@tinycloud/sdk-core 3.3.0-beta.18 → 3.3.0-beta.21

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { br as CredentialHolderBinding, bs as CredentialFlowDescriptor, bt as CredentialRequirement, bu as StoredCredentialRecord, bv as VerifiedCredential, bw as CredentialStorageReceipt, bx as IssuedCredentialEnvelope, by as CredentialIssuerMetadata } from './credential-admission-Cg1M9uyV.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bz as CREDENTIAL_ACQUISITION_PROTOCOL, bA as CREDENTIAL_CONTRACT_VERSION, bB as CREDENTIAL_FORMAT, bz as CREDENTIAL_PROTOCOL, bC as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bD as CredentialClaimDescriptor, bE as CredentialEndpointId, bF as CredentialInputDescriptor, bG as CredentialProgressEvent, bH as CredentialStepDescriptor, bI as CredentialStepType, bJ as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bK as HOLDER_BINDING_DOMAIN, bL as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from './credential-admission-Cg1M9uyV.cjs';
+import { br as CredentialHolderBinding, bs as CredentialFlowDescriptor, bt as CredentialRequirement, bu as StoredCredentialRecord, bv as VerifiedCredential, bw as CredentialStorageReceipt, bx as IssuedCredentialEnvelope, by as CredentialIssuerMetadata } from './credential-admission-CIMA0jGE.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bz as CREDENTIAL_ACQUISITION_PROTOCOL, bA as CREDENTIAL_CONTRACT_VERSION, bB as CREDENTIAL_FORMAT, bz as CREDENTIAL_PROTOCOL, bC as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bD as CredentialClaimDescriptor, bE as CredentialEndpointId, bF as CredentialInputDescriptor, bG as CredentialProgressEvent, bH as CredentialStepDescriptor, bI as CredentialStepType, bJ as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bK as HOLDER_BINDING_DOMAIN, bL as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from './credential-admission-CIMA0jGE.cjs';
 export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { AuthorityRefusal, AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, IStorageService, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListPage, KVListResponse, KVPutOptions, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PinnedKey, PrefixedKVService, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedReplicationOptions, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageFullHandler, StorageFullMonitor, StorageRejectionDetails, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, appSecretScope, authorizationVerdictOf, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, isStorageFullError, networkDiscoveryKey, ok, openWrappedKey, parseCapabilityResource, parseNetworkId, parseSecretCatalogKey, parseStorageRejection, parseStorageStatus, resolveSecretListPrefix, resolveSecretPath, serviceError, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validatedCapabilityOf, verifyDecryptResponse } from '@tinycloud/sdk-services';
@@ -8,7 +8,7 @@ export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, L
 import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-CPDoAVh4.cjs';
 export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-CPDoAVh4.cjs';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
-export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.cjs';
+export { b as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BA49Uboq.cjs';
 export { SiweMessage } from 'siwe';
 
 /**
@@ -3609,8 +3609,9 @@ declare function verifyDidKeyEd25519Signature(did: string, payload: Uint8Array,
  *   closed here.
  *
  * {@link classifyRegistryLookup} is a pure classifier over one registry
- * response. It performs no I/O and is not used by host resolution yet. Its
- * rules are written to be portable: the shared vectors in
+ * response. It performs no I/O; `resolveOwnerHosts` (`registry-policy.ts`)
+ * does the lookup for the opt-in `fail-closed` registry policy. The
+ * classifier's rules are written to be portable: the shared vectors in
  * `test-vectors/registry-verdict/` state them for other implementations.
  */
 type RegistryVerdictStatus = "registered" | "unregistered" | "unavailable";
@@ -3729,6 +3730,202 @@ declare const REGISTRY_NOT_FOUND_BODY = "{\"error\":\"location record not found\
  */
 declare function classifyRegistryLookup(subject: string, response: RegistryLookupResponse, options?: ClassifyRegistryLookupOptions): Promise<RegistryVerdict>;
 
+/**
+ * Registry policy for host resolution and space creation (TC-1443).
+ *
+ * - `legacy-fallback` (the default, deprecated): {@link resolveTinyCloudHosts}
+ *   as before. A registry miss or failure silently routes to the hosted
+ *   fallback node, with a one-time deprecation warning.
+ * - `fail-closed` (opt-in): routing and space creation act on the three-state
+ *   registry verdict. `unavailable` is never treated as `unregistered`.
