@tinycloud/node-sdk 3.3.0-beta.8 → 3.3.0

package/dist/{TinyCloudNode-CcNh20QX.d.cts → TinyCloudNode-DeV-L_14.d.cts}

@@ -1,5 +1,5 @@
 import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
-import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
+import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, RegistryPolicy, RegistrySequenceStore, OnNodeNotFound, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, RetryPolicy, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
 import { ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction, FetchFunction } from '@tinycloud/sdk-services';
@@ -181,8 +181,46 @@ interface NodeUserAuthorizationConfig {
     tinycloudHosts?: string[];
     /** TinyCloud location registry URL. Default: https://registry.tinycloud.xyz. */
     tinycloudRegistryUrl?: string | null;
-    /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
+    /**
+     * Fallback TinyCloud hosts. Default: hosted TinyCloud node. Used only by the
+     * default `registryPolicy` ("legacy-fallback"), whose silent fallback is
+     * deprecated and will be removed in a future major release.
+     */
     tinycloudFallbackHosts?: string[] | null;
+    /**
+     * How sign-in uses the location registry when no host is configured.
+     *
+     * - `"legacy-fallback"` (default, deprecated): a registry miss or failure
+     *   silently uses `tinycloudFallbackHosts`, with a one-time warning.
+     * - `"fail-closed"`: sign-in acts on the registry verdict for the signer
+     *   address. Registered owners go to their listed hosts, unregistered owners
+     *   to `newUserHost`, and an unavailable registry is
+     *   `RegistryUnavailableError`, never a new account. Automatic space
+     *   creation is refused on a host the owner's record does not list
+     *   (`NodeRegistryEntryExistsError`) or when the registry gives no verdict
+     *   (`RegistryUnavailableError`).
+     */
+    registryPolicy?: RegistryPolicy;
+    /**
+     * `fail-closed` only: host for owners with no registry record (and only
+     * them). Default https://node.tinycloud.xyz. `null` refuses them with
+     * `NodeNotFoundError`.
+     */
+    newUserHost?: string | null;
+    /**
+     * `fail-closed` only: chain ID of the v1 registry subject, which is built
+     * from the signer address, never the session chain. Default 1.
+     */
+    registryChainId?: number;
+    /** `fail-closed` only: highest registry sequence seen per owner. Default: in-memory. */
+    registrySequenceStore?: RegistrySequenceStore;
+    /**
+     * `fail-closed` only: called when sign-in resolves no host
+     * (`NodeNotFoundError` or `RegistryUnavailableError`) to retry, use another
+     * host (not identity-checked; it persists with the session), or abort.
+     * Without it, sign-in throws the error.
+     */
+    onNodeNotFound?: OnNodeNotFound;
     /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
     /** Local loopback node URL to probe. Omit to avoid probing loopback. */
@@ -295,6 +333,13 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private tinycloudHosts?;
     private readonly tinycloudRegistryUrl?;
     private readonly tinycloudFallbackHosts?;
+    private readonly registryPolicy?;
+    private readonly newUserHost?;
+    private readonly registryChainId?;
+    private readonly registrySequenceStore;
+    private readonly onNodeNotFound?;
+    /** Verdict from the last `fail-closed` host resolution, reused by {@link assertMayCreateSpace}. */
+    private registryVerdict?;
     private readonly autoDiscoverLocalNode?;
     private readonly localNodeUrl?;
     private readonly localLinkName?;
@@ -415,6 +460,16 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     ensureTinyCloudHosts(): Promise<void>;
     private resolveTinyCloudHostsForSignIn;
+    /**
+     * Space-creation guard (TC-1443). Under `registryPolicy: "fail-closed"`,
+     * throws unless the owner's registry verdict allows a space on the primary
+     * host: `NodeRegistryEntryExistsError` when the owner's record does not
+     * list it, `RegistryUnavailableError` when the registry gives no
+     * verdict. Reuses this session's sign-in verdict unless it was
+     * `unavailable`, else looks it up now (explicit-host apps). Under the
+     * default policy it returns at once and performs no lookup.
