@tinycloud/sdk-core 3.11.0 → 3.12.0-beta.3

package/dist/index.cjs

@@ -88,6 +88,7 @@ __export(index_exports, {
   DEFAULT_MANIFEST_SPACE: () => DEFAULT_MANIFEST_SPACE,
   DEFAULT_MANIFEST_VERSION: () => DEFAULT_MANIFEST_VERSION,
   DEFAULT_NEW_USER_HOST: () => DEFAULT_NEW_USER_HOST,
+  DEFAULT_REGISTRY_CACHE_STORAGE_KEY: () => DEFAULT_REGISTRY_CACHE_STORAGE_KEY,
   DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS: () => DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS,
   DEFAULT_REGISTRY_OWNER_CHAIN_ID: () => DEFAULT_REGISTRY_OWNER_CHAIN_ID,
   DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY: () => DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY,
@@ -179,6 +180,7 @@ __export(index_exports, {
   PermissionNotInManifestError: () => PermissionNotInManifestError,
   PrefixedKVService: () => import_sdk_services10.PrefixedKVService,
   ProtocolMismatchError: () => ProtocolMismatchError,
+  REGISTRY_CACHE_MAX_AGE_MS: () => REGISTRY_CACHE_MAX_AGE_MS,
   REGISTRY_LOOKUP_MAX_BODY_BYTES: () => REGISTRY_LOOKUP_MAX_BODY_BYTES,
   REGISTRY_NOT_FOUND_BODY: () => REGISTRY_NOT_FOUND_BODY,
   REQUESTER_ENGINE_RETRY_ATTEMPTS: () => REQUESTER_ENGINE_RETRY_ATTEMPTS,
@@ -279,6 +281,7 @@ __export(index_exports, {
   canonicalEmailDomain: () => import_share_envelope.canonicalEmailDomain,
   canonicalHashHex: () => import_sdk_services10.canonicalHashHex,
   canonicalLocationPayload: () => canonicalLocationPayload,
+  canonicalLocationPayloadV2: () => canonicalLocationPayloadV2,
   canonicalMailbox: () => import_share_envelope.canonicalMailbox,
   canonicalOwnerSharePolicy: () => canonicalOwnerSharePolicy,
   canonicalSignedResponse: () => import_sdk_services10.canonicalSignedResponse,
@@ -312,8 +315,10 @@ __export(index_exports, {
   createEmailDomainCredentialRequirement: () => createEmailDomainCredentialRequirement,
   createHolderBinding: () => createHolderBinding,
   createInMemoryLocalNodeIdentityStore: () => createInMemoryLocalNodeIdentityStore,
+  createInMemoryRegistryCacheStore: () => createInMemoryRegistryCacheStore,
   createInMemoryRegistrySequenceStore: () => createInMemoryRegistrySequenceStore,
   createLocalStorageLocalNodeIdentityStore: () => createLocalStorageLocalNodeIdentityStore,
+  createLocalStorageRegistryCacheStore: () => createLocalStorageRegistryCacheStore,
   createLocalStorageRegistrySequenceStore: () => createLocalStorageRegistrySequenceStore,
   createOpenKeyCallbackSigningStrategy: () => createOpenKeyCallbackSigningStrategy,
   createOpenKeyManageKeySigningStrategy: () => createOpenKeyManageKeySigningStrategy,
@@ -365,6 +370,7 @@ __export(index_exports, {
   encryptionUtf8Encode: () => import_sdk_services10.utf8Encode,
   ensureNetworkUsableForDecrypt: () => import_sdk_services10.ensureNetworkUsableForDecrypt,
   err: () => import_sdk_services10.err,
+  exactHttpOrigin: () => exactHttpOrigin,
   expandActionShortNames: () => expandActionShortNames,
   expandDelegationPermissionEntries: () => expandDelegationPermissionEntries,
   expandPermissionEntries: () => expandPermissionEntries,
@@ -448,7 +454,9 @@ __export(index_exports, {
   projectUnifiedPolicyCapability: () => projectUnifiedPolicyCapability,
   publishLocationRecord: () => publishLocationRecord,
   recapCaveatsEqual: () => recapCaveatsEqual,
+  refreshOwnerRegistry: () => refreshOwnerRegistry,
   registerPolicyV3: () => registerPolicyV3,
+  registryOwnerKeyV2: () => registryOwnerKeyV2,
   registryOwnerSubjectV1: () => registryOwnerSubjectV1,
   renewPolicyRootStatusV3: () => renewPolicyRootStatusV3,
   requestTinyCloudManageKeyScope: () => requestTinyCloudManageKeyScope,
@@ -457,6 +465,7 @@ __export(index_exports, {
   resolveManifest: () => resolveManifest,
   resolveManifestKnowledgeRoot: () => resolveManifestKnowledgeRoot,
   resolveOwnerHosts: () => resolveOwnerHosts,
+  resolveRegistryResource: () => resolveRegistryResource,
   resolveSecretListPrefix: () => import_sdk_services10.resolveSecretListPrefix,
   resolveSecretPath: () => import_sdk_services10.resolveSecretPath,
   resolveTinyCloudHosts: () => resolveTinyCloudHosts,
@@ -474,6 +483,7 @@ __export(index_exports, {
   signCompactUcanAuthorization: () => signCompactUcanAuthorization,
   signCompactUcanRootAuthorization: () => signCompactUcanRootAuthorization,
   signLocationRecord: () => signLocationRecord,
+  signLocationRecordV2: () => signLocationRecordV2,
   signPolicyCredentialPresentationV4: () => signPolicyCredentialPresentationV4,
   signShareEnvelope: () => signShareEnvelope,
   signedObjectIdFor: () => signedObjectIdFor,
@@ -495,6 +505,8 @@ __export(index_exports, {
   validateEnvelope: () => import_sdk_services10.validateEnvelope,
   validateLocationRecord: () => validateLocationRecord,
   validateLocationRecordPayload: () => validateLocationRecordPayload,
+  validateLocationRecordV2: () => validateLocationRecordV2,
+  validateLocationRecordV2Payload: () => validateLocationRecordV2Payload,
   validateManifest: () => validateManifest,
   validateOwnerSharePolicyRegistration: () => validateOwnerSharePolicyRegistration,
   validateOwnerSharePolicyRegistrationBytes: () => validateOwnerSharePolicyRegistrationBytes,
@@ -516,17 +528,20 @@ __export(index_exports, {
   verifyEip191MessageSignature: () => verifyEip191MessageSignature,
   verifyIssuedCredential: () => verifyIssuedCredential,
   verifyLocationRecord: () => verifyLocationRecord,
+  verifyLocationRecordV2: () => verifyLocationRecordV2,
   verifyOwnerNodeBinding: () => verifyOwnerNodeBinding,
   verifyPolicy: () => verifyPolicy,
   verifyPolicyEngineRecord: () => verifyPolicyEngineRecord,
   verifyPolicyRootRevocationV3: () => verifyPolicyRootRevocationV3,
   verifyPolicyRootStatusCheckpointV3: () => verifyPolicyRootStatusCheckpointV3,
   verifyPolicyStatus: () => verifyPolicyStatus,
+  verifyRegistryCacheEntry: () => verifyRegistryCacheEntry,
   verifyShareCid: () => verifyShareCid,
   verifyShareDeliveryAuthorizationV3Bytes: () => verifyShareDeliveryAuthorizationV3Bytes,
   verifyShareEnvelope: () => verifyShareEnvelope,
   verifySignedObject: () => verifySignedObject,
   verifyStorageReceipt: () => verifyStorageReceipt,
+  warnRegistryDefaultNode: () => warnRegistryDefaultNode,
   withoutShareLink: () => withoutShareLink
 });
 module.exports = __toCommonJS(index_exports);
@@ -18748,6 +18763,298 @@ async function verifyLocationRecord(input) {
   }
   return false;
 }
+function canonicalLocationPayloadV2(payload) {
+  return JSON.stringify({
+    version: payload.version,
+    subject: payload.subject,
+    nodes: payload.nodes.map(({ did, url }) => ({ did, url })).sort((left, right) => compareAscii(left.did, right.did)),
+    spaces: payload.spaces.map(({ space, nodes }) => ({
+      space,