+ *
+ * Registry lookups key on the owner's signer address, never the session
+ * chain. The v1 registry stores records under an exact
+ * `did:pkh:eip155:<chain>:<EIP-55 address>` subject, so v1 lookups use
+ * {@link registryOwnerSubjectV1} with a configured chain (default 1). Registry
+ * v2 keys owner records on the EIP-55 address alone, chain-independent.
+ */
+
+type RegistryPolicy = "legacy-fallback" | "fail-closed";
+/** Chain of the v1 registry subject when none is configured. */
+declare const DEFAULT_REGISTRY_OWNER_CHAIN_ID = 1;
+/** Host for `unregistered` owners under `fail-closed` when none is configured. */
+declare const DEFAULT_NEW_USER_HOST = "https://node.tinycloud.xyz";
+/** Budget for one registry lookup, covering the request and the body. */
+declare const DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS = 3000;
+/** Default key {@link createLocalStorageRegistrySequenceStore} stores its sequences under. */
+declare const DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY = "tinycloud.registrySequences.v1";
+/**
+ * The v1 registry subject for an owner: `did:pkh:eip155:<registryChainId>:<EIP-55 address>`.
+ *
+ * Built from the signer address and a configured chain, never from the
+ * session chain, so switching wallet chains never changes the lookup. Registry
+ * v2 will key on the EIP-55 address alone.
+ */
+declare function registryOwnerSubjectV1(address: string, registryChainId?: number): string;
+/**
+ * The highest registry record sequence accepted per subject. A remembered
+ * sequence marks the subject as registered: a later not-found or an older
+ * record is `unavailable`, never `unregistered`.
+ *
+ * `set` is only called with a sequence above the remembered one. A `get`
+ * failure fails that lookup closed (`RegistryUnavailableError`, never
+ * "nothing remembered"). A `set` failure is logged once and the verdict in
+ * hand stands: failing to remember weakens later rollback detection but
+ * never turns a correct `registered` answer into a lockout.
+ */
+interface RegistrySequenceStore {
+    get(subject: string): number | undefined | Promise<number | undefined>;
+    set(subject: string, sequence: number): void | Promise<void>;
+}
+/** In-memory {@link RegistrySequenceStore}. Does not persist across process restarts. */
+declare function createInMemoryRegistrySequenceStore(): RegistrySequenceStore;
+/**
+ * `localStorage`-backed {@link RegistrySequenceStore}, one JSON object under
+ * `storageKey`. Falls back to an in-memory store when `localStorage` is
+ * unavailable. Sequences are also kept in memory, so a failed write (full or
+ * read-only storage) is still remembered for this page. A storage read that
+ * throws, or a corrupt stored value, throws instead of being reset:
+ * forgetting a sequence would let a registry not-found read as
+ * `unregistered`. Remove `storageKey` to reset.
+ */
+declare function createLocalStorageRegistrySequenceStore(storage?: WebStorageLike, storageKey?: string): RegistrySequenceStore;
+interface ResolveOwnerHostsOptions {
+    /** Location registry base URL. Default https://registry.tinycloud.xyz. */
+    registryUrl?: string;
+    /** Remembered sequences. Omit to remember nothing. */
+    sequenceStore?: RegistrySequenceStore;
+    /** Custom fetch implementation. Defaults to globalThis.fetch. */
+    fetch?: typeof fetch;
+    /** Lookup budget in milliseconds. Default {@link DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS}. */
+    timeoutMs?: number;
+}
+/**
+ * Look up `subject` in the off-chain v1 location registry and classify the
+ * answer with {@link classifyRegistryLookup}, using and updating the
+ * remembered sequence. Transport failures, timeouts and oversize or non-UTF-8
+ * bodies are `unavailable` verdicts. Performs no host probing and never
+ * applies a fallback.
+ *
+ * @throws RegistryLookupInputError if `subject` is not canonical or a
+ * remembered sequence is invalid. The subject is length-checked before any
+ * other parsing.
+ */
+declare function resolveOwnerHosts(subject: string, options?: ResolveOwnerHostsOptions): Promise<RegistryVerdict>;
+/** Sign-in found no usable host for a registered owner, or none for an unregistered owner when `newUserHost` is null. */
+declare class NodeNotFoundError extends Error {
+    readonly subject: string;
+    readonly verdict: RegisteredRegistryVerdict | UnregisteredRegistryVerdict;
+    readonly code: "node_not_found";
+    constructor(subject: string, verdict: RegisteredRegistryVerdict | UnregisteredRegistryVerdict);
+}
+/**
+ * The registry could not give a verdict: unreachable, timed out, an invalid
+ * or rolled-back answer, no registry configured, or a lookup that threw
+ * (`cause`). Never treated as "unregistered".