+     */
+    assertMayCreateSpace(): Promise<void>;
     private requireTinyCloudHosts;
     private get primaryTinyCloudHost();
     get nodeFeatures(): string[];
@@ -551,6 +606,8 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * @throws Error if space creation fails
      */
     ensureSpaceExists(): Promise<void>;
+    /** {@link assertMayCreateSpace}, reporting a refusal to the creation handler before rethrowing it. */
+    private guardSpaceCreation;
     private recordActivationSkippedSpaces;
     createBootstrapSession(options: CreateBootstrapSessionOptions): Promise<TinyCloudSession>;
     private persistedData;
@@ -1175,8 +1232,35 @@ interface TinyCloudNodeConfig {
     host?: string;
     /** TinyCloud location registry URL. Default: https://registry.tinycloud.xyz. */
     tinycloudRegistryUrl?: string | null;
-    /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
+    /**
+     * Fallback TinyCloud hosts. Default: hosted TinyCloud node. Used only by the
+     * default `registryPolicy` ("legacy-fallback"), whose silent fallback is
+     * deprecated and will be removed in a future major release.
+     */
     tinycloudFallbackHosts?: string[] | null;
+    /**
+     * How sign-in uses the location registry when no `host` is configured.
+     * Default `"legacy-fallback"` (deprecated): a registry miss or failure
+     * silently uses `tinycloudFallbackHosts`, with a one-time warning.
+     * `"fail-closed"`: routing acts on the registry verdict for the signer
+     * address, an unavailable registry is `RegistryUnavailableError` (never a
+     * new account), record hosts are used only if HTTPS or loopback, and
+     * automatic space creation (sign-in, account bootstrap, owned-space
+     * hosting, the public space the vault creates) is refused on a host the
+     * owner's registry record does not list (`NodeRegistryEntryExistsError`)
+     * or when the registry gives no verdict. An explicit `hostOwnedSpace()`
+     * call is not guarded. `newUserHost` governs routing only: a pinned host
+     * may still create spaces for an unregistered owner.
+     */
+    registryPolicy?: RegistryPolicy;
+    /** `fail-closed` only: host for owners with no registry record. Default https://node.tinycloud.xyz; `null` refuses them with `NodeNotFoundError`. */
+    newUserHost?: string | null;
+    /** `fail-closed` only: chain ID of the v1 registry subject built from the signer address (never the session chain). Default 1. */
+    registryChainId?: number;
+    /** `fail-closed` only: highest registry sequence seen per owner. Default: in-memory for this client. */
+    registrySequenceStore?: RegistrySequenceStore;
+    /** `fail-closed` only: retry, use another host (not identity-checked; it persists with the session), or abort when sign-in resolves no host. Without it, sign-in throws. */
+    onNodeNotFound?: OnNodeNotFound;
     /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
     /** Local loopback node URL to probe. Omit to avoid probing loopback. */
@@ -1240,6 +1324,8 @@ interface TinyCloudNodeConfig {
     autoBootstrapAccount?: boolean;
     /** Default-off service telemetry. */
     telemetry?: TelemetryConfig;
+    /** Retry of node busy/timeout answers; `{ maxAttempts: 1 }` disables it. See {@link RetryPolicy}. */
+    retryPolicy?: Partial<RetryPolicy>;
     /**
      * Optional read-through replica configuration; disabled unless explicitly enabled.
      * Node profile mutations require `profileDir` and a caller-supplied `profileGuard` holding
@@ -1287,9 +1373,16 @@ interface DelegateToOptions {
      * Mark the delegation terminal: the node refuses any delegation that cites
      * it as a parent (`terminal-parent-cannot-redelegate`). The delegate can
      * still use it directly. Only session-key UCAN delegations can carry the
-     * marker, so this throws with `forceWalletSign`. Default false.
+     * marker, so this throws with `forceWalletSign`, and with a `did:pkh`
+     * recipient (use its session-key DID). Default false.
      */
     disableSubDelegation?: boolean;
+    /**
+     * Throw when the node answers 200 but skips a space the delegation targets (a space it does not
+     * host): it registers the delegation without attaching it, which otherwise looks like success.
+     * Off by default because grants to a not-yet-hosted space (e.g. secrets) are valid. Default false.
+     */
+    requireActivation?: boolean;
 }
 /**
  * Result of {@link TinyCloudNode.delegateTo}.
