapabilityKeyRegistry() {
 }
 
 // src/authorization/strategies.ts
+async function resolveOpenKeyToken(token) {
+  return typeof token === "function" ? token() : token;
+}
+async function resolveOpenKeyHeaders(headers) {
+  return typeof headers === "function" ? headers() : headers ?? {};
+}
+function openKeyApprovalReason(body) {
+  if (body.reason) return body.reason;
+  if (body.error) return body.error;
+  if (body.approvalUrl) {
+    return `OpenKey explicit approval required: ${body.approvalUrl}`;
+  }
+  return "OpenKey explicit approval required";
+}
+function createOpenKeyCallbackSigningStrategy(options) {
+  return {
+    type: "callback",
+    openKeyAutoSign: true,
+    handler: async (request) => {
+      const fetchImpl = options.fetch ?? globalThis.fetch;
+      if (!fetchImpl) {
+        throw new Error("OpenKey signing strategy requires a fetch implementation");
+      }
+      const token = await resolveOpenKeyToken(options.token);
+      const extraHeaders = await resolveOpenKeyHeaders(options.headers);
+      const body = {
+        ...request,
+        ...options.keyId ? { keyId: options.keyId } : {}
+      };
+      const response = await fetchImpl(options.endpoint, {
+        method: "POST",
+        credentials: options.credentials,
+        headers: {
+          "content-type": "application/json",
+          ...token ? { authorization: `Bearer ${token}` } : {},
+          ...extraHeaders
+        },
+        body: JSON.stringify(body)
+      });
+      let parsed;
+      try {
+        parsed = await response.json();
+      } catch {
+        parsed = void 0;
+      }
+      if (!response.ok) {
+        return {
+          approved: false,
+          reason: parsed?.reason ?? parsed?.error ?? `OpenKey signing failed with HTTP ${response.status}`
+        };
+      }
+      if (parsed?.needsApproval || parsed?.approved === false) {
+        return {
+          approved: false,
+          reason: openKeyApprovalReason(parsed)
+        };
+      }
+      if (typeof parsed?.signature === "string" && parsed.signature.length > 0) {
+        return {
+          approved: true,
+          signature: parsed.signature
+        };
+      }
+      return {
+        approved: false,
+        reason: "OpenKey signing response did not include a signature"
+      };
+    }
+  };
+}
 var defaultSignStrategy = { type: "auto-sign" };
 
 // src/authorization/spaceCreation.ts
@@ -5726,6 +5877,9 @@ async function checkNodeInfo(host, sdkProtocol, fetchFn = globalThis.fetch.bind(
   };
 }
 
+// src/index.ts
+var import_bootstrap2 = require("@tinycloud/bootstrap");
+
 // src/location.ts
 var import_multiaddr = require("@multiformats/multiaddr");
 var import_multiaddr_to_uri = require("@multiformats/multiaddr-to-uri");
@@ -6236,10 +6390,21 @@ function parseRecapCapabilities(parseWasm, siwe) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACCOUNT_INDEX_SCHEMA,
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE,
   AccountService,
   AutoApproveSpaceCreationHandler,
+  BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES,
   CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes,
   ClientSessionSchema,
@@ -6251,6 +6416,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   DEFAULT_ENCRYPTION_ALG,
   DEFAULT_EXPIRY,
   DEFAULT_KEY_VERSION,
+  DEFAULT_KNOWLEDGE_ROOT,
   DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION,
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
@@ -6283,7 +6449,9 @@ function parseRecapCapabilities(parseWasm, siwe) {
   PermissionNotInManifestError,
   PrefixedKVService,
   ProtocolMismatchError,
+  SECRETS_SPACE,
   SECRET_NAME_RE,
+  SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG,
   SQLAction,
@@ -6298,7 +6466,13 @@ function parseRecapCapabilities(parseWasm, siwe) {
   Space,
   SpaceErrorCodes,
   SpaceService,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud,
+  TinyCloudDebugLogger,
   UnsupportedFeatureError,
   VAULT_PERMISSION_SERVICE,
   VaultHeaders,
@@ -6307,6 +6481,9 @@ function parseRecapCapabilities(parseWasm, siwe) {
   activateSessionWithHost,
   addressStorageKey,
   applyPrefix,
+  bootstrapEncryptionNetworkId,
+  bootstrapSpaceId,
+  bootstrapSteps,
   buildCanonicalDecryptRequest,
   buildDecryptAttenuation,
   buildDecryptFacts,
@@ -6324,8 +6501,11 @@ function parseRecapCapabilities(parseWasm, siwe) {
   canonicalizeSecretScope,
   checkDecryptInvocationInput,
   checkNodeInfo,
+  clearTinyCloudDebugLogs,
+  composeBootstrapSpaceManifest,
   composeManifestRequest,
   createCapabilityKeyRegistry,
+  createOpenKeyCallbackSigningStrategy,
   createSharingService,
   createSpaceService,
   createVaultCrypto,
@@ -6336,7 +6516,9 @@ function parseRecapCapabilities(parseWasm, siwe) {
   deriveSignedReceiverKey,
   didCacheKey,
   didEquals,
+  disableTinyCloudDebug,
   discoverNetwork,
+  enableTinyCloudDebug,
   encryptToNetwork,
   encryptionBase64Decode,
   encryptionBase64Encode,
@@ -6351,9 +6533,11 @@ function parseRecapCapabilities(parseWasm, siwe) {
   fetchLocationRecord,
   fetchPeerId,
   generateRandomReceiverKey,
+  getTinyCloudDebugLogs,
   hexDecode,
   hexEncode,
   httpUrlToMultiaddr,
+  installTinyCloudDebugGlobals,
   isCapabilitySubset,
   isEvmAddress,
   isNetworkId,
@@ -6378,6 +6562,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   principalDidEquals,
   resolveCloudLocation,
   resolveManifest,
+  resolveManifestKnowledgeRoot,
   resolveSecretListPrefix,
   resolveSecretPath,
   resolveTinyCloudHosts,
@@ -6386,6 +6571,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
   serviceError,
   signLocationRecord,
   submitHostDelegation,
+  tinyCloudDebugLogger,
   validateClientSession,
   validateEnvelope,
   validateLocationRecord,