+ */
+declare class RegistryUnavailableError extends Error {
+    readonly subject: string;
+    readonly verdict: UnavailableRegistryVerdict | undefined;
+    readonly code: "registry_unavailable";
+    readonly cause?: unknown;
+    constructor(subject: string, verdict: UnavailableRegistryVerdict | undefined, detail?: {
+        message?: string;
+        cause?: unknown;
+    });
+}
+/** Space creation was refused: the owner's registry record does not list this host. */
+declare class NodeRegistryEntryExistsError extends Error {
+    readonly subject: string;
+    readonly host: string;
+    readonly verdict: RegisteredRegistryVerdict;
+    readonly code: "node_registry_entry_exists";
+    /** HTTPS or loopback origins the owner's record lists, in record order. */
+    readonly registeredHosts: string[];
+    constructor(subject: string, host: string, verdict: RegisteredRegistryVerdict);
+}
+interface LookupOwnerRegistryVerdictOptions {
+    /** Location registry base URL. `null` means none, which is `RegistryUnavailableError`. */
+    registryUrl?: string | null;
+    sequenceStore?: RegistrySequenceStore;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+/**
+ * {@link resolveOwnerHosts} for policy decisions: a lookup that throws, or no
+ * configured registry, becomes {@link RegistryUnavailableError}. An
+ * `unavailable` verdict is returned as a verdict.
+ */
+declare function lookupOwnerRegistryVerdict(subject: string, options?: LookupOwnerRegistryVerdictOptions): Promise<RegistryVerdict>;
+interface NodeNotFoundContext {
+    readonly error: NodeNotFoundError | RegistryUnavailableError;
+    /** 1 for the first failure, incremented after each `retry`. */
+    readonly attempt: number;
+}
+type NodeNotFoundDecision = {
+    readonly action: "retry";
+} | {
+    readonly action: "use-host";
+    readonly host: string;
+} | {
+    readonly action: "abort";
+};
+/**
+ * Decides what sign-in does when no host can be resolved under `fail-closed`:
+ * look up again, use another host, or abort with the error. A `use-host`
+ * host must be an HTTPS or loopback HTTP origin. The SDK does not verify its
+ * identity, and it persists with the session like any resolved host; space
+ * creation there still goes through the creation guard.
+ */
+type OnNodeNotFound = (context: NodeNotFoundContext) => NodeNotFoundDecision | Promise<NodeNotFoundDecision>;
+interface FailClosedHostOptions extends LookupOwnerRegistryVerdictOptions {
+    /** Chain of the v1 registry subject. Default {@link DEFAULT_REGISTRY_OWNER_CHAIN_ID}. */
+    registryChainId?: number;
+    /**
+     * Host for owners the registry reports as `unregistered`, and only them.
+     * Default {@link DEFAULT_NEW_USER_HOST}. `null`: unregistered owners get
+     * {@link NodeNotFoundError}.
+     */
+    newUserHost?: string | null;
+    /** Without a callback, resolution throws the error. */
+    onNodeNotFound?: OnNodeNotFound;
+    /**
+     * Probe local nodes before routing on the verdict. Default true. Only
+     * configured candidates (`localNodeUrl`, `localLinkName`) and
+     * `*.local.tinycloud.link` hosts from a `registered` verdict are probed.
+     */
+    autoDiscoverLocalNode?: boolean;
+    localNodeUrl?: string;
+    localLinkName?: string;
+    expectedNodeDid?: string;
+    localNodeIdentityStore?: LocalNodeIdentityStore;
+}
+interface FailClosedHosts {
+    hosts: string[];
+    /** The registry verdict behind `hosts`. Absent when a verified local node was used. */
+    verdict?: RegistryVerdict;
+}
+/**
+ * Resolve the hosts for `address` under the `fail-closed` policy. The
+ * registry verdict for {@link registryOwnerSubjectV1} comes first. Then a
+ * verified local node is used if one is configured or listed by a
+ * `registered` verdict. Otherwise `registered` routes to the record's hosts
+ * (record order, HTTPS or loopback only), `unregistered` to `newUserHost`,
+ * and `unavailable` or a record without a usable host goes to
+ * `onNodeNotFound`, else throws.