@@ -1811,6 +1904,8 @@ declare class TinyCloudNode {
     private registerPrimarySessionGrant;
     private writeManifestRegistryRecords;
     private createAccountRegistryServices;
+    /** Set once per process: the registry sync was skipped for want of account access. */
+    private static accountRegistrySkipLogged;
     private scheduleAccountRegistrySync;
     private enqueueAccountRegistryOperation;
     /**
@@ -1903,10 +1998,26 @@ declare class TinyCloudNode {
      * session's recap doesn't cover it and the registry has no record; the host
      * SIWE is idempotent server-side. Must be called after {@link signIn}.
      *
+     * Under `registryPolicy: "fail-closed"`, hosting is refused with
+     * `NodeRegistryEntryExistsError` when the owner's registry record does not
+     * list the host, or `RegistryUnavailableError` when the registry gives no
+     * verdict. {@link hostOwnedSpace} itself is an explicit action and is not
+     * guarded.
+     *
      * @param name - The owned space name (e.g. `"secrets"`).
      * @returns The hosted owned-space URI.
      */
     ensureOwnedSpaceHosted(name: string): Promise<string>;
+    /**
+     * Space-creation guard (TC-1443) for the automatic hosting paths: sign-in's
+     * owned spaces, account bootstrap, {@link ensureOwnedSpaceHosted} and
+     * {@link ensurePublicSpace}. Only `registryPolicy: "fail-closed"` consults
+     * the registry ({@link NodeUserAuthorization.assertMayCreateSpace}); the
+     * default policy performs no lookup.
+     */
+    private assertMayCreateSpace;
+    /** Registry-policy settings shared by every authorization this client creates. */
+    private registryPolicyConfig;
     /**
      * Submit the host delegation for an owned space, sharing one in-flight
      * request (and so one approval) between concurrent callers in this session,
@@ -2366,16 +2477,8 @@ declare class TinyCloudNode {
      * ```typescript
      * const delegations = alice.delegationManager;
      *
-     * // Create a delegation
-     * const result = await delegations.create({
-     *   delegateDID: bob.did,
-     *   path: "shared/",
-     *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
-     *   expiry: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours
-     * });
-     *
-     * // List delegations
-     * const listResult = await delegations.list();
+     * // Query account delegations
+     * const page = await delegations.query();
      *
      * // Revoke a delegation
      * await delegations.revoke(delegationCid);
@@ -2456,7 +2559,9 @@ declare class TinyCloudNode {
      * Ensure the user's public space exists and is accessible.
      * Creates the space and activates a session delegation for it.
      * This is the trigger for lazy public space creation — call it
-     * before writing to spaces.get('public').kv.
+     * before writing to spaces.get('public').kv. The vault calls it on unlock.
+     * Under `registryPolicy: "fail-closed"` creation goes through the
+     * space-creation guard.
      */
     ensurePublicSpace(): Promise<void>;
     /**
@@ -2464,30 +2569,6 @@ declare class TinyCloudNode {
      * Writes require authentication (owner/delegate).
      */
     get publicKV(): IKVService;
-    /**
-     * Create a delegation using the v2 DelegationManager.
-     *
-     * This is a convenience method that wraps DelegationManager.create().
-     * For more control, use `this.delegationManager` directly.
-     *
-     * @param params - Delegation parameters
-     * @returns Result containing the created Delegation
-     *
-     * @example
-     * ```typescript
-     * const result = await alice.delegate({
-     *   delegateDID: bob.did,
-     *   path: "shared/",
-     *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
-     *   expiry: new Date(Date.now() + 24 * 60 * 60 * 1000),
-     * });
-     *
-     * if (result.ok) {
-     *   console.log("Delegation created:", result.data.cid);
-     * }
-     * ```
-     */
-    delegate(params: CreateDelegationParams): Promise<DelegationResult<Delegation>>;
     /**
      * Revoke a delegation with the owner wallet when available. Session-only
      * clients continue to use their delegated revocation authority.
@@ -2500,12 +2581,6 @@ declare class TinyCloudNode {
     getDelegationStatus(cid: string): Promise<DelegationResult<DelegationStatus>>;
     /** Compute the canonical CID of a compact UCAN or DAG-CBOR delegation authorization. */
     computeDelegationCid(authorization: string): string;
-    /**
-     * List all delegations for the current session's space.
