@tinycloud/node-sdk 3.3.0-beta.9 → 3.3.1-beta.0

package/dist/index.js

@@ -18114,24 +18114,17 @@ function signedAuthorityFromCompactUcan(authorization) {
       ));
       continue;
     }
-    const nativeMatch = /^(tinycloud:[^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
-    const policyMatch = /^tinycloud:\/\/([^/]+)\/(kv|sql|duckdb|hooks)\/(.*)$/.exec(resource);
-    const match = nativeMatch ?? policyMatch;
+    const match = /^(?:tinycloud:\/\/([^/]+)|(tinycloud:[^/]+))\/(kv|sql|duckdb|hooks)(?:\/|$)(.*)$/.exec(resource);
     if (!match) {
       throw new Error(
         `Validated runtime delegation has an unsupported signed resource '${resource}'.`
       );
     }
-    const [, space, shortService, path] = match;
+    const [, policySpace, nativeSpace, shortService, path] = match;
     const service = SERVICE_BY_SHORT_NAME[shortService];
-    if (service === void 0) {
-      throw new Error(
-        `Validated runtime delegation has an unsupported signed service '${shortService}'.`
-      );
-    }
     permissions.push(...groupedSignedEntries(
       service,
-      space,
+      nativeSpace ?? policySpace,
       path,
       abilities
     ));
@@ -18557,6 +18550,8 @@ import {
   canonicalizeAddress as canonicalizeAddress2,
   pkhDid as pkhDid2,
   resolveTinyCloudHosts as resolveTinyCloudHosts2,
+  resolveFailClosedTinyCloudHosts as resolveFailClosedTinyCloudHosts2,
+  createInMemoryRegistrySequenceStore as createInMemoryRegistrySequenceStore2,
   publishLocationRecord,
   principalDidEquals as principalDidEquals3,
   parseNetworkId as parseNetworkId2,
@@ -18577,7 +18572,8 @@ import {
   serviceError
 } from "@tinycloud/sdk-core";
 import {
-  parsePermissionHint
+  parsePermissionHint,
+  tinyCloudDebugLogger
 } from "@tinycloud/sdk-services";
 
 // src/authorization/NodeUserAuthorization.ts
@@ -18598,6 +18594,11 @@ import {
   resourceCapabilitiesToAbilitiesMap,
   resourceCapabilitiesToSpaceAbilitiesMap,
   resolveTinyCloudHosts,
+  resolveFailClosedTinyCloudHosts,
+  lookupOwnerRegistryVerdict,
+  assertSpaceCreationAllowed,
+  createInMemoryRegistrySequenceStore,
+  registryOwnerSubjectV1,
   EXPIRY,
   canonicalizeAddress,
   makePkhSpaceId,
@@ -18812,6 +18813,11 @@ var NodeUserAuthorization = class {
     this.tinycloudHosts = config.tinycloudHosts;
     this.tinycloudRegistryUrl = config.tinycloudRegistryUrl;
     this.tinycloudFallbackHosts = config.tinycloudFallbackHosts;
+    this.registryPolicy = config.registryPolicy;
+    this.newUserHost = config.newUserHost;
+    this.registryChainId = config.registryChainId;
+    this.registrySequenceStore = config.registrySequenceStore ?? createInMemoryRegistrySequenceStore();
+    this.onNodeNotFound = config.onNodeNotFound;
     this.autoDiscoverLocalNode = config.autoDiscoverLocalNode;
     this.localNodeUrl = config.localNodeUrl;
     this.localLinkName = config.localLinkName;
@@ -18923,6 +18929,7 @@ var NodeUserAuthorization = class {
     this._nodeFeaturesKnown = nodeFeatures !== void 0;
     this._nodeInfoIdentity = void 0;
     this.tinycloudHosts = hosts && hosts.length > 0 ? [...hosts] : void 0;
+    this.registryVerdict = void 0;
     this._lastActivationSkippedSpaceIds = [];
     this._lastActivationActivatedSpaceIds = [];
     if (!session) {
@@ -18973,6 +18980,23 @@ var NodeUserAuthorization = class {
     if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
       return;
     }
+    if (this.registryPolicy === "fail-closed") {
+      const resolved2 = await resolveFailClosedTinyCloudHosts(address, {
+        registryUrl: this.tinycloudRegistryUrl,
+        registryChainId: this.registryChainId,
+        newUserHost: this.newUserHost,
+        sequenceStore: this.registrySequenceStore,
+        onNodeNotFound: this.onNodeNotFound,
+        autoDiscoverLocalNode: this.autoDiscoverLocalNode,
+        localNodeUrl: this.localNodeUrl,
+        localLinkName: this.localLinkName,
+        expectedNodeDid: this.expectedNodeDid,
+        localNodeIdentityStore: this.localNodeIdentityStore
+      });
+      this.tinycloudHosts = resolved2.hosts;
+      this.registryVerdict = resolved2.verdict;