+ */
+declare function resolveFailClosedTinyCloudHosts(address: string, options?: FailClosedHostOptions): Promise<FailClosedHosts>;
+/**
+ * The space-creation guard under `fail-closed`: creating a space on `host` is
+ * allowed for an `unregistered` owner, or for a `registered` owner whose
+ * record lists `host` as an HTTPS or loopback HTTP origin.
+ *
+ * @throws NodeRegistryEntryExistsError for a registered owner whose record
+ * does not list `host` that way (including an empty record).
+ * @throws RegistryUnavailableError for an `unavailable` verdict.
+ */
+declare function assertSpaceCreationAllowed(verdict: RegistryVerdict, host: string): void;
+
 /**
  * Default lifetimes for the various delegation shapes the SDK mints.
  *
@@ -3758,4 +3955,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClassifyRegistryLookupOptions, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, REGISTRY_LOOKUP_MAX_BODY_BYTES, REGISTRY_NOT_FOUND_BODY, type RecapAttenuation, type RegisterBatchSuccess, type RegisteredRegistryVerdict, type RegistryHost, type RegistryHostSource, RegistryLookupInputError, type RegistryLookupInputErrorCode, type RegistryLookupResponse, type RegistryUnavailableReason, type RegistryVerdict, type RegistryVerdictSource, type RegistryVerdictStatus, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, type SignedSiweCacao, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TERMINAL_DELEGATION_FACT, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, type TerminalDelegationSigningKey, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, type UnavailableRegistryVerdict, type UnregisteredRegistryVerdict, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, classifyRegistryLookup, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, markDelegationTerminal, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSignedSiweCacao, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClassifyRegistryLookupOptions, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_NEW_USER_HOST, DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS, DEFAULT_REGISTRY_OWNER_CHAIN_ID, DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type FailClosedHostOptions, type FailClosedHosts, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type LookupOwnerRegistryVerdictOptions, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type NodeNotFoundContext, type NodeNotFoundDecision, NodeNotFoundError, NodeRegistryEntryExistsError, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OnNodeNotFound, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, REGISTRY_LOOKUP_MAX_BODY_BYTES, REGISTRY_NOT_FOUND_BODY, type RecapAttenuation, type RegisterBatchSuccess, type RegisteredRegistryVerdict, type RegistryHost, type RegistryHostSource, RegistryLookupInputError, type RegistryLookupInputErrorCode, type RegistryLookupResponse, type RegistryPolicy, type RegistrySequenceStore, RegistryUnavailableError, type RegistryUnavailableReason, type RegistryVerdict, type RegistryVerdictSource, type RegistryVerdictStatus, type ResolveCloudLocationOptions, type ResolveOwnerHostsOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, type SignedSiweCacao, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TERMINAL_DELEGATION_FACT, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, type TerminalDelegationSigningKey, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, type UnavailableRegistryVerdict, type UnregisteredRegistryVerdict, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, assertSpaceCreationAllowed, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, classifyRegistryLookup, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createInMemoryRegistrySequenceStore, createLocalStorageLocalNodeIdentityStore, createLocalStorageRegistrySequenceStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, lookupOwnerRegistryVerdict, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, markDelegationTerminal, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSignedSiweCacao, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, registryOwnerSubjectV1, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveFailClosedTinyCloudHosts, resolveManifest, resolveManifestKnowledgeRoot, resolveOwnerHosts, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { br as CredentialHolderBinding, bs as CredentialFlowDescriptor, bt as CredentialRequirement, bu as StoredCredentialRecord, bv as VerifiedCredential, bw as CredentialStorageReceipt, bx as IssuedCredentialEnvelope, by as CredentialIssuerMetadata } from './credential-admission-7I_ymo-C.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bz as CREDENTIAL_ACQUISITION_PROTOCOL, bA as CREDENTIAL_CONTRACT_VERSION, bB as CREDENTIAL_FORMAT, bz as CREDENTIAL_PROTOCOL, bC as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bD as CredentialClaimDescriptor, bE as CredentialEndpointId, bF as CredentialInputDescriptor, bG as CredentialProgressEvent, bH as CredentialStepDescriptor, bI as CredentialStepType, bJ as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bK as HOLDER_BINDING_DOMAIN, bL as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from './credential-admission-7I_ymo-C.js';