-     *
-     * @returns Result containing an array of Delegations
-     */
-    listDelegations(): Promise<DelegationResult<Delegation[]>>;
     /**
      * Check if the current session has permission for a path and action.
      *
@@ -2746,7 +2821,9 @@ declare class TinyCloudNode {
          * Prevent the recipient from creating sub-delegations (default: false).
          * The delegation carries the node's terminal marker, so the node refuses
          * its children. Needs capabilities the current session holds; throws
-         * rather than fall back to a wallet-signed delegation.
+         * rather than fall back to a wallet-signed delegation, and throws for a
+         * `did:pkh` recipient (a wallet-mode `useDelegation` of it is refused);
+         * grant the recipient's session-key DID instead.
          */
         disableSubDelegation?: boolean;
         /** Expiration time in milliseconds from now (default: 1 hour) */

package/dist/{TinyCloudNode-CcNh20QX.d.ts → TinyCloudNode-DeV-L_14.d.ts}

@@ -1,5 +1,5 @@
 import * as _tinycloud_sdk_core from '@tinycloud/sdk-core';
-import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, CreateDelegationParams, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
+import { AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, CapabilityPresentationEnvelopeV1, IUserAuthorization, ISigner, ISessionStorage, ISpaceCreationHandler, RegistryPolicy, RegistrySequenceStore, OnNodeNotFound, LocalNodeIdentityStore, IWasmBindings, ISessionManager, SiweConfig, Manifest, ComposedManifestRequest, ReplicationOptions, TinyCloudSession, PersistedSessionData, ClientSession, PermissionEntry, Extension, SignRequest, SpaceHostResult, SignInOptions, Delegation, DelegatedResource, TelemetryConfig, ServiceContext, IKVService, ISQLService, IDuckDbService, IHooksService, CreateOwnerDelegationParams as CreateOwnerDelegationParams$1, OwnerDelegationReceipt as OwnerDelegationReceipt$1, StorageFullEvent, IStorageService, INotificationHandler, IENSResolver, RetryPolicy, KVReplicaStorage, AccountService, InvokeAnyFunction as InvokeAnyFunction$1, UnifiedPolicyCapability, RegisterPolicyV3Input, RegisterPolicyV3Receipt, CanonicalJson, ShareDeliveryAuthorizationV3Receipt, IDataVaultService, IEncryptionService, NetworkDescriptor, ISecretsService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISpace, ISharingService, DelegationResult, DelegationRevocationReceipt, DelegationStatus, ServiceSession, ReplicationControl, ResolvedDelegate } from '@tinycloud/sdk-core';
 import { ReplicaSessionStamp } from '@tinycloud/sdk-services/kv/replication';
 import { EventEmitter } from 'events';
 import { InvokeFunction, InvokeAnyFunction, FetchFunction } from '@tinycloud/sdk-services';
@@ -181,8 +181,46 @@ interface NodeUserAuthorizationConfig {
     tinycloudHosts?: string[];
     /** TinyCloud location registry URL. Default: https://registry.tinycloud.xyz. */
     tinycloudRegistryUrl?: string | null;
-    /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
+    /**
+     * Fallback TinyCloud hosts. Default: hosted TinyCloud node. Used only by the
+     * default `registryPolicy` ("legacy-fallback"), whose silent fallback is
+     * deprecated and will be removed in a future major release.
+     */
     tinycloudFallbackHosts?: string[] | null;
+    /**
+     * How sign-in uses the location registry when no host is configured.
+     *
+     * - `"legacy-fallback"` (default, deprecated): a registry miss or failure
+     *   silently uses `tinycloudFallbackHosts`, with a one-time warning.
+     * - `"fail-closed"`: sign-in acts on the registry verdict for the signer
+     *   address. Registered owners go to their listed hosts, unregistered owners
+     *   to `newUserHost`, and an unavailable registry is
+     *   `RegistryUnavailableError`, never a new account. Automatic space
+     *   creation is refused on a host the owner's record does not list
+     *   (`NodeRegistryEntryExistsError`) or when the registry gives no verdict
+     *   (`RegistryUnavailableError`).
+     */
+    registryPolicy?: RegistryPolicy;
+    /**
+     * `fail-closed` only: host for owners with no registry record (and only
+     * them). Default https://node.tinycloud.xyz. `null` refuses them with
+     * `NodeNotFoundError`.