+      nodes: nodes.map(({ did, mode }) => ({ did, mode })).sort((left, right) => compareAscii(left.did, right.did))
+    })).sort((left, right) => compareAscii(left.space, right.space)),
+    encryptionNode: payload.encryptionNode,
+    updated_at: payload.updated_at,
+    sequence: payload.sequence
+  });
+}
+function validateLocationRecordV2Payload(input) {
+  const payload = exactV2Object(
+    input,
+    ["version", "subject", "nodes", "spaces", "encryptionNode", "updated_at", "sequence"],
+    "payload"
+  );
+  if (payload.version !== 2) {
+    throw new LocationRecordValidationError("version must be 2");
+  }
+  validateV2OwnerSubject(payload.subject);
+  if (!Array.isArray(payload.nodes)) {
+    throw new LocationRecordValidationError("nodes must be an array");
+  }
+  const nodeDids = /* @__PURE__ */ new Set();
+  const origins = /* @__PURE__ */ new Set();
+  const nodes = [];
+  for (const item of payload.nodes) {
+    const node = exactV2Object(item, ["did", "url"], "node");
+    if (typeof node.did !== "string") {
+      throw new LocationRecordValidationError("node.did must be a string");
+    }
+    validateV2DidKey(node.did, "node.did");
+    if (typeof node.url !== "string") {
+      throw new LocationRecordValidationError("node.url must be a string");
+    }
+    const origin2 = validateV2Origin(node.url);
+    if (nodeDids.has(node.did) || origins.has(origin2)) {
+      throw new LocationRecordValidationError("node DIDs and origins must be unique");
+    }
+    nodeDids.add(node.did);
+    origins.add(origin2);
+    nodes.push({ did: node.did, url: origin2 });
+  }
+  if (!Array.isArray(payload.spaces)) {
+    throw new LocationRecordValidationError("spaces must be an array");
+  }
+  const spaceKeys = /* @__PURE__ */ new Set();
+  const spaces = [];
+  for (const item of payload.spaces) {
+    const space = exactV2Object(item, ["space", "nodes"], "space");
+    if (typeof space.space !== "string" || !isAsciiNonEmpty(space.space)) {
+      throw new LocationRecordValidationError("space.space must be a non-empty ASCII URI");
+    }
+    const identity3 = validateV2SpaceOwner(space.space, payload.subject);
+    if (spaceKeys.has(identity3)) {
+      throw new LocationRecordValidationError("spaces must be unique");
+    }
+    spaceKeys.add(identity3);
+    if (!Array.isArray(space.nodes)) {
+      throw new LocationRecordValidationError("space.nodes must be an array");
+    }
+    const membershipDids = /* @__PURE__ */ new Set();
+    const memberships = [];
+    for (const item2 of space.nodes) {
+      const membership = exactV2Object(item2, ["did", "mode"], "space membership");
+      if (typeof membership.did !== "string") {
+        throw new LocationRecordValidationError("membership.did must be a string");
+      }
+      validateV2DidKey(membership.did, "membership.did");
+      if (!nodeDids.has(membership.did)) {
+        throw new LocationRecordValidationError("space membership must reference a listed node");
+      }
+      if (membershipDids.has(membership.did)) {
+        throw new LocationRecordValidationError("space membership DIDs must be unique");
+      }
+      if (membership.mode !== "read-write" && membership.mode !== "read-only") {
+        throw new LocationRecordValidationError("membership.mode must be read-write or read-only");
+      }
+      membershipDids.add(membership.did);
+      memberships.push({ did: membership.did, mode: membership.mode });
+    }
+    spaces.push({ space: space.space, nodes: memberships });
+  }
+  if (payload.encryptionNode !== null) {
+    if (typeof payload.encryptionNode !== "string") {
+      throw new LocationRecordValidationError("encryptionNode must be a DID or null");
+    }
+    validateV2DidKey(payload.encryptionNode, "encryptionNode");
+    if (!nodeDids.has(payload.encryptionNode)) {
+      throw new LocationRecordValidationError("encryptionNode must reference a listed node");
+    }
+  }
+  if (typeof payload.updated_at !== "string" || !isV2UtcTimestamp(payload.updated_at)) {
+    throw new LocationRecordValidationError("updated_at must be a valid UTC RFC 3339 timestamp with milliseconds");
+  }
+  if (typeof payload.sequence !== "number" || !Number.isSafeInteger(payload.sequence) || payload.sequence < 0) {
+    throw new LocationRecordValidationError("sequence must be a non-negative safe integer");
+  }
+  return {
+    version: 2,
+    subject: payload.subject,
+    nodes,
+    spaces,
+    encryptionNode: payload.encryptionNode,
+    updated_at: payload.updated_at,
+    sequence: payload.sequence
+  };
+}
+function validateLocationRecordV2(input) {
+  const record2 = exactV2Object(
+    input,
+    ["version", "subject", "nodes", "spaces", "encryptionNode", "updated_at", "sequence", "signature"],
+    "record"
+  );
+  const payload = validateLocationRecordV2Payload({
+    version: record2.version,
+    subject: record2.subject,
+    nodes: record2.nodes,
+    spaces: record2.spaces,
+    encryptionNode: record2.encryptionNode,
+    updated_at: record2.updated_at,
+    sequence: record2.sequence
+  });
+  if (typeof record2.signature !== "string" || !isCanonicalV2Signature(payload.subject, record2.signature)) {
+    throw new LocationRecordValidationError("signature is not in canonical owner-signature format");
+  }
+  return { ...payload, signature: record2.signature };
+}
+async function verifyLocationRecordV2(input) {
+  const record2 = validateLocationRecordV2(input);
+  const payload = canonicalLocationPayloadV2(record2);
+  if (record2.subject.startsWith("did:pkh:")) {
+    const address = record2.subject.slice(record2.subject.lastIndexOf(":") + 1);
+    try {
+      return await (0, import_viem6.verifyMessage)({
+        address,
+        message: payload,
+        signature: record2.signature
+      });
+    } catch {
+      return false;
+    }
+  }
+  try {
+    return import_ed2551911.ed25519.verify(
+      decodeBase64Url4(record2.signature),
+      new TextEncoder().encode(payload),
+      canonicalV2DidKey(record2.subject),
+      { zip215: false }
+    );
+  } catch {
+    return false;
+  }
+}
+async function signLocationRecordV2(payload, signer) {
+  const validated = validateLocationRecordV2Payload(payload);
+  const message = canonicalLocationPayloadV2(validated);
+  const isPkh = validated.subject.startsWith("did:pkh:");
+  if (signer.type === "did:pkh" !== isPkh) {
+    throw new LocationRecordValidationError("signer type does not match owner subject");
+  }
+  const signature = signer.type === "did:pkh" ? await signer.signMessage(message) : base64UrlEncode3(await signer.signBytes(new TextEncoder().encode(message)));
+  const record2 = validateLocationRecordV2({ ...validated, signature });