+      return;
+    }
     const subject = pkhDid(address, chainId);
     const resolved = await resolveTinyCloudHosts(subject, {
       registryUrl: this.tinycloudRegistryUrl,
@@ -18985,6 +19009,32 @@ var NodeUserAuthorization = class {
     });
     this.tinycloudHosts = resolved.hosts;
   }
+  /**
+   * Space-creation guard (TC-1443). Under `registryPolicy: "fail-closed"`,
+   * throws unless the owner's registry verdict allows a space on the primary
+   * host: `NodeRegistryEntryExistsError` when the owner's record does not
+   * list it, `RegistryUnavailableError` when the registry gives no
+   * verdict. Reuses this session's sign-in verdict unless it was
+   * `unavailable`, else looks it up now (explicit-host apps). Under the
+   * default policy it returns at once and performs no lookup.
+   */
+  async assertMayCreateSpace() {
+    if (this.registryPolicy !== "fail-closed") return;
+    if (this._address === void 0) {
+      throw new Error("Must be signed in to create a space");
+    }
+    await this.ensureTinyCloudHosts();
+    const subject = registryOwnerSubjectV1(this._address, this.registryChainId);
+    let verdict = this.registryVerdict;
+    if (verdict?.subject !== subject || verdict.status === "unavailable") {
+      verdict = await lookupOwnerRegistryVerdict(subject, {
+        registryUrl: this.tinycloudRegistryUrl,
+        sequenceStore: this.registrySequenceStore
+      });
+      this.registryVerdict = verdict;
+    }
+    assertSpaceCreationAllowed(verdict, this.primaryTinyCloudHost);
+  }
   requireTinyCloudHosts() {
     if (!this.tinycloudHosts || this.tinycloudHosts.length === 0) {
       throw new Error("TinyCloud hosts have not been resolved. Call signIn() first.");
@@ -19433,6 +19483,7 @@ var NodeUserAuthorization = class {
       if (!handler) {
         return;
       }
+      await this.guardSpaceCreation(handler, creationContext);
       const confirmed = await handler.confirmSpaceCreation(creationContext);
       if (!confirmed) {
         return;
@@ -19473,6 +19524,7 @@ var NodeUserAuthorization = class {
       if (!handler) {
         return;
       }
+      await this.guardSpaceCreation(handler, creationContext);
       const confirmed = await handler.confirmSpaceCreation(creationContext);
       if (!confirmed) {
         return;
@@ -19514,6 +19566,16 @@ var NodeUserAuthorization = class {
       { cause: result }
     );
   }
+  /** {@link assertMayCreateSpace}, reporting a refusal to the creation handler before rethrowing it. */
+  async guardSpaceCreation(handler, context) {
+    try {
+      await this.assertMayCreateSpace();
+    } catch (error) {
+      const failure = error instanceof Error ? error : new Error(String(error));
+      handler.onSpaceCreationFailed?.(context, failure);
+      throw failure;
+    }
+  }
   recordActivationSkippedSpaces(result, primarySpaceId) {
     if (result.success) {
       this._lastActivationSkippedSpaceIds = result.skipped ?? [];
@@ -21086,6 +21148,12 @@ function describeHostFailure2(result) {
   const text = result.error?.trim();
   return text ? `${result.status} - ${text}` : `${result.status}`;
 }
+function assertDelegationActivated(result, delegation, requireActivation) {
+  const skipped = requireActivation ? (delegation.resources?.map((r2) => r2.space) ?? [delegation.spaceId]).filter((space) => result.skipped?.includes(space)) : [];
+  if (result.success && skipped.length === 0) return;
+  const detail = result.success ? `the node skipped ${[...new Set(skipped)].join(", ")} (space not hosted on the node)` : describeHostFailure2(result);
+  throw Object.assign(new Error(`Failed to activate delegation with host: ${detail}`), { cause: result });
+}
 function ownerDelegationPermissions(params) {
   const hasPermissions = Object.prototype.hasOwnProperty.call(params, "permissions");
   const hasLegacy = Object.prototype.hasOwnProperty.call(params, "path") || Object.prototype.hasOwnProperty.call(params, "actions");
@@ -21168,7 +21236,7 @@ function ownerPermissionsToAbilities(permissions) {
   }
   return { abilities, rawAbilities };
 }
-var TERMINAL_DELEGATION_REQUIRES_SESSION_KEY = "disableSubDelegation requires a session-key delegation";
