@tinycloud/node-sdk 3.3.0-beta.18 → 3.3.0-beta.21

package/dist/{TinyCloudNode-DmF9QUcS.d.cts → TinyCloudNode-BPDOmuf6.d.cts}

@@ -1,5 +1,5 @@
 import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
-import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
+import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, RegistryPolicy, RegistrySequenceStore, OnNodeNotFound, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
 import { ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction, FetchFunction } from '@tinycloud/sdk-services';
@@ -181,8 +181,46 @@ interface NodeUserAuthorizationConfig {
     tinycloudHosts?: string[];
     /** TinyCloud location registry URL. Default: https://registry.tinycloud.xyz. */
     tinycloudRegistryUrl?: string | null;
-    /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
+    /**
+     * Fallback TinyCloud hosts. Default: hosted TinyCloud node. Used only by the
+     * default `registryPolicy` ("legacy-fallback"), whose silent fallback is
+     * deprecated and will be removed in a future major release.
+     */
     tinycloudFallbackHosts?: string[] | null;
+    /**
+     * How sign-in uses the location registry when no host is configured.
+     *
+     * - `"legacy-fallback"` (default, deprecated): a registry miss or failure
+     *   silently uses `tinycloudFallbackHosts`, with a one-time warning.
+     * - `"fail-closed"`: sign-in acts on the registry verdict for the signer
+     *   address. Registered owners go to their listed hosts, unregistered owners
+     *   to `newUserHost`, and an unavailable registry is
+     *   `RegistryUnavailableError`, never a new account. Automatic space
+     *   creation is refused on a host the owner's record does not list
+     *   (`NodeRegistryEntryExistsError`) or when the registry gives no verdict
+     *   (`RegistryUnavailableError`).
+     */
+    registryPolicy?: RegistryPolicy;
+    /**
+     * `fail-closed` only: host for owners with no registry record (and only
+     * them). Default https://node.tinycloud.xyz. `null` refuses them with
+     * `NodeNotFoundError`.
+     */
+    newUserHost?: string | null;
+    /**
+     * `fail-closed` only: chain ID of the v1 registry subject, which is built
+     * from the signer address, never the session chain. Default 1.
+     */
+    registryChainId?: number;
+    /** `fail-closed` only: highest registry sequence seen per owner. Default: in-memory. */
+    registrySequenceStore?: RegistrySequenceStore;
+    /**
+     * `fail-closed` only: called when sign-in resolves no host
+     * (`NodeNotFoundError` or `RegistryUnavailableError`) to retry, use another
+     * host (not identity-checked; it persists with the session), or abort.
+     * Without it, sign-in throws the error.
+     */
+    onNodeNotFound?: OnNodeNotFound;
     /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
     /** Local loopback node URL to probe. Omit to avoid probing loopback. */
@@ -295,6 +333,13 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private tinycloudHosts?;
     private readonly tinycloudRegistryUrl?;
     private readonly tinycloudFallbackHosts?;
+    private readonly registryPolicy?;
+    private readonly newUserHost?;
+    private readonly registryChainId?;
+    private readonly registrySequenceStore;
+    private readonly onNodeNotFound?;
+    /** Verdict from the last `fail-closed` host resolution, reused by {@link assertMayCreateSpace}. */
+    private registryVerdict?;
     private readonly autoDiscoverLocalNode?;
     private readonly localNodeUrl?;
     private readonly localLinkName?;
@@ -415,6 +460,16 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     ensureTinyCloudHosts(): Promise<void>;
     private resolveTinyCloudHostsForSignIn;
+    /**
+     * Space-creation guard (TC-1443). Under `registryPolicy: "fail-closed"`,
+     * throws unless the owner's registry verdict allows a space on the primary
+     * host: `NodeRegistryEntryExistsError` when the owner's record does not
+     * list it, `RegistryUnavailableError` when the registry gives no
+     * verdict. Reuses this session's sign-in verdict unless it was
+     * `unavailable`, else looks it up now (explicit-host apps). Under the
+     * default policy it returns at once and performs no lookup.