+  if (!await verifyLocationRecordV2(record2)) {
+    throw new LocationRecordValidationError("signature does not verify for owner subject");
+  }
+  return record2;
+}
+function exactV2Object(input, expected, label) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    throw new LocationRecordValidationError(`${label} must be an object`);
+  }
+  const keys = Reflect.ownKeys(input);
+  if (keys.length !== expected.length || keys.some((key) => typeof key !== "string" || !expected.includes(key))) {
+    throw new LocationRecordValidationError(`${label} has missing or unknown fields`);
+  }
+  return input;
+}
+function validateV2OwnerSubject(subject) {
+  if (typeof subject !== "string" || !isAsciiNonEmpty(subject)) {
+    throw new LocationRecordValidationError("subject must be a canonical owner DID");
+  }
+  const pkh = /^did:pkh:eip155:([1-9][0-9]*):(0x[a-fA-F0-9]{40})$/.exec(subject);
+  if (pkh !== null) {
+    const chainId = Number(pkh[1]);
+    try {
+      if (Number.isSafeInteger(chainId) && chainId > 0 && pkhDid(pkh[2], chainId) === subject) return;
+    } catch {
+    }
+    throw new LocationRecordValidationError("subject must use a positive safe chain ID and EIP-55 address");
+  }
+  validateV2DidKey(subject, "subject");
+}
+function validateV2DidKey(value, label) {
+  try {
+    canonicalV2DidKey(value);
+  } catch {
+    throw new LocationRecordValidationError(`${label} must be a canonical Ed25519 did:key`);
+  }
+}
+function canonicalV2DidKey(did) {
+  if (!did.startsWith("did:key:z")) {
+    throw new LocationRecordValidationError("DID must be an Ed25519 did:key");
+  }
+  const identifier = did.slice("did:key:".length);
+  const bytes2 = bases.base58btc.decode(identifier);
+  if (bytes2.length !== 34 || bytes2[0] !== 237 || bytes2[1] !== 1 || bases.base58btc.encode(bytes2) !== identifier) {
+    throw new LocationRecordValidationError("DID must use the canonical Ed25519 multicodec");
+  }
+  return bytes2.slice(2);
+}
+function validateV2Origin(input) {
+  if (!isAsciiNonEmpty(input)) {
+    throw new LocationRecordValidationError("node.url must be an ASCII HTTP(S) origin");
+  }
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    throw new LocationRecordValidationError("node.url must be an absolute HTTP(S) origin");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.origin !== input) {
+    throw new LocationRecordValidationError("node.url must be an exact origin without path, query, fragment, or credentials");
+  }
+  if (url.protocol === "http:" && url.hostname !== "127.0.0.1" && url.hostname !== "[::1]") {
+    throw new LocationRecordValidationError("HTTP node URLs are allowed only for IPv4 or IPv6 loopback");
+  }
+  return url.origin;
+}
+function validateV2SpaceOwner(space, subject) {
+  if (!/^[A-Za-z0-9._~!$&'()*+,;=:@%-]+$/.test(space)) {
+    throw new LocationRecordValidationError("space must be a complete normalized TinyCloud space URI");
+  }
+  for (let index = space.indexOf("%"); index !== -1; index = space.indexOf("%", index + 3)) {
+    const octet = space.slice(index + 1, index + 3);
+    if (!/^[0-9A-F]{2}$/.test(octet) || /^[A-Za-z0-9._~-]$/.test(String.fromCharCode(Number.parseInt(octet, 16)))) {
+      throw new LocationRecordValidationError("space URI percent encoding must be normalized");
+    }
+  }
+  if (subject.startsWith("did:key:")) {
+    const prefix = `tinycloud:${subject.slice("did:".length)}:`;
+    if (!space.startsWith(prefix) || space.length === prefix.length || space.slice(prefix.length).includes(":")) {
+      throw new LocationRecordValidationError("space owner must match the did:key subject");
+    }
+    return space;
+  }
+  const parts = /^tinycloud:pkh:eip155:([1-9][0-9]*):(0x[a-fA-F0-9]{40}):([^:]+)$/.exec(space);
+  const ownerAddress = subject.slice(subject.lastIndexOf(":") + 1);
+  if (parts === null || !Number.isSafeInteger(Number(parts[1])) || Number(parts[1]) <= 0 || parts[2].toLowerCase() !== ownerAddress.toLowerCase()) {
+    throw new LocationRecordValidationError("space owner address must match the did:pkh subject");
+  }
+  return `tinycloud:pkh:eip155:${parts[1]}:${parts[2].toLowerCase()}:${parts[3]}`;
+}
+function isV2UtcTimestamp(value) {
+  const match = /^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-9]{2})\.([0-9]{3})Z$/.exec(value);
+  if (match === null) return false;
+  const [year, month, day, hour, minute, second] = match.slice(1, 7).map(Number);
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const daysInMonth = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1];
+  return year > 0 && daysInMonth !== void 0 && day >= 1 && day <= daysInMonth && hour <= 23 && minute <= 59 && second <= 59;
+}
+function isCanonicalV2Signature(subject, signature) {
+  if (subject.startsWith("did:pkh:")) {
+    if (!/^0x[0-9a-fA-F]{130}$/.test(signature)) return false;
+    const r = BigInt(`0x${signature.slice(2, 66)}`);
+    const s = BigInt(`0x${signature.slice(66, 130)}`);
+    const v = Number.parseInt(signature.slice(130), 16);
+    const curveOrder = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+    return r > 0n && r < curveOrder && s > 0n && s <= curveOrder / 2n && (v === 27 || v === 28);
+  }
+  if (!/^[A-Za-z0-9_-]{86}$/.test(signature)) return false;
+  try {
+    const bytes2 = decodeBase64Url4(signature);
+    return bytes2.length === 64 && base64UrlEncode3(bytes2) === signature;
+  } catch {
+    return false;
+  }
+}
+function isAsciiNonEmpty(value) {
+  if (value.length === 0) return false;
+  for (let index = 0; index < value.length; index++) {
+    if (value.charCodeAt(index) > 127) return false;
+  }
+  return true;
+}
+function compareAscii(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
 async function fetchLocationRecord(registryUrl, subject, fetchFn = globalThis.fetch, signal) {
   const url = `${registryUrl.replace(/\/$/, "")}/v1/locations/${encodeURIComponent(subject)}`;
   const response = await fetchFn(url, {
@@ -19524,6 +19831,50 @@ async function classifyRegistryLookup(subject, response, options2 = {}) {
     }
     return { status: "unregistered", subject, source: "offchain", hosts: [] };
   }
+  if (options2.recordVersion === 2) {
+    let record3;
+    try {
+      record3 = parseRecordResponseV2(response.body);
+    } catch (error) {
+      return unavailable(
+        "malformed-response",
+        error instanceof Error ? error.message : "location registry response is invalid"
+      );
+    }
+    if (registryOwnerKeyV2(record3.subject) !== registryOwnerKeyV2(subject)) {
+      return unavailable(
+        "subject-mismatch",
+        "location record owner does not match requested owner key"
+      );
+    }
+    let signatureValid = false;
+    try {
+      signatureValid = await verifyLocationRecordV2(record3);