+var TERMINAL_DELEGATION_REQUIRES_SESSION_KEY = "disableSubDelegation requires a session-key delegation to a did:key (not did:pkh); use the session-key DID or drop the flag";
 function base64UrlEncode(bytes) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   let output = "";
@@ -21482,7 +21550,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.explicitHost = config.host;
     this.config = {
       ...config,
-      host: config.host ?? DEFAULT_HOST
+      host: config.host ?? DEFAULT_HOST,
+      // One store for every authorization this client creates.
+      registrySequenceStore: config.registrySequenceStore ?? createInMemoryRegistrySequenceStore2()
     };
     if (this.config.replication?.enabled) {
       const runtime = getNodeReplicationLoaders().runtime().then(({ ReplicationRuntime: ReplicationRuntime2 }) => {
@@ -21717,7 +21787,6 @@ var _TinyCloudNode = class _TinyCloudNode {
         if (!this.wasmBindings.computeCid) throw new Error("computeCid is unavailable");
         return this.wasmBindings.computeCid(data, codec);
       },
-      // delegationManager: undefined - not needed for receive()
       createKVService: (config) => {
         const prefix = config.pathPrefix?.replace(/\/$/, "");
         const kvService = new KVService2({ prefix });
@@ -21725,7 +21794,8 @@ var _TinyCloudNode = class _TinyCloudNode {
           invoke: config.invoke,
           fetch: config.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config.hosts,
-          telemetry: this.config.telemetry
+          telemetry: this.config.telemetry,
+          retryPolicy: this.config.retryPolicy
         }));
         kvContext.setSession(config.session);
         kvService.initialize(kvContext);
@@ -21752,6 +21822,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: config.tinycloudFallbackHosts,
+      ...this.registryPolicyConfig(),
       autoDiscoverLocalNode: config.autoDiscoverLocalNode,
       localNodeUrl: config.localNodeUrl,
       localLinkName: config.localLinkName,
@@ -21775,7 +21846,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     this.tc = new TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
-      telemetry: config.telemetry
+      telemetry: config.telemetry,
+      retryPolicy: config.retryPolicy
     });
   }
   shouldUseBootstrapSignInRequest(config) {
@@ -22137,7 +22209,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.auth = oldAuth;
     this.tc = this.auth ? new TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
-      telemetry: this.config.telemetry
+      telemetry: this.config.telemetry,
+      retryPolicy: this.config.retryPolicy
     }) : null;
     this._capabilityRegistry = new CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({ sessionManager: this.sessionManager });
@@ -22457,6 +22530,9 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primarySession = auth.tinyCloudSession;
     const defaultSpaceId = this.ownedSpaceId("default");
     const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === BOOTSTRAP_SESSION_REQUESTS.default;
+    if (steps.some((step) => step.kind === "host")) {
+      await this.assertMayCreateSpace();
+    }
     for (const step of steps) {
       if (step.kind !== "session") continue;
       graph.assertActive();
@@ -22785,7 +22861,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         invokeAny: context.invokeAny,
         fetch: context.fetch,
         hosts: context.hosts,
-        telemetry: this.config.telemetry
+        telemetry: this.config.telemetry,
+        retryPolicy: this.config.retryPolicy
       }));
       scoped.setOperationAbortSignal(signal);
       scoped.setSession({ ...session, spaceId });
@@ -22832,6 +22909,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       return;
     }
     if (!this.currentSessionCoversAccountRegistry()) {
+      if (!_TinyCloudNode.accountRegistrySkipLogged) {
+        _TinyCloudNode.accountRegistrySkipLogged = true;
+        tinyCloudDebugLogger.log("registry.skip");
+      }
       return;
     }
     const controller = new AbortController();