+     */
+    assertMayCreateSpace(): Promise<void>;
     private requireTinyCloudHosts;
     private get primaryTinyCloudHost();
     get nodeFeatures(): string[];
@@ -551,6 +606,8 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * @throws Error if space creation fails
      */
     ensureSpaceExists(): Promise<void>;
+    /** {@link assertMayCreateSpace}, reporting a refusal to the creation handler before rethrowing it. */
+    private guardSpaceCreation;
     private recordActivationSkippedSpaces;
     createBootstrapSession(options: CreateBootstrapSessionOptions): Promise<TinyCloudSession>;
     private persistedData;
@@ -1175,8 +1232,35 @@ interface TinyCloudNodeConfig {
     host?: string;
     /** TinyCloud location registry URL. Default: https://registry.tinycloud.xyz. */
     tinycloudRegistryUrl?: string | null;
-    /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
+    /**
+     * Fallback TinyCloud hosts. Default: hosted TinyCloud node. Used only by the
+     * default `registryPolicy` ("legacy-fallback"), whose silent fallback is
+     * deprecated and will be removed in a future major release.
+     */
     tinycloudFallbackHosts?: string[] | null;
+    /**
+     * How sign-in uses the location registry when no `host` is configured.
+     * Default `"legacy-fallback"` (deprecated): a registry miss or failure
+     * silently uses `tinycloudFallbackHosts`, with a one-time warning.
+     * `"fail-closed"`: routing acts on the registry verdict for the signer
+     * address, an unavailable registry is `RegistryUnavailableError` (never a
+     * new account), record hosts are used only if HTTPS or loopback, and
+     * automatic space creation (sign-in, account bootstrap, owned-space
+     * hosting, the public space the vault creates) is refused on a host the
+     * owner's registry record does not list (`NodeRegistryEntryExistsError`)
+     * or when the registry gives no verdict. An explicit `hostOwnedSpace()`
+     * call is not guarded. `newUserHost` governs routing only: a pinned host
+     * may still create spaces for an unregistered owner.
+     */
+    registryPolicy?: RegistryPolicy;
+    /** `fail-closed` only: host for owners with no registry record. Default https://node.tinycloud.xyz; `null` refuses them with `NodeNotFoundError`. */
+    newUserHost?: string | null;
+    /** `fail-closed` only: chain ID of the v1 registry subject built from the signer address (never the session chain). Default 1. */
+    registryChainId?: number;
+    /** `fail-closed` only: highest registry sequence seen per owner. Default: in-memory for this client. */
+    registrySequenceStore?: RegistrySequenceStore;
+    /** `fail-closed` only: retry, use another host (not identity-checked; it persists with the session), or abort when sign-in resolves no host. Without it, sign-in throws. */
+    onNodeNotFound?: OnNodeNotFound;
     /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
     /** Local loopback node URL to probe. Omit to avoid probing loopback. */
@@ -1904,10 +1988,26 @@ declare class TinyCloudNode {
      * session's recap doesn't cover it and the registry has no record; the host
      * SIWE is idempotent server-side. Must be called after {@link signIn}.
      *
+     * Under `registryPolicy: "fail-closed"`, hosting is refused with
+     * `NodeRegistryEntryExistsError` when the owner's registry record does not
+     * list the host, or `RegistryUnavailableError` when the registry gives no
+     * verdict. {@link hostOwnedSpace} itself is an explicit action and is not
+     * guarded.
+     *
      * @param name - The owned space name (e.g. `"secrets"`).
      * @returns The hosted owned-space URI.
      */
     ensureOwnedSpaceHosted(name: string): Promise<string>;
+    /**
+     * Space-creation guard (TC-1443) for the automatic hosting paths: sign-in's
+     * owned spaces, account bootstrap, {@link ensureOwnedSpaceHosted} and
+     * {@link ensurePublicSpace}. Only `registryPolicy: "fail-closed"` consults
+     * the registry ({@link NodeUserAuthorization.assertMayCreateSpace}); the
+     * default policy performs no lookup.
+     */
+    private assertMayCreateSpace;
+    /** Registry-policy settings shared by every authorization this client creates. */
+    private registryPolicyConfig;
     /**
      * Submit the host delegation for an owned space, sharing one in-flight
      * request (and so one approval) between concurrent callers in this session,
@@ -2457,7 +2557,9 @@ declare class TinyCloudNode {
      * Ensure the user's public space exists and is accessible.
      * Creates the space and activates a session delegation for it.
      * This is the trigger for lazy public space creation — call it
-     * before writing to spaces.get('public').kv.
+     * before writing to spaces.get('public').kv. The vault calls it on unlock.
+     * Under `registryPolicy: "fail-closed"` creation goes through the
+     * space-creation guard.
      */
     ensurePublicSpace(): Promise<void>;
     /**

package/dist/{TinyCloudNode-DmF9QUcS.d.ts → TinyCloudNode-BPDOmuf6.d.ts}

@@ -1,5 +1,5 @@
 import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
-import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
+import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, RegistryPolicy, RegistrySequenceStore, OnNodeNotFound, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
 import { ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction, FetchFunction } from '@tinycloud/sdk-services';
@@ -181,8 +181,46 @@ interface NodeUserAuthorizationConfig {
     tinycloudHosts?: string[];
     /** TinyCloud location registry URL. Default: https://registry.tinycloud.xyz. */
     tinycloudRegistryUrl?: string | null;
-    /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
+    /**
+     * Fallback TinyCloud hosts. Default: hosted TinyCloud node. Used only by the
+     * default `registryPolicy` ("legacy-fallback"), whose silent fallback is
+     * deprecated and will be removed in a future major release.
+     */
     tinycloudFallbackHosts?: string[] | null;
+    /**
+     * How sign-in uses the location registry when no host is configured.
+     *
+     * - `"legacy-fallback"` (default, deprecated): a registry miss or failure
+     *   silently uses `tinycloudFallbackHosts`, with a one-time warning.
+     * - `"fail-closed"`: sign-in acts on the registry verdict for the signer
+     *   address. Registered owners go to their listed hosts, unregistered owners
+     *   to `newUserHost`, and an unavailable registry is
+     *   `RegistryUnavailableError`, never a new account. Automatic space
+     *   creation is refused on a host the owner's record does not list
+     *   (`NodeRegistryEntryExistsError`) or when the registry gives no verdict
+     *   (`RegistryUnavailableError`).
+     */
+    registryPolicy?: RegistryPolicy;
+    /**
+     * `fail-closed` only: host for owners with no registry record (and only
+     * them). Default https://node.tinycloud.xyz. `null` refuses them with
+     * `NodeNotFoundError`.
+     */
+    newUserHost?: string | null;
+    /**
+     * `fail-closed` only: chain ID of the v1 registry subject, which is built
+     * from the signer address, never the session chain. Default 1.
+     */
+    registryChainId?: number;
+    /** `fail-closed` only: highest registry sequence seen per owner. Default: in-memory. */
+    registrySequenceStore?: RegistrySequenceStore;
+    /**
+     * `fail-closed` only: called when sign-in resolves no host
+     * (`NodeNotFoundError` or `RegistryUnavailableError`) to retry, use another
+     * host (not identity-checked; it persists with the session), or abort.
+     * Without it, sign-in throws the error.
+     */
+    onNodeNotFound?: OnNodeNotFound;
     /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
     /** Local loopback node URL to probe. Omit to avoid probing loopback. */
@@ -295,6 +333,13 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private tinycloudHosts?;
     private readonly tinycloudRegistryUrl?;
     private readonly tinycloudFallbackHosts?;
+    private readonly registryPolicy?;
+    private readonly newUserHost?;
+    private readonly registryChainId?;
+    private readonly registrySequenceStore;
+    private readonly onNodeNotFound?;
+    /** Verdict from the last `fail-closed` host resolution, reused by {@link assertMayCreateSpace}. */
+    private registryVerdict?;
     private readonly autoDiscoverLocalNode?;
     private readonly localNodeUrl?;
     private readonly localLinkName?;
@@ -415,6 +460,16 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     ensureTinyCloudHosts(): Promise<void>;
     private resolveTinyCloudHostsForSignIn;
+    /**
+     * Space-creation guard (TC-1443). Under `registryPolicy: "fail-closed"`,
+     * throws unless the owner's registry verdict allows a space on the primary
+     * host: `NodeRegistryEntryExistsError` when the owner's record does not
+     * list it, `RegistryUnavailableError` when the registry gives no
+     * verdict. Reuses this session's sign-in verdict unless it was
+     * `unavailable`, else looks it up now (explicit-host apps). Under the
+     * default policy it returns at once and performs no lookup.
+     */
+    assertMayCreateSpace(): Promise<void>;
     private requireTinyCloudHosts;
     private get primaryTinyCloudHost();
     get nodeFeatures(): string[];
@@ -551,6 +606,8 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * @throws Error if space creation fails
      */
     ensureSpaceExists(): Promise<void>;
+    /** {@link assertMayCreateSpace}, reporting a refusal to the creation handler before rethrowing it. */
+    private guardSpaceCreation;
     private recordActivationSkippedSpaces;
     createBootstrapSession(options: CreateBootstrapSessionOptions): Promise<TinyCloudSession>;
     private persistedData;
@@ -1175,8 +1232,35 @@ interface TinyCloudNodeConfig {
     host?: string;
     /** TinyCloud location registry URL. Default: https://registry.tinycloud.xyz. */
     tinycloudRegistryUrl?: string | null;
-    /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
+    /**
+     * Fallback TinyCloud hosts. Default: hosted TinyCloud node. Used only by the
+     * default `registryPolicy` ("legacy-fallback"), whose silent fallback is
+     * deprecated and will be removed in a future major release.
+     */
     tinycloudFallbackHosts?: string[] | null;
+    /**
+     * How sign-in uses the location registry when no `host` is configured.
+     * Default `"legacy-fallback"` (deprecated): a registry miss or failure
+     * silently uses `tinycloudFallbackHosts`, with a one-time warning.
+     * `"fail-closed"`: routing acts on the registry verdict for the signer
+     * address, an unavailable registry is `RegistryUnavailableError` (never a
+     * new account), record hosts are used only if HTTPS or loopback, and
+     * automatic space creation (sign-in, account bootstrap, owned-space
+     * hosting, the public space the vault creates) is refused on a host the
+     * owner's registry record does not list (`NodeRegistryEntryExistsError`)
+     * or when the registry gives no verdict. An explicit `hostOwnedSpace()`
+     * call is not guarded. `newUserHost` governs routing only: a pinned host
+     * may still create spaces for an unregistered owner.
+     */
+    registryPolicy?: RegistryPolicy;
+    /** `fail-closed` only: host for owners with no registry record. Default https://node.tinycloud.xyz; `null` refuses them with `NodeNotFoundError`. */
+    newUserHost?: string | null;
+    /** `fail-closed` only: chain ID of the v1 registry subject built from the signer address (never the session chain). Default 1. */
+    registryChainId?: number;
+    /** `fail-closed` only: highest registry sequence seen per owner. Default: in-memory for this client. */
+    registrySequenceStore?: RegistrySequenceStore;
+    /** `fail-closed` only: retry, use another host (not identity-checked; it persists with the session), or abort when sign-in resolves no host. Without it, sign-in throws. */
+    onNodeNotFound?: OnNodeNotFound;
     /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
     /** Local loopback node URL to probe. Omit to avoid probing loopback. */
@@ -1904,10 +1988,26 @@ declare class TinyCloudNode {
      * session's recap doesn't cover it and the registry has no record; the host
      * SIWE is idempotent server-side. Must be called after {@link signIn}.
      *
+     * Under `registryPolicy: "fail-closed"`, hosting is refused with
+     * `NodeRegistryEntryExistsError` when the owner's registry record does not
+     * list the host, or `RegistryUnavailableError` when the registry gives no
+     * verdict. {@link hostOwnedSpace} itself is an explicit action and is not
+     * guarded.
+     *
      * @param name - The owned space name (e.g. `"secrets"`).
      * @returns The hosted owned-space URI.
      */
     ensureOwnedSpaceHosted(name: string): Promise<string>;
+    /**
+     * Space-creation guard (TC-1443) for the automatic hosting paths: sign-in's
+     * owned spaces, account bootstrap, {@link ensureOwnedSpaceHosted} and
+     * {@link ensurePublicSpace}. Only `registryPolicy: "fail-closed"` consults
+     * the registry ({@link NodeUserAuthorization.assertMayCreateSpace}); the
+     * default policy performs no lookup.