+    } catch {
+      signatureValid = false;
+    }
+    if (!signatureValid) {
+      return unavailable("invalid-signature", "location record signature is invalid");
+    }
+    if (remembered !== null && record3.sequence < remembered) {
+      return unavailable(
+        "rollback",
+        `location record sequence ${record3.sequence} is below remembered sequence ${remembered}`
+      );
+    }
+    return {
+      status: "registered",
+      subject,
+      source: "offchain",
+      sequence: record3.sequence,
+      record: record3,
+      hosts: record3.nodes.map(({ did, url }) => ({
+        nodeDid: did,
+        urls: [url],
+        source: "offchain"
+      }))
+    };
+  }
   let record2;
   try {
     record2 = parseRecordResponse(response.body);
@@ -19700,6 +20051,26 @@ function parseStrictJson(text3) {
   if (i !== text3.length) fail2("trailing data");
   return value;
 }
+function registryOwnerKeyV2(subject) {
+  return subject.startsWith("did:pkh:") ? subject.slice(subject.lastIndexOf(":") + 1) : subject;
+}
+function parseRecordResponseV2(body) {
+  const root = parseStrictJson(body);
+  if (!(root instanceof Map) || root.size !== 1 || !root.has("record")) {
+    throw new SyntaxError("location registry v2 response must contain only a record field");
+  }
+  return validateLocationRecordV2(toNativeJson(root.get("record")));
+}
+function toNativeJson(value) {
+  if (value instanceof JsonInteger) return Number(value.lexeme);
+  if (Array.isArray(value)) return value.map(toNativeJson);
+  if (value instanceof Map) {
+    return Object.fromEntries(
+      Array.from(value, ([key, entry]) => [key, toNativeJson(entry)])
+    );
+  }
+  return value;
+}
 function parseRecordResponse(body) {
   const root = parseStrictJson(body);
   const record2 = root instanceof Map ? root.get("record") : void 0;
@@ -19820,11 +20191,150 @@ function multiaddrOrigin(address) {
   }
 }
 
+// src/registry-cache.ts
+function createInMemoryRegistryCacheStore() {
+  const entries = /* @__PURE__ */ new Map();
+  let tail = Promise.resolve();
+  return {
+    async get(key) {
+      await tail;
+      const record2 = validateRegistryCacheRecord(entries.get(key), key);
+      return record2 && "invalidated" in record2 ? void 0 : record2;
+    },
+    async getRevision(key) {
+      await tail;
+      return validateRegistryCacheRecord(entries.get(key), key)?.revision ?? 0;
+    },
+    update(key, update) {
+      const next = tail.then(async () => {
+        const record2 = validateRegistryCacheRecord(entries.get(key), key);
+        const revision = record2?.revision ?? 0;
+        const entry = { ...await update(record2 && "invalidated" in record2 ? void 0 : record2, revision), revision };
+        entries.set(key, entry);
+        return entry;
+      });
+      tail = next.catch(() => void 0);
+      return next;
+    },
+    delete(key, expectedRevision, maximumSequence) {
+      const next = tail.then(() => {
+        const record2 = validateRegistryCacheRecord(entries.get(key), key);
+        const revision = record2?.revision ?? 0;
+        if (expectedRevision !== void 0 && (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0 || expectedRevision !== revision)) {
+          throw new Error("Registry cache revision changed before invalidation");
+        }
+        if (maximumSequence !== void 0 && (!Number.isSafeInteger(maximumSequence) || maximumSequence < 0 || record2 !== void 0 && !("invalidated" in record2) && record2.sequence > maximumSequence)) {
+          throw new Error("Registry cache sequence advanced before invalidation");
+        }
+        if (revision === Number.MAX_SAFE_INTEGER) throw new Error("Registry cache revision overflow");
+        entries.set(key, { ownerKey: key, revision: revision + 1, invalidated: true });
+      });
+      tail = next.catch(() => void 0);
+      return next;
+    }
+  };
+}
+function validateRegistryCacheRecord(value, key) {
+  if (value === void 0) return void 0;
+  if (!value || typeof value !== "object" || Array.isArray(value) || !("ownerKey" in value) || value.ownerKey !== key) {
+    throw new Error("Invalid registry cache metadata");
+  }
+  const revision = "revision" in value ? value.revision : 0;
+  if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 0) {
+    throw new Error("Invalid registry cache revision");
+  }
+  if ("invalidated" in value) {
+    if (value.invalidated !== true || !("revision" in value) || revision === 0 || Object.keys(value).some((field) => field !== "ownerKey" && field !== "revision" && field !== "invalidated")) {
+      throw new Error("Invalid registry cache tombstone");
+    }
+    return { ownerKey: key, revision, invalidated: true };
+  }
+  if (!("responseBody" in value) || typeof value.responseBody !== "string" || !("fetchedAt" in value) || typeof value.fetchedAt !== "number" || !Number.isSafeInteger(value.fetchedAt) || value.fetchedAt < 0 || !("sequence" in value) || typeof value.sequence !== "number" || !Number.isSafeInteger(value.sequence) || value.sequence < 0) {
+    throw new Error("Invalid registry cache metadata");
+  }
+  return value;
+}
+var DEFAULT_REGISTRY_CACHE_STORAGE_KEY = "tinycloud.registryCache.v2";
+function createLocalStorageRegistryCacheStore(storage, storageKey = DEFAULT_REGISTRY_CACHE_STORAGE_KEY) {
+  const browserGlobal = globalThis;
+  const backing = storage ?? browserGlobal.localStorage;
+  if (!backing) return createInMemoryRegistryCacheStore();
+  const read2 = (key) => {
+    const raw = backing.getItem(`${storageKey}:${key}`);
+    if (raw === null) return void 0;
+    const parsed = JSON.parse(raw);
+    return validateRegistryCacheRecord(parsed, key);
+  };
+  let tail = Promise.resolve();
+  return {
+    async get(key) {
+      await tail;
+      const record2 = read2(key);
+      return record2 && "invalidated" in record2 ? void 0 : record2;
+    },
+    async getRevision(key) {
+      await tail;
+      return read2(key)?.revision ?? 0;
+    },
+    update(key, update) {
+      const commit = async () => {
+        const record2 = read2(key);
+        const revision = record2?.revision ?? 0;
+        const entry = { ...await update(record2 && "invalidated" in record2 ? void 0 : record2, revision), revision };
+        backing.setItem(`${storageKey}:${key}`, JSON.stringify(entry));
+        return entry;
+      };
+      const next = tail.then(() => {
+        const navigator = globalThis.navigator;
+        const locks = navigator?.locks;
+        if (!locks) throw new Error("Persistent registry cache requires Web Locks");
+        return locks.request(`${storageKey}:${key}`, commit);
+      });
+      tail = next.catch(() => void 0);
+      return next;
+    },
+    delete(key, expectedRevision, maximumSequence) {
+      const next = tail.then(async () => {
+        const navigator = globalThis.navigator;
+        if (!navigator?.locks) throw new Error("Persistent registry cache requires Web Locks");
+        await navigator.locks.request(`${storageKey}:${key}`, async () => {
+          const record2 = read2(key);
+          const revision = record2?.revision ?? 0;
+          if (expectedRevision !== void 0 && (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0 || expectedRevision !== revision)) {
+            throw new Error("Registry cache revision changed before invalidation");
+          }
+          if (maximumSequence !== void 0 && (!Number.isSafeInteger(maximumSequence) || maximumSequence < 0 || record2 !== void 0 && !("invalidated" in record2) && record2.sequence > maximumSequence)) {
+            throw new Error("Registry cache sequence advanced before invalidation");
+          }
+          if (revision === Number.MAX_SAFE_INTEGER) throw new Error("Registry cache revision overflow");
+          backing.setItem(`${storageKey}:${key}`, JSON.stringify({ ownerKey: key, revision: revision + 1, invalidated: true }));
+        });
+      });
+      tail = next.catch(() => void 0);
+      return next;
+    }
+  };
+}
+async function verifyRegistryCacheEntry(subject, ownerKey, entry, rememberedSequence) {
+  if (!entry || ownerKey !== registryOwnerKeyV2(subject) || entry.ownerKey !== ownerKey || typeof entry.responseBody !== "string" || !Number.isSafeInteger(entry.fetchedAt) || entry.fetchedAt < 0 || !Number.isSafeInteger(entry.sequence) || entry.sequence < 0 || entry.revision !== void 0 && (!Number.isSafeInteger(entry.revision) || entry.revision < 0)) {
+    throw new Error("Invalid registry cache metadata");
+  }
+  const verdict = await classifyRegistryLookup(subject, { kind: "http", status: 200, body: entry.responseBody }, {
+    recordVersion: 2,
+    rememberedSequence
+  });
+  if (verdict.status !== "registered" || verdict.sequence !== entry.sequence || !verdict.record) {
+    throw new Error("Registry cache verification failed");
+  }
+  return verdict;
+}
+
 // src/registry-policy.ts
 var DEFAULT_REGISTRY_OWNER_CHAIN_ID = 1;
 var DEFAULT_NEW_USER_HOST = DEFAULT_TINYCLOUD_FALLBACK_HOST;
 var DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS = 3e3;
-var DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY = "tinycloud.registrySequences.v1";
+var DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY = "tinycloud.registrySequences.v2";
+var REGISTRY_CACHE_MAX_AGE_MS = 36e5;
 var MAX_SUBJECT_LENGTH = 74;
 function registryOwnerSubjectV1(address, registryChainId = DEFAULT_REGISTRY_OWNER_CHAIN_ID) {
   return pkhDid(address, registryChainId);
@@ -19870,33 +20380,272 @@ function createLocalStorageRegistrySequenceStore(storage, storageKey = DEFAULT_R
     },
     set: async (subject, sequence) => {
       await memory.set(subject, sequence);
-      const sequences = read2();
-      if ((sequences.get(subject) ?? -1) >= sequence) return;
-      sequences.set(subject, sequence);
-      backing.setItem(storageKey, JSON.stringify(Object.fromEntries(sequences)));
+      const navigator = globalThis.navigator;
+      const locks = navigator?.locks;
+      if (!locks) throw new Error("Persistent registry sequence store requires Web Locks");
+      await locks.request(storageKey, async () => {
+        const remembered = await memory.get(subject);
+        const sequences = read2();
+        const previous = sequences.get(subject);
+        const highest = Math.max(previous ?? -1, remembered ?? -1, sequence);
+        await memory.set(subject, highest);
+        if (previous !== void 0 && previous >= highest) return;
+        sequences.set(subject, highest);
+        backing.setItem(storageKey, JSON.stringify(Object.fromEntries(sequences)));
+      });
     }
   };
 }
 function isSequence(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
-async function resolveOwnerHosts(subject, options2 = {}) {
-  if (typeof subject !== "string" || // Bounds the work below; covers any did:pkh with a safe-integer chain ID.
-  subject.length > MAX_SUBJECT_LENGTH || !isCanonicalSubject(subject)) {
+function assertRegistrySubject(subject) {
+  if (typeof subject !== "string" || subject.length > MAX_SUBJECT_LENGTH || !isCanonicalSubject(subject)) {
     throw new RegistryLookupInputError(
       "invalid-subject",
       "subject must be did:pkh:eip155:<chainId>:<EIP-55 address> or an Ed25519 did:key"
     );
   }
+}
+async function resolveOwnerHosts(subject, options2 = {}) {
+  assertRegistrySubject(subject);
+  const ownerKey = registryOwnerKeyV2(subject);
+  const store = options2.sequenceStore;
+  const remembered = store === void 0 ? void 0 : await store.get(ownerKey);
+  const cache2 = options2.cacheStore;
+  const authority = cache2 ? cacheAuthority(cache2, ownerKey) : void 0;
+  const highWater = Math.max(remembered ?? -1, authority?.sequence ?? -1);
+  if (cache2) {
+    const cached = await cache2.get(ownerKey);
+    if (cached !== void 0) {
+      const verdict = await verifyRegistryCacheEntry(subject, ownerKey, cached, highWater < 0 ? void 0 : highWater);
+      authority.sequence = Math.max(highWater, verdict.sequence);
+      await rememberAcceptedSequence(store, ownerKey, remembered, verdict);
+    }
+    return refreshCachedOwnerRegistry(subject, options2, cache2, ownerKey, Math.max(highWater, authority.sequence) < 0 ? void 0 : Math.max(highWater, authority.sequence));
+  }
+  return (await fetchOwnerRegistry(subject, options2, remembered)).verdict;
+}
+var cacheAuthorities = /* @__PURE__ */ new WeakMap();
+var verdictRevisions = /* @__PURE__ */ new WeakMap();
+function cacheAuthority(cache2, key) {
+  let owners = cacheAuthorities.get(cache2);
+  if (!owners) cacheAuthorities.set(cache2, owners = /* @__PURE__ */ new Map());
+  let authority = owners.get(key);
+  if (!authority) owners.set(key, authority = { sequence: -1, invalidated: false, invalidationAttempt: 0 });
+  return authority;
+}
+var refreshes = /* @__PURE__ */ new WeakMap();
+async function refreshOwnerRegistry(subject, options2) {
+  return resolveOwnerHosts(subject, options2);
+}
+async function refreshCachedOwnerRegistry(subject, options2, cache2, key, remembered) {
+  let active = refreshes.get(cache2);
+  if (!active) refreshes.set(cache2, active = /* @__PURE__ */ new Map());
+  let next = active.get(key);
+  if (!next) {
+    next = (async () => {
+      const current2 = await cache2.get(key);
+      if (current2 !== void 0) {
+        const verified = await verifyRegistryCacheEntry(subject, key, current2, remembered);
+        await rememberAcceptedSequence(options2.sequenceStore, key, remembered, verified);