+import { br as CredentialHolderBinding, bs as CredentialFlowDescriptor, bt as CredentialRequirement, bu as StoredCredentialRecord, bv as VerifiedCredential, bw as CredentialStorageReceipt, bx as IssuedCredentialEnvelope, by as CredentialIssuerMetadata } from './credential-admission-CJbnvwJa.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bz as CREDENTIAL_ACQUISITION_PROTOCOL, bA as CREDENTIAL_CONTRACT_VERSION, bB as CREDENTIAL_FORMAT, bz as CREDENTIAL_PROTOCOL, bC as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bD as CredentialClaimDescriptor, bE as CredentialEndpointId, bF as CredentialInputDescriptor, bG as CredentialProgressEvent, bH as CredentialStepDescriptor, bI as CredentialStepType, bJ as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bK as HOLDER_BINDING_DOMAIN, bL as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from './credential-admission-CJbnvwJa.js';
 export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { AuthorityRefusal, AuthorizationVerdict, BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, IStorageService, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVChange, KVChangesAuthority, KVChangesOptions, KVChangesResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListPage, KVListResponse, KVPutOptions, KVReadThrough, KVReplicaHandle, KVReplicaSpec, KVReplicaStorage, KVReplicationController, KVReplicationDeps, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, LocalGetResult, LocalListResult, LocalReadMeta, LocalReplicaStatus, LocalSyncResult, MAX_SECRET_SCOPE_LENGTH, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PendingWriteRecord, PendingWriteState, PendingWriteStore, PinnedKey, PrefixedKVService, PurgeTarget, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ReplicaAuthorityState, ReplicaCoverage, ReplicaDevice, ReplicaGatedHandle, ReplicaGrantInfo, ReplicaInspectedStatus, ReplicaState, ReplicaStatusEntry, ReplicationAuthority, ReplicationControl, ReplicationEvent, ReplicationIdentity, ReplicationOptions, ReplicationPurgeReport, ReplicationReason, ReplicationScheduler, ResolvedReplicationOptions, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SECRET_SCOPE_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, STORAGE_FULL_MESSAGE, STORAGE_MANAGE_URL, STORAGE_NEARLY_FULL_RATIO, STORAGE_WRITE_TOO_LARGE_MESSAGE, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretPutOptions, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, StorageAccountUsage, StorageFullEvent, StorageFullHandler, StorageFullMonitor, StorageRejectionDetails, StorageStatus, StorageStatusOptions, StorageUsage, StorageUsageState, SubscribeOptions, TC832_RESERVED_SCOPES, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, appSecretScope, authorizationVerdictOf, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, isStorageFullError, networkDiscoveryKey, ok, openWrappedKey, parseCapabilityResource, parseNetworkId, parseSecretCatalogKey, parseStorageRejection, parseStorageStatus, resolveSecretListPrefix, resolveSecretPath, serviceError, storageUsageState, tinyCloudDebugLogger, validateEnvelope, validatedCapabilityOf, verifyDecryptResponse } from '@tinycloud/sdk-services';
@@ -8,7 +8,7 @@ export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, L
 import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-CPDoAVh4.js';
 export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-CPDoAVh4.js';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, AGENTS_SPACE, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_AGENTS_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
-export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';
+export { b as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BA49Uboq.js';
 export { SiweMessage } from 'siwe';
 
 /**
@@ -3609,8 +3609,9 @@ declare function verifyDidKeyEd25519Signature(did: string, payload: Uint8Array,
  *   closed here.
  *
  * {@link classifyRegistryLookup} is a pure classifier over one registry
- * response. It performs no I/O and is not used by host resolution yet. Its
- * rules are written to be portable: the shared vectors in
+ * response. It performs no I/O; `resolveOwnerHosts` (`registry-policy.ts`)
+ * does the lookup for the opt-in `fail-closed` registry policy. The
+ * classifier's rules are written to be portable: the shared vectors in
  * `test-vectors/registry-verdict/` state them for other implementations.
  */
 type RegistryVerdictStatus = "registered" | "unregistered" | "unavailable";
@@ -3729,6 +3730,202 @@ declare const REGISTRY_NOT_FOUND_BODY = "{\"error\":\"location record not found\
  */
 declare function classifyRegistryLookup(subject: string, response: RegistryLookupResponse, options?: ClassifyRegistryLookupOptions): Promise<RegistryVerdict>;
 
+/**
+ * Registry policy for host resolution and space creation (TC-1443).
