@tinycloud/sdk-core 3.1.0-beta.10 → 3.1.0-beta.11

package/dist/index.d.cts

@@ -7,7 +7,7 @@ export { AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryp
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
 import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-_JkBDZB6.cjs';
 export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-_JkBDZB6.cjs';
-export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
+export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.cjs';
 export { SiweMessage } from 'siwe';
 
@@ -3052,6 +3052,12 @@ declare class AccountService {
          * leave the first attempt's blocks orphaned.
          */
         registerBatch: (spaces: readonly (SpaceInfo | AccountSpace)[]) => Promise<Result<RegisterBatchSuccess>>;
+        /**
+         * Register only spaces without a registry record (TC-800). Existing
+         * records, including renamed or archived ones, are kept byte-for-byte.
+         * Bootstrap repair uses this on populated accounts.
+         */
+        registerMissing: (spaces: readonly (SpaceInfo | AccountSpace)[]) => Promise<Result<AccountSpace[]>>;
         syncAccessible: () => Promise<Result<AccountSpace[]>>;
         remove: (spaceId: string) => Promise<Result<void>>;
     };

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export { AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryp
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
 import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-_JkBDZB6.js';
 export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-_JkBDZB6.js';
-export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
+export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';
 export { SiweMessage } from 'siwe';
 
@@ -3052,6 +3052,12 @@ declare class AccountService {
          * leave the first attempt's blocks orphaned.
          */
         registerBatch: (spaces: readonly (SpaceInfo | AccountSpace)[]) => Promise<Result<RegisterBatchSuccess>>;
+        /**
+         * Register only spaces without a registry record (TC-800). Existing
+         * records, including renamed or archived ones, are kept byte-for-byte.
+         * Bootstrap repair uses this on populated accounts.
+         */
+        registerMissing: (spaces: readonly (SpaceInfo | AccountSpace)[]) => Promise<Result<AccountSpace[]>>;
         syncAccessible: () => Promise<Result<AccountSpace[]>>;
         remove: (spaceId: string) => Promise<Result<void>>;
     };

package/dist/index.js

@@ -13976,6 +13976,56 @@ var AccountService = class {
         await this.upsertSpacesIndexQuietly(registered);
         return ok3({ spaces: registered, recoveredFromBatchError: batchResult.error });
       },
+      /**
+       * Register only spaces without a registry record (TC-800). Existing
+       * records, including renamed or archived ones, are kept byte-for-byte.
+       * Bootstrap repair uses this on populated accounts.
+       */
+      registerMissing: async (spaces) => {
+        if (spaces.length === 0) return ok3([]);
+        await this.config.ensureAccountSpaceHosted?.();
+        const kvResult = this.accountKV();
+        if (!kvResult.ok) return kvResult;
+        const kv = kvResult.data;
+        const stored = spaces.map((space) => spaceRecordFromInput(space));
+        const keys = stored.map((record2) => spaceKey(record2.space_id));
+        const read2 = await kv.batchGet(keys);
+        if (!read2.ok) return accountErr(read2.error);
+        const byKey = new Map(read2.data.results.map((result) => [result.key, result.result]));
+        const final = new Array(keys.length);
+        const missing = [];
+        for (let i = 0; i < keys.length; i++) {
+          const key = keys[i];
+          const result = byKey.get(key);
+          if (!result) {
+            return err3(serviceError4(
+              ErrorCodes4.NETWORK_ERROR,
+              `KV batch read omitted requested key ${JSON.stringify(key)}`,
+              SERVICE_NAME2
+            ));
+          }
+          if (result.ok) {
+            final[i] = spaceFromRecord(key, result.data.data);
+          } else if (result.error.code === ErrorCodes4.KV_NOT_FOUND) {
+            missing.push({ index: i, key, record: stored[i] });
+          } else {
+            return accountErr(result.error);
+          }
+        }
+        const creates = await Promise.all(missing.map(async ({ index, key, record: record2 }) => {
+          const written = await kv.put(key, record2, { ifNoneMatch: "*" });
+          if (written.ok) return { index, result: ok3(spaceFromRecord(key, record2)) };
+          const raced = await kv.get(key);
+          if (raced.ok) return { index, result: ok3(spaceFromRecord(key, raced.data.data)) };
+          return { index, result: err3(written.error) };
+        }));
+        for (const { index, result } of creates) {
+          if (!result.ok) return accountErr(result.error);
+          final[index] = result.data;
+        }
+        await this.upsertSpacesIndexQuietly(final);
+        return ok3(final);
+      },
       syncAccessible: async () => {
         const synced = await this.syncAccessibleSpaces({ tolerateStorageFull: false });
         return synced.ok ? ok3(synced.data.spaces) : synced;
@@ -16041,10 +16091,12 @@ import {
   BOOTSTRAP_SESSION_REQUESTS,
   BOOTSTRAP_SPACE_MANIFESTS,
   BOOTSTRAP_SPACE_NAMES,
+  AGENTS_SPACE,
   SECRET_RECORDS_SCHEMA,
   TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
   TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
   TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_AGENTS_SPACE_MANIFEST,
   TINYCLOUD_PUBLIC_SPACE_MANIFEST,
   TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   bootstrapEncryptionNetworkId,
@@ -18539,6 +18591,7 @@ export {
   ACCOUNT_MANIFEST_PERMISSIONS2 as ACCOUNT_MANIFEST_PERMISSIONS,
   ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE,
+  AGENTS_SPACE,
   ATTESTED_ENFORCER_BINDING_V2_SCHEMA,
   AccountService,
   AutoApproveSpaceCreationHandler,
@@ -18711,6 +18764,7 @@ export {
   SpaceErrorCodes,
   SpaceService,
   TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_AGENTS_SPACE_MANIFEST,
   TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
   TINYCLOUD_CANONICAL_IDENTITY_CLAIM,
   TINYCLOUD_DEFAULT_SPACE_MANIFEST,