+      }
+      const highWater2 = Math.max(remembered ?? -1, current2?.sequence ?? -1);
+      return fetchOwnerRegistry(subject, options2, highWater2 < 0 ? void 0 : highWater2, current2);
+    })();
+    active.set(key, next);
+    void next.finally(() => active.delete(key)).catch(() => void 0);
+  }
+  const { verdict, allowCached, revision, invalidationAttempt } = await next;
+  if (verdict.status === "unavailable" && !allowCached) return verdict;
+  const current = await cache2.get(key);
+  const latest = await options2.sequenceStore?.get(key);
+  const authority = cacheAuthority(cache2, key);
+  const highWater = Math.max(remembered ?? -1, latest ?? -1, authority.sequence);
+  assertRegistryRevision(subject, await cache2.getRevision(key), revision);
+  assertInvalidationAttempt(subject, authority.invalidationAttempt, invalidationAttempt);
+  if (current !== void 0) {
+    const verified = await verifyRegistryCacheEntry(subject, key, current, highWater < 0 ? void 0 : highWater);
+    authority.sequence = Math.max(highWater, verified.sequence);
+    await rememberAcceptedSequence(options2.sequenceStore, key, latest, verified);
+    assertRegistryRevision(subject, await cache2.getRevision(key), revision);
+    assertInvalidationAttempt(subject, authority.invalidationAttempt, invalidationAttempt);
+    if (verdict.status === "unavailable") {
+      const age = Date.now() - current.fetchedAt;
+      if (!allowCached || authority.invalidated || age < 0 || age >= REGISTRY_CACHE_MAX_AGE_MS) return verdict;
+      const fallback = { ...verified, offline: true };
+      verdictRevisions.set(fallback, revision);
+      return fallback;
+    }
+    verdictRevisions.set(verified, revision);
+    return verified;
+  }
+  if (verdict.status === "unavailable") return verdict;
+  if (verdict.status === "registered") {
+    if (verdict.sequence < highWater) return {
+      status: "unavailable",
+      subject,
+      source: "offchain",
+      reason: "rollback",
+      message: `registry refresh sequence ${verdict.sequence} is below remembered sequence ${highWater}`,
+      hosts: []
+    };
+    await rememberAcceptedSequence(options2.sequenceStore, key, latest, verdict);
+    assertRegistryRevision(subject, await cache2.getRevision(key), revision);
+    assertInvalidationAttempt(subject, authority.invalidationAttempt, invalidationAttempt);
+    verdictRevisions.set(verdict, revision);
+    return verdict;
+  }
+  if (highWater >= 0) return {
+    status: "unavailable",
+    subject,
+    source: "offchain",
+    reason: "not-found-after-registered",
+    message: "owner registration was remembered before registry absence could authorize onboarding",
+    hosts: []
+  };
+  return verdict;
+}
+function assertRegistryRevision(subject, actual, expected) {
+  if (!isSequence(actual) || actual !== expected) {
+    throw new RegistryUnavailableError(subject, void 0, {
+      message: "owner routing was invalidated while the registry lookup was in flight"
+    });
+  }
+}
+function assertInvalidationAttempt(subject, actual, expected) {
+  if (!isSequence(actual) || actual !== expected) {
+    throw new RegistryUnavailableError(subject, void 0, {
+      message: "owner routing invalidation was attempted while the registry lookup was in flight"
+    });
+  }
+}
+async function fetchOwnerRegistry(subject, options2, remembered, cached) {
+  const ownerKey = registryOwnerKeyV2(subject);
   const store = options2.sequenceStore;
-  const remembered = store === void 0 ? void 0 : await store.get(subject);
   const registryUrl = options2.registryUrl ?? DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL;
-  const url = `${registryUrl.replace(/\/$/, "")}/v1/locations/${encodeURIComponent(subject)}`;
-  const observed = await observeRegistry(
-    url,
-    options2.fetch ?? globalThis.fetch,
-    options2.timeoutMs ?? DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS
-  );
+  const baseUrl = registryUrl.replace(/\/$/, "");
+  const fetchFn = options2.fetch ?? globalThis.fetch;
+  const timeoutMs = options2.timeoutMs ?? DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS;
+  const authority = options2.cacheStore ? cacheAuthority(options2.cacheStore, ownerKey) : void 0;
+  const invalidationAttempt = authority?.invalidationAttempt;
+  const revision = options2.cacheStore ? await options2.cacheStore.getRevision(ownerKey) : void 0;
+  if (options2.cacheStore && !isSequence(revision)) throw new RegistryUnavailableError(subject, void 0, {
+    message: "invalid registry cache revision"
+  });
+  if (revision !== void 0 && revision > 0) remembered = Math.max(remembered ?? -1, 0);
+  if (authority) assertInvalidationAttempt(subject, authority.invalidationAttempt, invalidationAttempt);
+  const observation = await observeRegistry(`${baseUrl}/v2/locations/${encodeURIComponent(ownerKey)}`, fetchFn, timeoutMs);
+  const v2 = await classifyObservation(subject, observation, 2, remembered ?? null);
+  if (v2.status === "registered" && options2.cacheStore && observation.kind === "http") {
+    const candidate = { ownerKey, responseBody: observation.body, fetchedAt: Date.now(), sequence: v2.sequence };
+    let accepted;
+    let equalSequenceConflict = false;
+    try {
+      accepted = await options2.cacheStore.update(ownerKey, async (current, currentRevision) => {
+        assertRegistryRevision(subject, currentRevision, revision);
+        assertInvalidationAttempt(subject, authority.invalidationAttempt, invalidationAttempt);
+        const highest = Math.max(await store?.get(ownerKey) ?? -1, authority.sequence);
+        const highWater = highest < 0 ? void 0 : highest;
+        if (current !== void 0) {
+          const previous = await verifyRegistryCacheEntry(subject, ownerKey, current, highWater);
+          assertInvalidationAttempt(subject, authority.invalidationAttempt, invalidationAttempt);
+          if (v2.sequence < previous.sequence) return current;
+          if (v2.sequence === previous.sequence) {
+            if (canonicalLocationPayloadV2(v2.record) !== canonicalLocationPayloadV2(previous.record)) {
+              equalSequenceConflict = true;
+              throw new RegistryUnavailableError(subject, void 0, {
+                message: "equal-sequence registry response changes the accepted signed payload"
+              });
+            }
+            return { ...current, fetchedAt: candidate.fetchedAt };
+          }
+        }
+        await verifyRegistryCacheEntry(subject, ownerKey, candidate, highWater);
+        assertInvalidationAttempt(subject, authority.invalidationAttempt, invalidationAttempt);
+        return candidate;
+      });
+    } catch (error) {
+      if (equalSequenceConflict) await dropOwnerRegistryCache(subject, options2.cacheStore, store, ownerKey, v2.sequence, revision);
+      throw error;
+    }
+    const verdict = await verifyRegistryCacheEntry(subject, ownerKey, accepted);
+    assertInvalidationAttempt(subject, authority.invalidationAttempt, invalidationAttempt);
+    authority.sequence = Math.max(authority.sequence, verdict.sequence);
+    authority.invalidated = false;
+    await rememberAcceptedSequence(store, ownerKey, remembered, verdict);
+    return { verdict, revision, invalidationAttempt };
+  }
+  if (options2.cacheStore && (cached !== void 0 || remembered !== void 0) && observation.kind === "http" && observation.status >= 400 && observation.status < 500) {
+    await dropOwnerRegistryCache(subject, options2.cacheStore, store, ownerKey, Math.max(remembered ?? 0, cached?.sequence ?? 0), revision);
+  }
+  const fresh = cached === void 0 && remembered === void 0;
+  const coldOffline = fresh && v2.status === "unavailable" && registryOutage(observation);
+  if (v2.status !== "unregistered" && !coldOffline) {
+    await rememberAcceptedSequence(store, ownerKey, remembered, v2);
+    const allowCached = v2.status === "unavailable" && (observation.kind === "network-error" || observation.kind === "timeout" || observation.kind === "http" && [502, 503, 504].includes(observation.status));
+    return { verdict: v2, allowCached, revision, invalidationAttempt };
+  }
+  const v1Subject = legacyRegistrySubject(subject, options2.registryChainId);
+  const v1Observation = await observeRegistry(`${baseUrl}/v1/locations/${encodeURIComponent(v1Subject)}`, fetchFn, timeoutMs);
+  const v1 = await classifyObservation(v1Subject, v1Observation, 1, null);
+  if (v1.status === "registered") {
+    await store?.set(ownerKey, Math.max(remembered ?? 0, 0));
+    return { verdict: {
+      status: "unavailable",
+      subject,
+      source: "offchain",
+      reason: "unsupported-format",
+      message: "owner has a v1 location record but no signed-v2 routing record",
+      hosts: []
+    }, revision, invalidationAttempt };
+  }
+  const legacyOffline = fresh && v1.status === "unavailable" && registryOutage(v1Observation);
+  if (v1.status === "unavailable" && !legacyOffline) return { verdict: { ...v1, subject }, revision, invalidationAttempt };
+  return { verdict: { status: "unregistered", subject, source: "offchain", hosts: [], ...coldOffline || legacyOffline ? { offline: true } : {} }, revision, invalidationAttempt };
+}
+async function dropOwnerRegistryCache(subject, cache2, store, key, sequence, expectedRevision) {
+  if (!isSequence(expectedRevision)) throw new RegistryUnavailableError(subject, void 0, {
+    message: "registry invalidation has no accepted origin revision"
+  });
+  const authority = cacheAuthority(cache2, key);
+  authority.sequence = Math.max(authority.sequence, sequence);
+  authority.invalidated = true;
+  authority.invalidationAttempt++;
+  try {
+    if (store) await store.set(key, Math.max(authority.sequence, await store.get(key) ?? -1));
+    await cache2.delete(key, expectedRevision, sequence);
+  } catch (cause) {
+    throw new RegistryUnavailableError(subject, void 0, { message: "cached storage settings could not be invalidated", cause });
+  }
+}
+var sequenceWriteWarned = false;
+function registryOutage(observation) {
+  return observation.kind === "network-error" || observation.kind === "timeout" || observation.kind === "http" && observation.status >= 500 && observation.status < 600;
+}
+var fallbackWarnings = /* @__PURE__ */ new WeakMap();
+function warnRegistryDefaultNode(verdict, cacheStore, onRegistryFallback) {
+  if (verdict.status !== "unregistered" || !verdict.offline) return;
+  warnRegistryFallback(verdict.subject, "using_default_node", cacheStore, onRegistryFallback);
+}
+function warnRegistryCachedSettings(verdict, options2) {
+  if (verdict.status === "registered" && verdict.offline) {
+    warnRegistryFallback(verdict.subject, "using_cached_settings", options2.cacheStore, options2.onRegistryFallback);
+  }
+}
+function warnRegistryFallback(subject, code3, cacheStore, onRegistryFallback) {
+  if (cacheStore) {
+    const key = `${code3}:${registryOwnerKeyV2(subject)}`;
+    let warned = fallbackWarnings.get(cacheStore);
+    if (!warned) fallbackWarnings.set(cacheStore, warned = /* @__PURE__ */ new Set());
+    if (warned.has(key)) return;
+    warned.add(key);
+  }
+  const reason = code3 === "using_default_node" ? "registry unavailable; using the default node" : "Storage settings are unreachable; using cached settings checked less than 1 hour ago.";
+  if (onRegistryFallback) onRegistryFallback(reason, code3);
+  else console.warn(reason);
+}
+async function classifyObservation(subject, observed, recordVersion, rememberedSequence) {
   if (observed.kind === "oversize" || observed.kind === "invalid-utf8") {
     const oversize = observed.kind === "oversize";
     return {
@@ -19908,22 +20657,23 @@ async function resolveOwnerHosts(subject, options2 = {}) {
       hosts: []
     };
   }
-  const verdict = await classifyRegistryLookup(subject, observed, {
-    rememberedSequence: remembered ?? null
-  });
-  if (store !== void 0 && verdict.status === "registered" && (remembered === void 0 || verdict.sequence > remembered)) {
-    try {
-      await store.set(subject, verdict.sequence);
-    } catch (error) {
-      if (!sequenceWriteWarned) {
-        sequenceWriteWarned = true;
-        console.warn("[tinycloud:registry] could not remember the registry sequence:", error);
-      }
+  return classifyRegistryLookup(subject, observed, { rememberedSequence, recordVersion });
+}
+async function rememberAcceptedSequence(store, ownerKey, remembered, verdict) {
+  if (store === void 0 || verdict.status !== "registered" || remembered !== void 0 && verdict.sequence <= remembered) return;
+  try {
+    await store.set(ownerKey, verdict.sequence);
+  } catch (error) {
+    if (!sequenceWriteWarned) {
+      sequenceWriteWarned = true;
+      console.warn("[tinycloud:registry] could not remember the registry sequence:", error);
     }
   }
-  return verdict;
 }
-var sequenceWriteWarned = false;
+function legacyRegistrySubject(subject, registryChainId) {
+  if (subject.startsWith("did:key:")) return subject;
+  return registryOwnerSubjectV1(subject.slice(subject.lastIndexOf(":") + 1), registryChainId);
+}
 async function observeRegistry(url, fetchFn, timeoutMs) {
   const controller = new AbortController();
   let cancelTimer = () => void 0;
@@ -19945,6 +20695,8 @@ async function readRegistry(url, fetchFn, signal) {
   try {
     response = await fetchFn(url, {
       redirect: "error",
+      // A browser-cached HTTP 200 must not renew signed-cache freshness.
+      cache: "no-store",
       headers: { accept: "application/json" },
       signal
     });
@@ -19966,7 +20718,7 @@ async function readRegistry(url, fetchFn, signal) {
     return {
       kind: "http",
       status: response.status,
-      body: new TextDecoder("utf-8", { fatal: true }).decode(bytes2)
+      body: new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes2)
     };
   } catch {
     return { kind: "invalid-utf8" };
@@ -20014,8 +20766,10 @@ async function lookupOwnerRegistryVerdict(subject, options2 = {}) {
     return await resolveOwnerHosts(subject, {
       registryUrl: options2.registryUrl,
       sequenceStore: options2.sequenceStore,
+      cacheStore: options2.cacheStore,
       fetch: options2.fetch,
-      timeoutMs: options2.timeoutMs
+      timeoutMs: options2.timeoutMs,
+      registryChainId: options2.registryChainId
     });
   } catch (error) {
     throw new RegistryUnavailableError(subject, void 0, {
@@ -20024,35 +20778,81 @@ async function lookupOwnerRegistryVerdict(subject, options2 = {}) {
     });
   }
 }
+async function resolveRegistryResource(subject, resource, access, options2) {
+  const verdict = await lookupOwnerRegistryVerdict(subject, options2);
+  if (verdict.status === "unregistered") return { verdict, hosts: [] };
+  if (verdict.status === "unavailable") throw new RegistryUnavailableError(subject, verdict);
+  const record2 = verdict.record;
+  if (record2 === void 0) {
+    throw new RegistryUnavailableError(subject, void 0, {
+      message: "registered owner has no verified v2 routing record"
+    });
+  }
+  const denyRoute = async () => {
+    if (options2.cacheStore) {
+      await dropOwnerRegistryCache(subject, options2.cacheStore, options2.sequenceStore, registryOwnerKeyV2(subject), verdict.sequence, verdictRevisions.get(verdict));
+    }
+    throw new NodeNotFoundError(subject, verdict);
+  };
+  let targetDids;
+  if (access === "encryption") {
+    if (record2.encryptionNode === null) return denyRoute();
+    targetDids = [record2.encryptionNode];
+  } else {
+    const space = record2.spaces.find(({ space: signedSpace }) => sameSpaceIdentifier(signedSpace, resource));
+    if (space === void 0) return denyRoute();
+    targetDids = space.nodes.filter(({ mode }) => access !== "write" || mode === "read-write").map(({ did }) => did);
+  }
+  const nodeByDid = new Map(record2.nodes.map((node) => [node.did, node.url]));
+  const hosts = targetDids.map((nodeDid) => {
+    const url = nodeByDid.get(nodeDid);
+    if (url === void 0) {
+      throw new RegistryUnavailableError(subject, void 0, {
+        message: "verified membership references a missing node"
+      });
+    }
+    return { nodeDid, urls: [url], source: "offchain" };
+  });
+  if (hosts.length === 0) return denyRoute();
+  warnRegistryCachedSettings(verdict, options2);
+  return { verdict, hosts };
+}
+function sameSpaceIdentifier(signedSpace, requestedSpace) {
+  const signed = /^tinycloud:pkh:eip155:([1-9][0-9]*):(0x[a-fA-F0-9]{40}):([^/?#\s]+)$/.exec(signedSpace);
+  const requested = /^tinycloud:pkh:eip155:([1-9][0-9]*):(0x[a-fA-F0-9]{40}):([^/?#\s]+)$/.exec(requestedSpace);
+  if (signed === null || requested === null) return signedSpace === requestedSpace;
+  return signed[1] === requested[1] && signed[2].toLowerCase() === requested[2].toLowerCase() && signed[3] === requested[3];
+}
 async function resolveFailClosedTinyCloudHosts(address, options2 = {}) {
   const newUserHost = options2.newUserHost === null ? null : exactHttpOrigin(options2.newUserHost ?? DEFAULT_NEW_USER_HOST, "newUserHost");
   const subject = registryOwnerSubjectV1(address, options2.registryChainId);
   const resolve = async () => {
-    let verdict;
-    let unavailable;
+    const verdict = await lookupOwnerRegistryVerdict(subject, options2);
+    if (verdict.status === "unregistered" && (options2.autoDiscoverLocalNode ?? true)) {
+      const local = await discoverLocalTinyCloudNode({
+        localNodeUrl: options2.localNodeUrl,
+        localLinkName: options2.localLinkName,
+        expectedNodeDid: options2.expectedNodeDid,
+        identityStore: options2.localNodeIdentityStore,
+        fetch: options2.fetch
+      });
+      if (local) {
+        warnRegistryDefaultNode(verdict, options2.cacheStore, options2.onRegistryFallback);
+        return { hosts: [local.url], verdict };
+      }
+    }
+    let hosts;
     try {
-      verdict = await lookupOwnerRegistryVerdict(subject, options2);
+      hosts = hostsForVerdict(verdict, newUserHost);
     } catch (error) {
-      if (!(error instanceof RegistryUnavailableError)) throw error;
-      unavailable = error;
-    }
-    if (options2.autoDiscoverLocalNode ?? true) {
-      const linkNames = verdict?.status === "registered" ? secureRecordHosts(verdict).flatMap((host) => LOCAL_LINK_ORIGIN.exec(host)?.[1] ?? []) : [];
-      for (const candidate of [
-        { localNodeUrl: options2.localNodeUrl, localLinkName: options2.localLinkName },
-        ...linkNames.map((localLinkName) => ({ localLinkName }))
-      ]) {
-        const local = await discoverLocalTinyCloudNode({
-          ...candidate,
-          expectedNodeDid: options2.expectedNodeDid,
-          identityStore: options2.localNodeIdentityStore,
-          fetch: options2.fetch
-        });
-        if (local) return { hosts: [local.url], ...verdict === void 0 ? {} : { verdict } };
+      if (error instanceof NodeNotFoundError && error.verdict.status === "registered" && options2.cacheStore) {
+        await dropOwnerRegistryCache(subject, options2.cacheStore, options2.sequenceStore, registryOwnerKeyV2(subject), error.verdict.sequence, verdictRevisions.get(error.verdict));
       }
+      throw error;
     }
-    if (verdict === void 0) throw unavailable;
-    return { hosts: hostsForVerdict(verdict, newUserHost), verdict };
+    warnRegistryCachedSettings(verdict, options2);
+    warnRegistryDefaultNode(verdict, options2.cacheStore, options2.onRegistryFallback);
+    return { hosts, verdict };
   };
   for (let attempt = 1; ; attempt++) {
     let failure;
@@ -20070,10 +20870,12 @@ async function resolveFailClosedTinyCloudHosts(address, options2 = {}) {
       case "retry":
         continue;
       case "use-host":
-        return {
-          hosts: [exactHttpOrigin(decision.host, "onNodeNotFound host")],
-          ...failure.verdict === void 0 ? {} : { verdict: failure.verdict }
-        };
+        if (!(failure instanceof NodeNotFoundError) || failure.verdict.status !== "unregistered") {
+          throw failure;
+        }
+        const host = exactHttpOrigin(decision.host, "onNodeNotFound host");
+        warnRegistryDefaultNode(failure.verdict, options2.cacheStore, options2.onRegistryFallback);
+        return { hosts: [host], verdict: failure.verdict };
       case "abort":
         throw failure;
       default:
@@ -20081,7 +20883,6 @@ async function resolveFailClosedTinyCloudHosts(address, options2 = {}) {
     }
   }
 }
-var LOCAL_LINK_ORIGIN = /^https:\/\/([a-z0-9-]+)\.local\.tinycloud\.link$/;
 function secureRecordHosts(verdict) {
   const hosts = /* @__PURE__ */ new Set();
   for (const host of verdict.hosts) {
@@ -20108,7 +20909,7 @@ function hostsForVerdict(verdict, newUserHost) {
       throw new RegistryUnavailableError(verdict.subject, verdict);
   }
 }
-function assertSpaceCreationAllowed(verdict, host) {
+function assertSpaceCreationAllowed(verdict, host, spaceId) {
   switch (verdict.status) {
     case "unregistered":
       return;
@@ -20116,7 +20917,14 @@ function assertSpaceCreationAllowed(verdict, host) {
       throw new RegistryUnavailableError(verdict.subject, verdict);
     case "registered": {
       const origin2 = httpOrigin(host);
-      if (origin2 !== void 0 && secureRecordHosts(verdict).includes(origin2)) {
+      if (origin2 !== void 0 && verdict.record !== void 0) {
+        const space = spaceId === void 0 ? void 0 : verdict.record.spaces.find(({ space: signedSpace }) => sameSpaceIdentifier(signedSpace, spaceId));
+        const memberNodes = new Set(
+          space?.nodes.map(({ did }) => did) ?? []
+        );
+        const spaceHosts = verdict.record.nodes.filter(({ did }) => memberNodes.has(did)).map(({ url }) => httpOrigin(url));
+        if (spaceHosts.includes(origin2)) return;
+      } else if (origin2 !== void 0 && secureRecordHosts(verdict).includes(origin2)) {
         return;
       }
       throw new NodeRegistryEntryExistsError(verdict.subject, host, verdict);