+ *
+ * - `legacy-fallback` (the default, deprecated): {@link resolveTinyCloudHosts}
+ *   as before. A registry miss or failure silently routes to the hosted
+ *   fallback node, with a one-time deprecation warning.
+ * - `fail-closed` (opt-in): routing and space creation act on the three-state
+ *   registry verdict. `unavailable` is never treated as `unregistered`.
+ *
+ * Registry lookups key on the owner's signer address, never the session
+ * chain. The v1 registry stores records under an exact
+ * `did:pkh:eip155:<chain>:<EIP-55 address>` subject, so v1 lookups use
+ * {@link registryOwnerSubjectV1} with a configured chain (default 1). Registry
+ * v2 keys owner records on the EIP-55 address alone, chain-independent.
+ */
+
+type RegistryPolicy = "legacy-fallback" | "fail-closed";
+/** Chain of the v1 registry subject when none is configured. */
+declare const DEFAULT_REGISTRY_OWNER_CHAIN_ID = 1;
+/** Host for `unregistered` owners under `fail-closed` when none is configured. */
+declare const DEFAULT_NEW_USER_HOST = "https://node.tinycloud.xyz";
+/** Budget for one registry lookup, covering the request and the body. */
+declare const DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS = 3000;
+/** Default key {@link createLocalStorageRegistrySequenceStore} stores its sequences under. */
+declare const DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY = "tinycloud.registrySequences.v1";
+/**
+ * The v1 registry subject for an owner: `did:pkh:eip155:<registryChainId>:<EIP-55 address>`.
+ *
+ * Built from the signer address and a configured chain, never from the
+ * session chain, so switching wallet chains never changes the lookup. Registry
+ * v2 will key on the EIP-55 address alone.
+ */
+declare function registryOwnerSubjectV1(address: string, registryChainId?: number): string;
+/**
+ * The highest registry record sequence accepted per subject. A remembered
+ * sequence marks the subject as registered: a later not-found or an older
+ * record is `unavailable`, never `unregistered`.
+ *
+ * `set` is only called with a sequence above the remembered one. A `get`
+ * failure fails that lookup closed (`RegistryUnavailableError`, never
+ * "nothing remembered"). A `set` failure is logged once and the verdict in
+ * hand stands: failing to remember weakens later rollback detection but
+ * never turns a correct `registered` answer into a lockout.
+ */
+interface RegistrySequenceStore {
+    get(subject: string): number | undefined | Promise<number | undefined>;
+    set(subject: string, sequence: number): void | Promise<void>;
+}
+/** In-memory {@link RegistrySequenceStore}. Does not persist across process restarts. */
+declare function createInMemoryRegistrySequenceStore(): RegistrySequenceStore;
+/**
+ * `localStorage`-backed {@link RegistrySequenceStore}, one JSON object under
+ * `storageKey`. Falls back to an in-memory store when `localStorage` is
+ * unavailable. Sequences are also kept in memory, so a failed write (full or
+ * read-only storage) is still remembered for this page. A storage read that
+ * throws, or a corrupt stored value, throws instead of being reset:
+ * forgetting a sequence would let a registry not-found read as
+ * `unregistered`. Remove `storageKey` to reset.
+ */
+declare function createLocalStorageRegistrySequenceStore(storage?: WebStorageLike, storageKey?: string): RegistrySequenceStore;
+interface ResolveOwnerHostsOptions {
+    /** Location registry base URL. Default https://registry.tinycloud.xyz. */
+    registryUrl?: string;
+    /** Remembered sequences. Omit to remember nothing. */
+    sequenceStore?: RegistrySequenceStore;
+    /** Custom fetch implementation. Defaults to globalThis.fetch. */
+    fetch?: typeof fetch;
+    /** Lookup budget in milliseconds. Default {@link DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS}. */
+    timeoutMs?: number;
+}
+/**
+ * Look up `subject` in the off-chain v1 location registry and classify the
+ * answer with {@link classifyRegistryLookup}, using and updating the
+ * remembered sequence. Transport failures, timeouts and oversize or non-UTF-8
+ * bodies are `unavailable` verdicts. Performs no host probing and never
+ * applies a fallback.