@@ -22847,7 +22928,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         invokeAny: sharedContext.invokeAny,
         fetch: sharedContext.fetch,
         hosts: sharedContext.hosts,
-        telemetry: this.config.telemetry
+        telemetry: this.config.telemetry,
+        retryPolicy: this.config.retryPolicy
       }));
       context.setOperationAbortSignal(controller.signal);
       const current = this.currentTinyCloudSession();
@@ -23098,6 +23180,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activation }
       );
     }
+    await this.assertMayCreateSpace();
+    if (signal?.aborted) throw signal.reason;
     const created = await this.hostOwnedSpaceOnce(spaceId, signal);
     if (!created.success) {
       throw Object.assign(
@@ -23211,6 +23295,12 @@ var _TinyCloudNode = class _TinyCloudNode {
    * session's recap doesn't cover it and the registry has no record; the host
    * SIWE is idempotent server-side. Must be called after {@link signIn}.
    *
+   * Under `registryPolicy: "fail-closed"`, hosting is refused with
+   * `NodeRegistryEntryExistsError` when the owner's registry record does not
+   * list the host, or `RegistryUnavailableError` when the registry gives no
+   * verdict. {@link hostOwnedSpace} itself is an explicit action and is not
+   * guarded.
+   *
    * @param name - The owned space name (e.g. `"secrets"`).
    * @returns The hosted owned-space URI.
    */
@@ -23222,8 +23312,25 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (this.hostedOwnedSpaceIds.has(spaceId) || await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
+    await this.assertMayCreateSpace();
     return this.hostOwnedSpace(name);
   }
+  /**
+   * Space-creation guard (TC-1443) for the automatic hosting paths: sign-in's
+   * owned spaces, account bootstrap, {@link ensureOwnedSpaceHosted} and
+   * {@link ensurePublicSpace}. Only `registryPolicy: "fail-closed"` consults
+   * the registry ({@link NodeUserAuthorization.assertMayCreateSpace}); the
+   * default policy performs no lookup.
+   */
+  async assertMayCreateSpace() {
+    if (this.config.registryPolicy !== "fail-closed") return;
+    await this.auth.assertMayCreateSpace();
+  }
+  /** Registry-policy settings shared by every authorization this client creates. */
+  registryPolicyConfig() {
+    const { registryPolicy, newUserHost, registryChainId, registrySequenceStore, onNodeNotFound } = this.config;
+    return { registryPolicy, newUserHost, registryChainId, registrySequenceStore, onNodeNotFound };
+  }
   /**
    * Submit the host delegation for an owned space, sharing one in-flight
    * request (and so one approval) between concurrent callers in this session,
@@ -23664,7 +23771,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const graph = this.createServiceGraphLifetime();
     const core = this.auth ? new TinyCloud(this.auth, {
       invokeAny: graph.invokeAny,
-      telemetry: this.config.telemetry
+      telemetry: this.config.telemetry,
+      retryPolicy: this.config.retryPolicy
     }) : null;
     if (core) {
       core.initializeServices(graph.invoke, [input.host], graph.fetch);
@@ -23676,7 +23784,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       invokeAny: graph.invokeAny,
       fetch: graph.fetch,
       hosts: [input.host],
-      telemetry: this.config.telemetry
+      telemetry: this.config.telemetry,
+      retryPolicy: this.config.retryPolicy
     }));
     const kv = new KVService2({});
     kv.initialize(serviceContext);
@@ -23762,7 +23871,8 @@ var _TinyCloudNode = class _TinyCloudNode {
           invoke: config.invoke,
           fetch: config.fetch ?? globalThis.fetch.bind(globalThis),
           hosts: config.hosts,
-          telemetry: this.config.telemetry
+          telemetry: this.config.telemetry,
+          retryPolicy: this.config.retryPolicy
         }));
         context.setSession(config.session);
         service.initialize(context);
@@ -23772,7 +23882,6 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     sharingService.updateConfig({
       session: input.serviceSession,
-      delegationManager,
       sessionExpiry: input.sessionExpiry,
       createDelegationWasm: (params) => {