+     */
+    newUserHost?: string | null;
+    /**
+     * `fail-closed` only: chain ID of the v1 registry subject, which is built
+     * from the signer address, never the session chain. Default 1.
+     */
+    registryChainId?: number;
+    /** `fail-closed` only: highest registry sequence seen per owner. Default: in-memory. */
+    registrySequenceStore?: RegistrySequenceStore;
+    /**
+     * `fail-closed` only: called when sign-in resolves no host
+     * (`NodeNotFoundError` or `RegistryUnavailableError`) to retry, use another
+     * host (not identity-checked; it persists with the session), or abort.
+     * Without it, sign-in throws the error.
+     */
+    onNodeNotFound?: OnNodeNotFound;
     /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
     /** Local loopback node URL to probe. Omit to avoid probing loopback. */
@@ -295,6 +333,13 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private tinycloudHosts?;
     private readonly tinycloudRegistryUrl?;
     private readonly tinycloudFallbackHosts?;
+    private readonly registryPolicy?;
+    private readonly newUserHost?;
+    private readonly registryChainId?;
+    private readonly registrySequenceStore;
+    private readonly onNodeNotFound?;
+    /** Verdict from the last `fail-closed` host resolution, reused by {@link assertMayCreateSpace}. */
+    private registryVerdict?;
     private readonly autoDiscoverLocalNode?;
     private readonly localNodeUrl?;
     private readonly localLinkName?;
@@ -415,6 +460,16 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     ensureTinyCloudHosts(): Promise<void>;
     private resolveTinyCloudHostsForSignIn;
+    /**
+     * Space-creation guard (TC-1443). Under `registryPolicy: "fail-closed"`,
+     * throws unless the owner's registry verdict allows a space on the primary
+     * host: `NodeRegistryEntryExistsError` when the owner's record does not
+     * list it, `RegistryUnavailableError` when the registry gives no
+     * verdict. Reuses this session's sign-in verdict unless it was
+     * `unavailable`, else looks it up now (explicit-host apps). Under the
+     * default policy it returns at once and performs no lookup.
+     */
+    assertMayCreateSpace(): Promise<void>;
     private requireTinyCloudHosts;
     private get primaryTinyCloudHost();
     get nodeFeatures(): string[];
@@ -551,6 +606,8 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * @throws Error if space creation fails
      */
     ensureSpaceExists(): Promise<void>;
+    /** {@link assertMayCreateSpace}, reporting a refusal to the creation handler before rethrowing it. */
+    private guardSpaceCreation;
     private recordActivationSkippedSpaces;
     createBootstrapSession(options: CreateBootstrapSessionOptions): Promise<TinyCloudSession>;
     private persistedData;
@@ -1175,8 +1232,35 @@ interface TinyCloudNodeConfig {
     host?: string;
     /** TinyCloud location registry URL. Default: https://registry.tinycloud.xyz. */
     tinycloudRegistryUrl?: string | null;
-    /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
+    /**
+     * Fallback TinyCloud hosts. Default: hosted TinyCloud node. Used only by the
+     * default `registryPolicy` ("legacy-fallback"), whose silent fallback is
+     * deprecated and will be removed in a future major release.
+     */
     tinycloudFallbackHosts?: string[] | null;
+    /**
+     * How sign-in uses the location registry when no `host` is configured.
+     * Default `"legacy-fallback"` (deprecated): a registry miss or failure
+     * silently uses `tinycloudFallbackHosts`, with a one-time warning.
+     * `"fail-closed"`: routing acts on the registry verdict for the signer
+     * address, an unavailable registry is `RegistryUnavailableError` (never a
+     * new account), record hosts are used only if HTTPS or loopback, and
+     * automatic space creation (sign-in, account bootstrap, owned-space
+     * hosting, the public space the vault creates) is refused on a host the
+     * owner's registry record does not list (`NodeRegistryEntryExistsError`)
+     * or when the registry gives no verdict. An explicit `hostOwnedSpace()`
+     * call is not guarded. `newUserHost` governs routing only: a pinned host
+     * may still create spaces for an unregistered owner.
+     */
+    registryPolicy?: RegistryPolicy;
+    /** `fail-closed` only: host for owners with no registry record. Default https://node.tinycloud.xyz; `null` refuses them with `NodeNotFoundError`. */
+    newUserHost?: string | null;
+    /** `fail-closed` only: chain ID of the v1 registry subject built from the signer address (never the session chain). Default 1. */
+    registryChainId?: number;
+    /** `fail-closed` only: highest registry sequence seen per owner. Default: in-memory for this client. */
+    registrySequenceStore?: RegistrySequenceStore;
+    /** `fail-closed` only: retry, use another host (not identity-checked; it persists with the session), or abort when sign-in resolves no host. Without it, sign-in throws. */
+    onNodeNotFound?: OnNodeNotFound;
     /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
     /** Local loopback node URL to probe. Omit to avoid probing loopback. */
@@ -1240,6 +1324,8 @@ interface TinyCloudNodeConfig {
     autoBootstrapAccount?: boolean;
     /** Default-off service telemetry. */
     telemetry?: TelemetryConfig;
+    /** Retry of node busy/timeout answers; `{ maxAttempts: 1 }` disables it. See {@link RetryPolicy}. */
+    retryPolicy?: Partial<RetryPolicy>;
     /**
      * Optional read-through replica configuration; disabled unless explicitly enabled.
      * Node profile mutations require `profileDir` and a caller-supplied `profileGuard` holding
@@ -1287,9 +1373,16 @@ interface DelegateToOptions {
      * Mark the delegation terminal: the node refuses any delegation that cites
      * it as a parent (`terminal-parent-cannot-redelegate`). The delegate can
      * still use it directly. Only session-key UCAN delegations can carry the
-     * marker, so this throws with `forceWalletSign`. Default false.
+     * marker, so this throws with `forceWalletSign`, and with a `did:pkh`
+     * recipient (use its session-key DID). Default false.
      */
     disableSubDelegation?: boolean;
+    /**
+     * Throw when the node answers 200 but skips a space the delegation targets (a space it does not
+     * host): it registers the delegation without attaching it, which otherwise looks like success.
+     * Off by default because grants to a not-yet-hosted space (e.g. secrets) are valid. Default false.
+     */
+    requireActivation?: boolean;
 }
 /**
  * Result of {@link TinyCloudNode.delegateTo}.
@@ -1811,6 +1904,8 @@ declare class TinyCloudNode {
     private registerPrimarySessionGrant;
     private writeManifestRegistryRecords;
     private createAccountRegistryServices;
+    /** Set once per process: the registry sync was skipped for want of account access. */
+    private static accountRegistrySkipLogged;
     private scheduleAccountRegistrySync;
     private enqueueAccountRegistryOperation;
     /**
@@ -1903,10 +1998,26 @@ declare class TinyCloudNode {
      * session's recap doesn't cover it and the registry has no record; the host
      * SIWE is idempotent server-side. Must be called after {@link signIn}.
      *
+     * Under `registryPolicy: "fail-closed"`, hosting is refused with
+     * `NodeRegistryEntryExistsError` when the owner's registry record does not
+     * list the host, or `RegistryUnavailableError` when the registry gives no
+     * verdict. {@link hostOwnedSpace} itself is an explicit action and is not
+     * guarded.
+     *
      * @param name - The owned space name (e.g. `"secrets"`).
      * @returns The hosted owned-space URI.
      */
     ensureOwnedSpaceHosted(name: string): Promise<string>;
+    /**
+     * Space-creation guard (TC-1443) for the automatic hosting paths: sign-in's
+     * owned spaces, account bootstrap, {@link ensureOwnedSpaceHosted} and
+     * {@link ensurePublicSpace}. Only `registryPolicy: "fail-closed"` consults
+     * the registry ({@link NodeUserAuthorization.assertMayCreateSpace}); the
+     * default policy performs no lookup.
+     */
+    private assertMayCreateSpace;
+    /** Registry-policy settings shared by every authorization this client creates. */
+    private registryPolicyConfig;
     /**
      * Submit the host delegation for an owned space, sharing one in-flight
      * request (and so one approval) between concurrent callers in this session,
@@ -2366,16 +2477,8 @@ declare class TinyCloudNode {
      * ```typescript
      * const delegations = alice.delegationManager;
      *
-     * // Create a delegation
-     * const result = await delegations.create({
-     *   delegateDID: bob.did,
-     *   path: "shared/",
-     *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
-     *   expiry: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours
-     * });
-     *
-     * // List delegations
-     * const listResult = await delegations.list();
+     * // Query account delegations
+     * const page = await delegations.query();
      *
      * // Revoke a delegation
      * await delegations.revoke(delegationCid);
@@ -2456,7 +2559,9 @@ declare class TinyCloudNode {
      * Ensure the user's public space exists and is accessible.
      * Creates the space and activates a session delegation for it.
      * This is the trigger for lazy public space creation — call it
-     * before writing to spaces.get('public').kv.
+     * before writing to spaces.get('public').kv. The vault calls it on unlock.
+     * Under `registryPolicy: "fail-closed"` creation goes through the
+     * space-creation guard.
      */
     ensurePublicSpace(): Promise<void>;
     /**
@@ -2464,30 +2569,6 @@ declare class TinyCloudNode {
      * Writes require authentication (owner/delegate).
      */
     get publicKV(): IKVService;
-    /**
-     * Create a delegation using the v2 DelegationManager.
-     *
-     * This is a convenience method that wraps DelegationManager.create().
-     * For more control, use `this.delegationManager` directly.
-     *
-     * @param params - Delegation parameters
-     * @returns Result containing the created Delegation
-     *
-     * @example
-     * ```typescript
-     * const result = await alice.delegate({
-     *   delegateDID: bob.did,
-     *   path: "shared/",
-     *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
-     *   expiry: new Date(Date.now() + 24 * 60 * 60 * 1000),
-     * });
-     *
-     * if (result.ok) {
-     *   console.log("Delegation created:", result.data.cid);
-     * }
-     * ```
-     */
-    delegate(params: CreateDelegationParams): Promise<DelegationResult<Delegation>>;
     /**
      * Revoke a delegation with the owner wallet when available. Session-only
      * clients continue to use their delegated revocation authority.
@@ -2500,12 +2581,6 @@ declare class TinyCloudNode {
     getDelegationStatus(cid: string): Promise<DelegationResult<DelegationStatus>>;
     /** Compute the canonical CID of a compact UCAN or DAG-CBOR delegation authorization. */
     computeDelegationCid(authorization: string): string;
-    /**
-     * List all delegations for the current session's space.
-     *
-     * @returns Result containing an array of Delegations
-     */
-    listDelegations(): Promise<DelegationResult<Delegation[]>>;
     /**
      * Check if the current session has permission for a path and action.
      *
@@ -2746,7 +2821,9 @@ declare class TinyCloudNode {
          * Prevent the recipient from creating sub-delegations (default: false).
          * The delegation carries the node's terminal marker, so the node refuses
          * its children. Needs capabilities the current session holds; throws
-         * rather than fall back to a wallet-signed delegation.
+         * rather than fall back to a wallet-signed delegation, and throws for a
+         * `did:pkh` recipient (a wallet-mode `useDelegation` of it is refused);
+         * grant the recipient's session-key DID instead.
          */
         disableSubDelegation?: boolean;
         /** Expiration time in milliseconds from now (default: 1 hour) */

package/dist/{authority-Cwotwza3.d.cts → authority-BO2VqGnD.d.cts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-CcNh20QX.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-DeV-L_14.cjs';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {

package/dist/{authority-D_u9a7Wl.d.ts → authority-CtsxSAoP.d.ts}

@@ -1,7 +1,7 @@
 import { ReplicationOptions, PermissionEntry, TinyCloudSession, KVReplicaStorage, ServiceContext, IWasmBindings, WasmRecapEntry } from '@tinycloud/sdk-core';
 import { ReplicaConsentAnchor, AuthorityRefusal, ReplicationAuthority } from '@tinycloud/sdk-services';
 import { ReplicaSessionStamp, ReplicaDenyInput } from '@tinycloud/sdk-services/kv/replication';
-import { T as TinyCloudNode } from './TinyCloudNode-CcNh20QX.js';
+import { T as TinyCloudNode } from './TinyCloudNode-DeV-L_14.js';
 
 /** Constructor-time validation; the space-dependent secrets check runs at sign-in and open. */
 declare function assertValidReplicationConfig(replication: (ReplicationOptions & {