+ *
+ * @throws RegistryLookupInputError if `subject` is not canonical or a
+ * remembered sequence is invalid. The subject is length-checked before any
+ * other parsing.
+ */
+declare function resolveOwnerHosts(subject: string, options?: ResolveOwnerHostsOptions): Promise<RegistryVerdict>;
+/** Sign-in found no usable host for a registered owner, or none for an unregistered owner when `newUserHost` is null. */
+declare class NodeNotFoundError extends Error {
+    readonly subject: string;
+    readonly verdict: RegisteredRegistryVerdict | UnregisteredRegistryVerdict;
+    readonly code: "node_not_found";
+    constructor(subject: string, verdict: RegisteredRegistryVerdict | UnregisteredRegistryVerdict);
+}
+/**
+ * The registry could not give a verdict: unreachable, timed out, an invalid
+ * or rolled-back answer, no registry configured, or a lookup that threw
+ * (`cause`). Never treated as "unregistered".
+ */
+declare class RegistryUnavailableError extends Error {
+    readonly subject: string;
+    readonly verdict: UnavailableRegistryVerdict | undefined;
+    readonly code: "registry_unavailable";
+    readonly cause?: unknown;
+    constructor(subject: string, verdict: UnavailableRegistryVerdict | undefined, detail?: {
+        message?: string;
+        cause?: unknown;
+    });
+}
+/** Space creation was refused: the owner's registry record does not list this host. */
+declare class NodeRegistryEntryExistsError extends Error {
+    readonly subject: string;
+    readonly host: string;
+    readonly verdict: RegisteredRegistryVerdict;
+    readonly code: "node_registry_entry_exists";
+    /** HTTPS or loopback origins the owner's record lists, in record order. */
+    readonly registeredHosts: string[];
+    constructor(subject: string, host: string, verdict: RegisteredRegistryVerdict);
+}
+interface LookupOwnerRegistryVerdictOptions {
+    /** Location registry base URL. `null` means none, which is `RegistryUnavailableError`. */
+    registryUrl?: string | null;
+    sequenceStore?: RegistrySequenceStore;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+/**
+ * {@link resolveOwnerHosts} for policy decisions: a lookup that throws, or no
+ * configured registry, becomes {@link RegistryUnavailableError}. An
+ * `unavailable` verdict is returned as a verdict.
+ */
+declare function lookupOwnerRegistryVerdict(subject: string, options?: LookupOwnerRegistryVerdictOptions): Promise<RegistryVerdict>;
+interface NodeNotFoundContext {
+    readonly error: NodeNotFoundError | RegistryUnavailableError;
+    /** 1 for the first failure, incremented after each `retry`. */
+    readonly attempt: number;
+}
+type NodeNotFoundDecision = {
+    readonly action: "retry";
+} | {
+    readonly action: "use-host";
+    readonly host: string;
+} | {
+    readonly action: "abort";
+};
+/**
+ * Decides what sign-in does when no host can be resolved under `fail-closed`:
+ * look up again, use another host, or abort with the error. A `use-host`
+ * host must be an HTTPS or loopback HTTP origin. The SDK does not verify its
+ * identity, and it persists with the session like any resolved host; space
+ * creation there still goes through the creation guard.
+ */
+type OnNodeNotFound = (context: NodeNotFoundContext) => NodeNotFoundDecision | Promise<NodeNotFoundDecision>;
+interface FailClosedHostOptions extends LookupOwnerRegistryVerdictOptions {
+    /** Chain of the v1 registry subject. Default {@link DEFAULT_REGISTRY_OWNER_CHAIN_ID}. */
+    registryChainId?: number;
+    /**
+     * Host for owners the registry reports as `unregistered`, and only them.
+     * Default {@link DEFAULT_NEW_USER_HOST}. `null`: unregistered owners get
+     * {@link NodeNotFoundError}.
+     */
+    newUserHost?: string | null;
+    /** Without a callback, resolution throws the error. */
+    onNodeNotFound?: OnNodeNotFound;
+    /**
+     * Probe local nodes before routing on the verdict. Default true. Only
+     * configured candidates (`localNodeUrl`, `localLinkName`) and
+     * `*.local.tinycloud.link` hosts from a `registered` verdict are probed.