         graph.assertActive();
@@ -23803,7 +23912,8 @@ var _TinyCloudNode = class _TinyCloudNode {
           invokeAny: graph.invokeAny,
           fetch: graph.fetch,
           hosts: [input.host],
-          telemetry: this.config.telemetry
+          telemetry: this.config.telemetry,
+          retryPolicy: this.config.retryPolicy
         }));
         context.setSession({ ...input.serviceSession, spaceId });
         scopedKv.initialize(context);
@@ -23818,7 +23928,8 @@ var _TinyCloudNode = class _TinyCloudNode {
           invokeAny: graph.invokeAny,
           fetch: graph.fetch,
           hosts: [input.host],
-          telemetry: this.config.telemetry
+          telemetry: this.config.telemetry,
+          retryPolicy: this.config.retryPolicy
         }));
         context.setSession({ ...input.serviceSession, spaceId });
         scopedKv.initialize(context);
@@ -23901,6 +24012,21 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (address === void 0 || chainId === void 0) {
       return void 0;
     }
+    if (this.config.registryPolicy === "fail-closed") {
+      const resolved2 = await resolveFailClosedTinyCloudHosts2(address, {
+        registryUrl: this.config.tinycloudRegistryUrl,
+        registryChainId: this.config.registryChainId,
+        newUserHost: this.config.newUserHost,
+        sequenceStore: this.config.registrySequenceStore,
+        onNodeNotFound: this.config.onNodeNotFound,
+        autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
+        localNodeUrl: this.config.localNodeUrl,
+        localLinkName: this.config.localLinkName,
+        expectedNodeDid: this.config.expectedNodeDid,
+        localNodeIdentityStore: this.config.localNodeIdentityStore
+      });
+      return resolved2.hosts[0];
+    }
     const resolved = await resolveTinyCloudHosts2(pkhDid2(address, chainId), {
       registryUrl: this.config.tinycloudRegistryUrl,
       fallbackHosts: this.config.tinycloudFallbackHosts,
@@ -24093,6 +24219,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: this.config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: this.config.tinycloudFallbackHosts,
+      ...this.registryPolicyConfig(),
       autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
       localNodeUrl: this.config.localNodeUrl,
       localLinkName: this.config.localLinkName,
@@ -24114,7 +24241,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     this.tc = new TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
-      telemetry: this.config.telemetry
+      telemetry: this.config.telemetry,
+      retryPolicy: this.config.retryPolicy
     });
     this.config.prefix = prefix;
   }
@@ -24152,6 +24280,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       tinycloudHosts: this.explicitHost ? [this.explicitHost] : void 0,
       tinycloudRegistryUrl: this.config.tinycloudRegistryUrl,
       tinycloudFallbackHosts: this.config.tinycloudFallbackHosts,
+      ...this.registryPolicyConfig(),
       autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
       localNodeUrl: this.config.localNodeUrl,
       localLinkName: this.config.localLinkName,
@@ -24173,7 +24302,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     this.tc = new TinyCloud(this.auth, {
       invokeAny: this.invokeAnyWithRuntimePermissions,
-      telemetry: this.config.telemetry
+      telemetry: this.config.telemetry,
+      retryPolicy: this.config.retryPolicy
     });
     this.config.prefix = prefix;
   }
@@ -24197,7 +24327,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       invokeAny: this._serviceGraph.invokeAny,
       fetch: this._serviceGraph.fetch,
       hosts: [this.config.host],
-      telemetry: this.config.telemetry
+      telemetry: this.config.telemetry,
+      retryPolicy: this.config.retryPolicy
     }));
     this._kv = new KVService2({});
     this._kv.initialize(this._serviceContext);
@@ -24244,7 +24375,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         invokeAny: this._serviceContext.invokeAny,
         fetch: this._serviceContext.fetch,
         hosts: this._serviceContext.hosts,
-        telemetry: this.config.telemetry
+        telemetry: this.config.telemetry,
+        retryPolicy: this.config.retryPolicy
       }));
       const session = this._serviceContext.session;
       if (session) {
@@ -24695,7 +24827,6 @@ var _TinyCloudNode = class _TinyCloudNode {
       assertActive: () => graph.assertActive(),
       keyProvider: this._keyProvider,
       registry: this._capabilityRegistry,
-      delegationManager: this._delegationManager,
       sessionExpiry: this.getSessionExpiry(),
       createDelegationWasm: (params) => {
         graph.assertActive();
@@ -24712,7 +24843,8 @@ var _TinyCloudNode = class _TinyCloudNode {
           invoke: config.invoke,
           fetch: config.fetch ?? graph.fetch,
           hosts: config.hosts,
-          telemetry: this.config.telemetry
+          telemetry: this.config.telemetry,
+          retryPolicy: this.config.retryPolicy
         }));
         context.setSession(config.session);
         service.initialize(context);
@@ -25033,7 +25165,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       invokeAny: this._serviceContext.invokeAny,
       fetch: this._serviceContext.fetch,
       hosts: this._serviceContext.hosts,
-      telemetry: this.config.telemetry
+      telemetry: this.config.telemetry,
+      retryPolicy: this.config.retryPolicy
     }));
     spaceScopedContext.setSession({ ...this._serviceContext.session, spaceId });
     sql.initialize(spaceScopedContext);
@@ -25236,6 +25369,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           }
         };
       }
+      if (result.status === "aad_mismatch") return { status: "read_failed" };
       return { status: result.status };
     }
     if (!isSecretPayload(result.entry.value)) {
@@ -25677,16 +25811,8 @@ var _TinyCloudNode = class _TinyCloudNode {
    * ```typescript
    * const delegations = alice.delegationManager;
    *
-   * // Create a delegation
-   * const result = await delegations.create({
-   *   delegateDID: bob.did,
-   *   path: "shared/",
-   *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
-   *   expiry: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours
-   * });
-   *
-   * // List delegations
-   * const listResult = await delegations.list();
+   * // Query account delegations
+   * const page = await delegations.query();
    *
    * // Revoke a delegation
    * await delegations.revoke(delegationCid);
@@ -25788,7 +25914,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * Ensure the user's public space exists and is accessible.
    * Creates the space and activates a session delegation for it.
    * This is the trigger for lazy public space creation — call it
-   * before writing to spaces.get('public').kv.
+   * before writing to spaces.get('public').kv. The vault calls it on unlock.
+   * Under `registryPolicy: "fail-closed"` creation goes through the
+   * space-creation guard.
    */
   async ensurePublicSpace() {
     if (!this.auth || !this.session || !this.signer) {
@@ -25798,6 +25926,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!publicSpaceId) {
       throw new Error("Public space not enabled. Set enablePublicSpace: true in config.");
     }
+    await this.assertMayCreateSpace();
     await this.auth.hostPublicSpace(publicSpaceId);
     const kvActions = [KV3.PUT, KV3.GET, KV3.DEL, KV3.LIST, KV3.METADATA];
     const abilities = { kv: { "": kvActions } };
@@ -25855,7 +25984,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         invoke: this._serviceGraph.invoke,
         fetch: this._serviceGraph.fetch,
         hosts: this._serviceContext.hosts,
-        telemetry: this.config.telemetry
+        telemetry: this.config.telemetry,
+        retryPolicy: this.config.retryPolicy
       }));
       publicContext.setSession({
         delegationHeader: delegationSession.delegationHeader,
@@ -25884,32 +26014,6 @@ var _TinyCloudNode = class _TinyCloudNode {
   // ===========================================================================
   // v2 Delegation Convenience Methods
   // ===========================================================================
-  /**
-   * Create a delegation using the v2 DelegationManager.
-   *
-   * This is a convenience method that wraps DelegationManager.create().
-   * For more control, use `this.delegationManager` directly.
-   *
-   * @param params - Delegation parameters
-   * @returns Result containing the created Delegation
-   *
-   * @example
-   * ```typescript
-   * const result = await alice.delegate({
-   *   delegateDID: bob.did,
-   *   path: "shared/",
-   *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
-   *   expiry: new Date(Date.now() + 24 * 60 * 60 * 1000),
-   * });
-   *
-   * if (result.ok) {
-   *   console.log("Delegation created:", result.data.cid);
-   * }
-   * ```
-   */
-  async delegate(params) {
-    return this.delegationManager.create(params);
-  }
   /**
    * Revoke a delegation with the owner wallet when available. Session-only
    * clients continue to use their delegated revocation authority.
@@ -25935,14 +26039,6 @@ var _TinyCloudNode = class _TinyCloudNode {
       0x55n
     );
   }
-  /**
-   * List all delegations for the current session's space.
-   *
-   * @returns Result containing an array of Delegations
-   */
-  async listDelegations() {
-    return this.delegationManager.list();
-  }
   /**
    * Check if the current session has permission for a path and action.
    *
@@ -26002,6 +26098,9 @@ var _TinyCloudNode = class _TinyCloudNode {
         "delegateTo: onPrepared cannot be combined with forceWalletSign=true; the wallet-signed path activates the delegation before it could be handed to onPrepared."
       );
     }
+    if (options?.disableSubDelegation && did.startsWith("did:pkh:")) {
+      throw new Error(TERMINAL_DELEGATION_REQUIRES_SESSION_KEY);
+    }
     const session = this.currentTinyCloudSession();
     if (!session) {
       throw new SessionExpiredError(/* @__PURE__ */ new Date(0));
@@ -26067,7 +26166,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         plan.grant,
         plan.operations,
         onPrepared,
-        options?.disableSubDelegation === true
+        options?.disableSubDelegation === true,
+        options?.requireActivation === true
       );
       return { delegation: delegation2, prompted: false };
     }
@@ -26077,7 +26177,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       effectiveExpiration,
       session,
       onPrepared,
-      options?.disableSubDelegation === true
+      options?.disableSubDelegation === true,
+      options?.requireActivation === true
     );
     return { delegation, prompted: false };
   }
@@ -26308,7 +26409,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    *
    * @internal
    */
-  async createDelegationViaWasmPath(did, entries, expirationTime, session, onPrepared, disableSubDelegation = false) {
+  async createDelegationViaWasmPath(did, entries, expirationTime, session, onPrepared, disableSubDelegation = false, requireActivation = false) {
     if (entries.length === 0) {
       throw new Error(
         "createDelegationViaWasmPath requires a non-empty entries array"
@@ -26392,15 +26493,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       this.config.host,
       delegationHeader
     );
-    if (!activateResult.success) {
-      throw Object.assign(
-        new Error(`Failed to activate delegation with host: ${describeHostFailure2(activateResult)}`),
-        { cause: activateResult }
-      );
-    }
+    assertDelegationActivated(activateResult, delegation, requireActivation);
     return delegation;
   }
-  async createDelegationViaRuntimeGrant(did, entries, expirationTime, grant, requestedOperations, onPrepared, disableSubDelegation = false) {
+  async createDelegationViaRuntimeGrant(did, entries, expirationTime, grant, requestedOperations, onPrepared, disableSubDelegation = false, requireActivation = false) {
     this.assertRuntimeGrantCaveatsPreservable(entries, requestedOperations, grant);
     this.assertDelegationCaveatsPreservable(entries);
     const result = this.createDelegationWrapper({
@@ -26434,12 +26530,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       targetHost,
       delegationHeader
     );
-    if (!activateResult.success) {
-      throw Object.assign(
-        new Error(`Failed to activate delegation with host: ${describeHostFailure2(activateResult)}`),
-        { cause: activateResult }
-      );
-    }
+    assertDelegationActivated(activateResult, delegation, requireActivation);
     return delegation;
   }
   resolvePermissionSpace(space, session) {
@@ -27386,6 +27477,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
   }
 };
+/** Set once per process: the registry sync was skipped for want of account access. */
+_TinyCloudNode.accountRegistrySkipLogged = false;
 // ===========================================================================
 // Capability-chain delegation (spec: .claude/specs/capability-chain.md)
 // ===========================================================================
@@ -27440,7 +27533,7 @@ import {
   principalDidEquals as principalDidEquals4,
   parseCanonicalNetworkId,
   TinyCloudDebugLogger,
-  tinyCloudDebugLogger,
+  tinyCloudDebugLogger as tinyCloudDebugLogger2,
   enableTinyCloudDebug,
   disableTinyCloudDebug,
   getTinyCloudDebugLogs,
@@ -28945,6 +29038,34 @@ assertSyncEffective_fn = async function() {
     throw new ReplicaStorageError("GRANT_EXPIRED", "The replica grant's effective lifetime has expired.");
   }
 };
+async function listDir(dir) {
+  try {
+    return await readdir(dir);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
+      return [];
+    }
+    throw error;
+  }
+}
+async function collectProfileOrphans(root, collectOrphans) {
+  for (const partition of await listDir(root)) {
+    const replicasDir = join2(root, partition, "replicas");
+    for (const replicaName of await listDir(replicasDir)) {
+      await collectOrphans(join2(replicasDir, replicaName));
+    }
+  }
+}
+async function profileContentBytes(root, contentBytes) {
+  let total = 0;
+  for (const partition of await listDir(root)) {
+    const replicasDir = join2(root, partition, "replicas");
+    for (const replicaName of await listDir(replicasDir)) {
+      total += await contentBytes(join2(replicasDir, replicaName));
+    }
+  }
+  return total;
+}
 function createSqliteReplicaStorage(options) {
   const root = options.dir;
   const profileDir = dirname2(options.gateFile ?? join2(dirname2(root), REPLICA_GATE_FILE));
@@ -29939,10 +30060,29 @@ function createSqliteReplicaStorage(options) {
       const replicaHash = replicaHashOf(spec.prefix, device.did);
       partitionId = `${identityKeyHash}:${replicaHash}`;
       const replicaDir = join2(idDir, "replicas", replicaHash);
-      const store = await sqlite.SqliteReplicaStore.open(replicaDir, {
-        create: true,
-        guard: storeGuard
-      });
+      const quota = spec.quota?.maxBytes ?? options.maxBytes;
+      if (quota !== void 0 && (!Number.isSafeInteger(quota) || quota < 0)) {
+        throw new TypeError(`maxBytes must be a non-negative safe integer, got ${quota}.`);
+      }
+      if (quota !== void 0) await collectProfileOrphans(root, sqlite.SqliteReplicaStore.collectOrphans);
+      const store = await sqlite.SqliteReplicaStore.open(
+        replicaDir,
+        quota === void 0 ? { create: true, guard: storeGuard } : {
+          create: true,
+          guard: storeGuard,
+          partitionId: basename(idDir),
+          admit: async (page) => {
+            await collectProfileOrphans(root, sqlite.SqliteReplicaStore.collectOrphans);
+            const used = await profileContentBytes(root, sqlite.SqliteReplicaStore.contentBytes);
+            if (page.blobBytes > 0 && used + page.blobBytes > quota) {
+              throw new replica.ReplicaError(
+                replica.ReplicaErrorCode.STORAGE_BUDGET,
+                `Profile storage holds ${used} bytes; this page adds ${page.blobBytes} against a ${quota}-byte quota. Nothing was committed.`
+              );
+            }
+          }
+        }
+      );
       let generation;
       try {
         try {
@@ -30369,7 +30509,7 @@ export {
   siweRuntimeDelegation,
   sqliteReplicaStorage,
   storageUsageState,
-  tinyCloudDebugLogger,
+  tinyCloudDebugLogger2 as tinyCloudDebugLogger,
   validateEnvelope,
   validateManifest,
   verifyDecryptResponse,