+     */
+    private assertMayCreateSpace;
+    /** Registry-policy settings shared by every authorization this client creates. */
+    private registryPolicyConfig;
     /**
      * Submit the host delegation for an owned space, sharing one in-flight
      * request (and so one approval) between concurrent callers in this session,
@@ -2457,7 +2557,9 @@ declare class TinyCloudNode {
      * Ensure the user's public space exists and is accessible.
      * Creates the space and activates a session delegation for it.
      * This is the trigger for lazy public space creation — call it
-     * before writing to spaces.get('public').kv.
+     * before writing to spaces.get('public').kv. The vault calls it on unlock.
+     * Under `registryPolicy: "fail-closed"` creation goes through the
+     * space-creation guard.
      */
     ensurePublicSpace(): Promise<void>;
     /**

package/dist/{authority-Cy5tMflt.d.cts → authority-21H2cKmO.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-DmF9QUcS.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-BPDOmuf6.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/{authority-BY0jd0P3.d.ts → authority-C-pzOYXq.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-DmF9QUcS.js';
+import { T as TinyCloudNode } from './TinyCloudNode-BPDOmuf6.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/core.cjs

@@ -517,6 +517,11 @@ var NodeUserAuthorization = class {
     this.tinycloudHosts = config.tinycloudHosts;
     this.tinycloudRegistryUrl = config.tinycloudRegistryUrl;
     this.tinycloudFallbackHosts = config.tinycloudFallbackHosts;
+    this.registryPolicy = config.registryPolicy;
+    this.newUserHost = config.newUserHost;
+    this.registryChainId = config.registryChainId;
+    this.registrySequenceStore = config.registrySequenceStore ?? (0, import_sdk_core4.createInMemoryRegistrySequenceStore)();
+    this.onNodeNotFound = config.onNodeNotFound;
     this.autoDiscoverLocalNode = config.autoDiscoverLocalNode;
     this.localNodeUrl = config.localNodeUrl;
     this.localLinkName = config.localLinkName;
@@ -628,6 +633,7 @@ var NodeUserAuthorization = class {
     this._nodeFeaturesKnown = nodeFeatures !== void 0;
     this._nodeInfoIdentity = void 0;
     this.tinycloudHosts = hosts && hosts.length > 0 ? [...hosts] : void 0;
+    this.registryVerdict = void 0;
     this._lastActivationSkippedSpaceIds = [];
     this._lastActivationActivatedSpaceIds = [];
     if (!session) {
@@ -678,6 +684,23 @@ var NodeUserAuthorization = class {
     if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
       return;
     }
+    if (this.registryPolicy === "fail-closed") {
+      const resolved2 = await (0, import_sdk_core4.resolveFailClosedTinyCloudHosts)(address, {
+        registryUrl: this.tinycloudRegistryUrl,
+        registryChainId: this.registryChainId,
+        newUserHost: this.newUserHost,
+        sequenceStore: this.registrySequenceStore,
+        onNodeNotFound: this.onNodeNotFound,
+        autoDiscoverLocalNode: this.autoDiscoverLocalNode,
+        localNodeUrl: this.localNodeUrl,
+        localLinkName: this.localLinkName,
+        expectedNodeDid: this.expectedNodeDid,
+        localNodeIdentityStore: this.localNodeIdentityStore
+      });
+      this.tinycloudHosts = resolved2.hosts;
+      this.registryVerdict = resolved2.verdict;
+      return;
+    }
     const subject = (0, import_sdk_core4.pkhDid)(address, chainId);
     const resolved = await (0, import_sdk_core4.resolveTinyCloudHosts)(subject, {
       registryUrl: this.tinycloudRegistryUrl,
@@ -690,6 +713,32 @@ var NodeUserAuthorization = class {
     });
     this.tinycloudHosts = resolved.hosts;
   }
+  /**
+   * Space-creation guard (TC-1443). Under `registryPolicy: "fail-closed"`,
+   * throws unless the owner's registry verdict allows a space on the primary
+   * host: `NodeRegistryEntryExistsError` when the owner's record does not
+   * list it, `RegistryUnavailableError` when the registry gives no
+   * verdict. Reuses this session's sign-in verdict unless it was
+   * `unavailable`, else looks it up now (explicit-host apps). Under the
+   * default policy it returns at once and performs no lookup.
+   */
+  async assertMayCreateSpace() {
+    if (this.registryPolicy !== "fail-closed") return;
+    if (this._address === void 0) {
+      throw new Error("Must be signed in to create a space");
+    }
+    await this.ensureTinyCloudHosts();
+    const subject = (0, import_sdk_core4.registryOwnerSubjectV1)(this._address, this.registryChainId);
+    let verdict = this.registryVerdict;
+    if (verdict?.subject !== subject || verdict.status === "unavailable") {
+      verdict = await (0, import_sdk_core4.lookupOwnerRegistryVerdict)(subject, {
+        registryUrl: this.tinycloudRegistryUrl,
+        sequenceStore: this.registrySequenceStore
+      });
+      this.registryVerdict = verdict;
+    }
+    (0, import_sdk_core4.assertSpaceCreationAllowed)(verdict, this.primaryTinyCloudHost);
+  }
   requireTinyCloudHosts() {
     if (!this.tinycloudHosts || this.tinycloudHosts.length === 0) {
       throw new Error("TinyCloud hosts have not been resolved. Call signIn() first.");
@@ -1138,6 +1187,7 @@ var NodeUserAuthorization = class {
       if (!handler) {
         return;
       }
+      await this.guardSpaceCreation(handler, creationContext);
       const confirmed = await handler.confirmSpaceCreation(creationContext);
       if (!confirmed) {
         return;
@@ -1178,6 +1228,7 @@ var NodeUserAuthorization = class {
       if (!handler) {
         return;
       }
+      await this.guardSpaceCreation(handler, creationContext);
       const confirmed = await handler.confirmSpaceCreation(creationContext);
       if (!confirmed) {
         return;
@@ -1219,6 +1270,16 @@ var NodeUserAuthorization = class {
       { cause: result }
     );
   }
+  /** {@link assertMayCreateSpace}, reporting a refusal to the creation handler before rethrowing it. */
+  async guardSpaceCreation(handler, context) {
+    try {
+      await this.assertMayCreateSpace();
+    } catch (error) {
+      const failure = error instanceof Error ? error : new Error(String(error));
+      handler.onSpaceCreationFailed?.(context, failure);
+      throw failure;
+    }
+  }
   recordActivationSkippedSpaces(result, primarySpaceId) {
     if (result.success) {
       this._lastActivationSkippedSpaceIds = result.skipped ?? [];
@@ -3661,7 +3722,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.explicitHost = config.host;
     this.config = {
       ...config,
-      host: config.host ?? DEFAULT_HOST
+      host: config.host ?? DEFAULT_HOST,
+      // One store for every authorization this client creates.
+      registrySequenceStore: config.registrySequenceStore ?? (0, import_sdk_core10.createInMemoryRegistrySequenceStore)()
     };
     if (this.config.replication?.enabled) {
       const runtime = getNodeReplicationLoaders().runtime().then(({ ReplicationRuntime }) => {
@@ -3931,6 +3994,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: config.tinycloudFallbackHosts,
+      ...this.registryPolicyConfig(),
       autoDiscoverLocalNode: config.autoDiscoverLocalNode,
       localNodeUrl: config.localNodeUrl,
       localLinkName: config.localLinkName,
@@ -4636,6 +4700,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primarySession = auth.tinyCloudSession;
     const defaultSpaceId = this.ownedSpaceId("default");
     const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === import_sdk_core10.BOOTSTRAP_SESSION_REQUESTS.default;
+    if (steps.some((step) => step.kind === "host")) {
+      await this.assertMayCreateSpace();
+    }
     for (const step of steps) {
       if (step.kind !== "session") continue;
       graph.assertActive();
@@ -5277,6 +5344,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activation }
       );
     }
+    await this.assertMayCreateSpace();
+    if (signal?.aborted) throw signal.reason;
     const created = await this.hostOwnedSpaceOnce(spaceId, signal);
     if (!created.success) {
       throw Object.assign(
@@ -5390,6 +5459,12 @@ var _TinyCloudNode = class _TinyCloudNode {
    * session's recap doesn't cover it and the registry has no record; the host
    * SIWE is idempotent server-side. Must be called after {@link signIn}.
    *
+   * Under `registryPolicy: "fail-closed"`, hosting is refused with
+   * `NodeRegistryEntryExistsError` when the owner's registry record does not
+   * list the host, or `RegistryUnavailableError` when the registry gives no
+   * verdict. {@link hostOwnedSpace} itself is an explicit action and is not
+   * guarded.
+   *
    * @param name - The owned space name (e.g. `"secrets"`).
    * @returns The hosted owned-space URI.
    */
@@ -5401,8 +5476,25 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (this.hostedOwnedSpaceIds.has(spaceId) || await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
+    await this.assertMayCreateSpace();
     return this.hostOwnedSpace(name);
   }
+  /**
+   * Space-creation guard (TC-1443) for the automatic hosting paths: sign-in's
+   * owned spaces, account bootstrap, {@link ensureOwnedSpaceHosted} and
+   * {@link ensurePublicSpace}. Only `registryPolicy: "fail-closed"` consults
+   * the registry ({@link NodeUserAuthorization.assertMayCreateSpace}); the
+   * default policy performs no lookup.
+   */
+  async assertMayCreateSpace() {
+    if (this.config.registryPolicy !== "fail-closed") return;
+    await this.auth.assertMayCreateSpace();
+  }
+  /** Registry-policy settings shared by every authorization this client creates. */
+  registryPolicyConfig() {
+    const { registryPolicy, newUserHost, registryChainId, registrySequenceStore, onNodeNotFound } = this.config;
+    return { registryPolicy, newUserHost, registryChainId, registrySequenceStore, onNodeNotFound };
+  }
   /**
    * Submit the host delegation for an owned space, sharing one in-flight
    * request (and so one approval) between concurrent callers in this session,
@@ -6080,6 +6172,21 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (address === void 0 || chainId === void 0) {
       return void 0;
     }
+    if (this.config.registryPolicy === "fail-closed") {
+      const resolved2 = await (0, import_sdk_core10.resolveFailClosedTinyCloudHosts)(address, {
+        registryUrl: this.config.tinycloudRegistryUrl,
+        registryChainId: this.config.registryChainId,
+        newUserHost: this.config.newUserHost,
+        sequenceStore: this.config.registrySequenceStore,
+        onNodeNotFound: this.config.onNodeNotFound,
+        autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
+        localNodeUrl: this.config.localNodeUrl,
+        localLinkName: this.config.localLinkName,
+        expectedNodeDid: this.config.expectedNodeDid,
+        localNodeIdentityStore: this.config.localNodeIdentityStore
+      });
+      return resolved2.hosts[0];
+    }
     const resolved = await (0, import_sdk_core10.resolveTinyCloudHosts)((0, import_sdk_core10.pkhDid)(address, chainId), {
       registryUrl: this.config.tinycloudRegistryUrl,
       fallbackHosts: this.config.tinycloudFallbackHosts,
@@ -6272,6 +6379,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: this.config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: this.config.tinycloudFallbackHosts,
+      ...this.registryPolicyConfig(),
       autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
       localNodeUrl: this.config.localNodeUrl,
       localLinkName: this.config.localLinkName,
@@ -6331,6 +6439,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: this.config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: this.config.tinycloudFallbackHosts,
+      ...this.registryPolicyConfig(),
       autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
       localNodeUrl: this.config.localNodeUrl,
       localLinkName: this.config.localLinkName,
@@ -7968,7 +8077,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * Ensure the user's public space exists and is accessible.
    * Creates the space and activates a session delegation for it.
    * This is the trigger for lazy public space creation — call it
-   * before writing to spaces.get('public').kv.
+   * before writing to spaces.get('public').kv. The vault calls it on unlock.
+   * Under `registryPolicy: "fail-closed"` creation goes through the
+   * space-creation guard.
    */
   async ensurePublicSpace() {
     if (!this.auth || !this.session || !this.signer) {
@@ -7978,6 +8089,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!publicSpaceId) {
       throw new Error("Public space not enabled. Set enablePublicSpace: true in config.");
     }
+    await this.assertMayCreateSpace();
     await this.auth.hostPublicSpace(publicSpaceId);
     const kvActions = [import_sdk_core10.KV.PUT, import_sdk_core10.KV.GET, import_sdk_core10.KV.DEL, import_sdk_core10.KV.LIST, import_sdk_core10.KV.METADATA];
     const abilities = { kv: { "": kvActions } };