+     */
+    autoDiscoverLocalNode?: boolean;
+    localNodeUrl?: string;
+    localLinkName?: string;
+    expectedNodeDid?: string;
+    localNodeIdentityStore?: LocalNodeIdentityStore;
+}
+interface FailClosedHosts {
+    hosts: string[];
+    /** The registry verdict behind `hosts`. Absent when a verified local node was used. */
+    verdict?: RegistryVerdict;
+}
+/**
+ * Resolve the hosts for `address` under the `fail-closed` policy. The
+ * registry verdict for {@link registryOwnerSubjectV1} comes first. Then a
+ * verified local node is used if one is configured or listed by a
+ * `registered` verdict. Otherwise `registered` routes to the record's hosts
+ * (record order, HTTPS or loopback only), `unregistered` to `newUserHost`,
+ * and `unavailable` or a record without a usable host goes to
+ * `onNodeNotFound`, else throws.
+ */
+declare function resolveFailClosedTinyCloudHosts(address: string, options?: FailClosedHostOptions): Promise<FailClosedHosts>;
+/**
+ * The space-creation guard under `fail-closed`: creating a space on `host` is
+ * allowed for an `unregistered` owner, or for a `registered` owner whose
+ * record lists `host` as an HTTPS or loopback HTTP origin.
+ *
+ * @throws NodeRegistryEntryExistsError for a registered owner whose record
+ * does not list `host` that way (including an empty record).
+ * @throws RegistryUnavailableError for an `unavailable` verdict.
+ */
+declare function assertSpaceCreationAllowed(verdict: RegistryVerdict, host: string): void;
+
 /**
  * Default lifetimes for the various delegation shapes the SDK mints.
  *
@@ -3758,4 +3955,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClassifyRegistryLookupOptions, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, REGISTRY_LOOKUP_MAX_BODY_BYTES, REGISTRY_NOT_FOUND_BODY, type RecapAttenuation, type RegisterBatchSuccess, type RegisteredRegistryVerdict, type RegistryHost, type RegistryHostSource, RegistryLookupInputError, type RegistryLookupInputErrorCode, type RegistryLookupResponse, type RegistryUnavailableReason, type RegistryVerdict, type RegistryVerdictSource, type RegistryVerdictStatus, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, type SignedSiweCacao, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TERMINAL_DELEGATION_FACT, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, type TerminalDelegationSigningKey, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, type UnavailableRegistryVerdict, type UnregisteredRegistryVerdict, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, classifyRegistryLookup, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, markDelegationTerminal, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSignedSiweCacao, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClassifyRegistryLookupOptions, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_NEW_USER_HOST, DEFAULT_REGISTRY_LOOKUP_TIMEOUT_MS, DEFAULT_REGISTRY_OWNER_CHAIN_ID, DEFAULT_REGISTRY_SEQUENCE_STORAGE_KEY, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type FailClosedHostOptions, type FailClosedHosts, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type LookupOwnerRegistryVerdictOptions, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type NodeNotFoundContext, type NodeNotFoundDecision, NodeNotFoundError, NodeRegistryEntryExistsError, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OnNodeNotFound, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, REGISTRY_LOOKUP_MAX_BODY_BYTES, REGISTRY_NOT_FOUND_BODY, type RecapAttenuation, type RegisterBatchSuccess, type RegisteredRegistryVerdict, type RegistryHost, type RegistryHostSource, RegistryLookupInputError, type RegistryLookupInputErrorCode, type RegistryLookupResponse, type RegistryPolicy, type RegistrySequenceStore, RegistryUnavailableError, type RegistryUnavailableReason, type RegistryVerdict, type RegistryVerdictSource, type RegistryVerdictStatus, type ResolveCloudLocationOptions, type ResolveOwnerHostsOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, type SignedSiweCacao, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TERMINAL_DELEGATION_FACT, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, type TerminalDelegationSigningKey, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, type UnavailableRegistryVerdict, type UnregisteredRegistryVerdict, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, assertSpaceCreationAllowed, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, classifyRegistryLookup, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createInMemoryRegistrySequenceStore, createLocalStorageLocalNodeIdentityStore, createLocalStorageRegistrySequenceStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpResponseError, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isExplicitOnlyAction, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, lookupOwnerRegistryVerdict, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, markDelegationTerminal, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSignedSiweCacao, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, registryOwnerSubjectV1, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveFailClosedTinyCloudHosts, resolveManifest, resolveManifestKnowledgeRoot, resolveOwnerHosts, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };