@tinycloud/sdk-core 2.10.0 → 2.11.0-beta.1

package/dist/delegations/index.d.cts

@@ -1,5 +1,5 @@
-import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-B2wH53_t.cjs';
-export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationParams, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, m as Delegation, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, w as DelegationRevocationReceipt, x as DelegationStatus, E as EncodedShareData, G as GenerateShareParams, y as ISharingService, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationReceipt, T as OwnerShareAction, U as OwnerShareMatcher, V as OwnerSharePolicyRegistration, W as OwnerSharePolicyRegistrationReceipt, X as OwnerSharePolicyV2, Y as ReceiveOptions, Z as RegisterOwnerSharePolicyParams, _ as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, $ as SenderShareKeyStorage, a0 as SenderShareRecord, a1 as SenderShareRecordStorage, a2 as SenderShareRevocationScope, a3 as SenderShareStore, a4 as ShareAccess, a5 as ShareAccessError, a6 as ShareAccessV2, a7 as ShareAction, a8 as ShareActionSchema, a9 as ShareAddressedDelegationEnvelopeV2, aa as ShareAddressedDelegationEnvelopeV2Schema, ab as ShareAddressedDelegationRequestV2, ac as ShareAddressedDelegationRequestV2Schema, ad as ShareAddressedDelegationResponseV2, ae as ShareAddressedDelegationResponseV2Schema, af as ShareAddressedRecipientMatcher, ag as ShareArtifactInput, ah as ShareArtifactResult, ai as ShareArtifactV2, aj as ShareCache, ak as ShareCacheEntry, al as ShareCacheKey, am as ShareCacheMetadata, an as ShareCapabilityLike, ao as ShareConflict, ap as ShareContentMetadata, aq as ShareContentSource, ar as ShareDeliveryAuthorization, as as ShareDeliveryAuthorizationReceipt, at as ShareDeliveryAuthorizationRequest, au as ShareDetachedProof, av as ShareEnvelopeError, aw as ShareEnvelopeV2, ax as ShareExpiryBounds, ay as ShareKvContentSource, az as ShareLink, aA as ShareLinkData, aB as ShareLinkLocation, aC as ShareListEntry, aD as ShareListResult, aE as ShareNativeAction, aF as ShareNativeInvokeEnvelopeV1, aG as ShareNativeInvokeErrorResult, aH as ShareNativeInvokeInput, aI as ShareNativeInvokeResult, aJ as ShareNativeInvokeSuccessResult, aK as ShareNativeResponse, aL as ShareNativeResponseSchema, aM as SharePolicy, aN as SharePolicyBinding, aO as SharePolicySession, aP as SharePolicySessionV1, aQ as SharePolicySessionWireV1, aR as ShareReadInvocationV1, aS as ShareReadResult, aT as ShareRecipientClient, aU as ShareRecipientClientOptions, aV as ShareRecipientClientOptionsSchema, aW as ShareRecipientPolicy, aX as ShareRecipientPolicySchema, aY as ShareRecipientResult, aZ as ShareRecipientTarget, a_ as ShareRecipientTargetSchema, a$ as ShareResource, b0 as ShareResourceSchema, b1 as ShareSaveOptions, b2 as ShareSchema, b3 as ShareSqlContentSource, b4 as ShareWireAction, b5 as SharingService, b6 as SharingServiceConfig, b7 as SignedDelegation, b8 as SpaceInfo, b9 as SpaceOwnership, ba as ValidateShareDeliveryAuthorizationExpected, bb as VerifyShareEnvelopeOptions, bc as canonicalOwnerSharePolicy, bd as computeOwnerShareRegistrationCid, be as computeShareCid, bf as createDelegatedShareKey, bg as createPolicyEnforcementDelegation, bh as createShareArtifact, bi as createShareArtifactAsync, bj as createSharePolicy, bk as createSharingService, bl as decryptShareBytesAsync, bm as encodeInlineShareUrl, bn as encodeShareArtifact, bo as encodeShareUrl, bp as encryptShareBytes, bq as encryptShareBytesAsync, br as intersectShareCapabilities, bs as isV2ShareLink, bt as normalizeShareActions, bu as normalizeShareRecipientTarget, bv as normalizeShareResource, bw as parseShareArtifact, bx as parseShareUrl, by as restoreDelegatedShareKey, bz as shareCapabilityAllows, bA as shareDeliveryTrustedKid, bB as signShareEnvelope, bC as validateOwnerSharePolicyRegistration, bD as validateOwnerSharePolicyRegistrationBytes, bE as validateShareDeliveryAuthorizationBytes, bF as verifyShareCid, bG as verifyShareEnvelope } from '../recipient-types.schema-B2wH53_t.cjs';
+import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-CWIt63Qp.cjs';
+export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationParams, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, m as Delegation, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, w as DelegationRevocationReceipt, x as DelegationStatus, E as EncodedShareData, G as GenerateShareParams, y as ISharingService, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as ReceiveOptions, $ as RegisterOwnerSharePolicyParams, a0 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a1 as SenderShareKeyStorage, a2 as SenderShareRecord, a3 as SenderShareRecordStorage, a4 as SenderShareRevocationScope, a5 as SenderShareStore, a6 as ShareAccess, a7 as ShareAccessError, a8 as ShareAccessV2, a9 as ShareAction, aa as ShareActionSchema, ab as ShareAddressedDelegationEnvelopeV2, ac as ShareAddressedDelegationEnvelopeV2Schema, ad as ShareAddressedDelegationRequestV2, ae as ShareAddressedDelegationRequestV2Schema, af as ShareAddressedDelegationResponseV2, ag as ShareAddressedDelegationResponseV2Schema, ah as ShareAddressedRecipientMatcher, ai as ShareArtifactInput, aj as ShareArtifactResult, ak as ShareArtifactV2, al as ShareCache, am as ShareCacheEntry, an as ShareCacheKey, ao as ShareCacheMetadata, ap as ShareCapabilityLike, aq as ShareConflict, ar as ShareContentMetadata, as as ShareContentSource, at as ShareDeliveryAuthorization, au as ShareDeliveryAuthorizationReceipt, av as ShareDeliveryAuthorizationRequest, aw as ShareDetachedProof, ax as ShareEnvelopeError, ay as ShareEnvelopeV2, az as ShareExpiryBounds, aA as ShareKvContentSource, aB as ShareLink, aC as ShareLinkData, aD as ShareLinkLocation, aE as ShareListEntry, aF as ShareListResult, aG as ShareNativeAction, aH as ShareNativeInvokeEnvelopeV1, aI as ShareNativeInvokeErrorResult, aJ as ShareNativeInvokeInput, aK as ShareNativeInvokeResult, aL as ShareNativeInvokeSuccessResult, aM as ShareNativeResponse, aN as ShareNativeResponseSchema, aO as SharePolicy, aP as SharePolicyBinding, aQ as SharePolicySession, aR as SharePolicySessionV1, aS as SharePolicySessionWireV1, aT as ShareReadInvocationV1, aU as ShareReadResult, aV as ShareRecipientClient, aW as ShareRecipientClientOptions, aX as ShareRecipientClientOptionsSchema, aY as ShareRecipientPolicy, aZ as ShareRecipientPolicySchema, a_ as ShareRecipientResult, a$ as ShareRecipientTarget, b0 as ShareRecipientTargetSchema, b1 as ShareResource, b2 as ShareResourceSchema, b3 as ShareSaveOptions, b4 as ShareSchema, b5 as ShareSqlContentSource, b6 as ShareWireAction, b7 as SharingService, b8 as SharingServiceConfig, b9 as SignedDelegation, ba as SpaceInfo, bb as SpaceOwnership, bc as ValidateShareDeliveryAuthorizationExpected, bd as VerifyShareEnvelopeOptions, be as canonicalOwnerSharePolicy, bf as computeOwnerShareRegistrationCid, bg as computeShareCid, bh as createDelegatedShareKey, bi as createPolicyEnforcementDelegation, bj as createShareArtifact, bk as createShareArtifactAsync, bl as createSharePolicy, bm as createSharingService, bn as decryptShareBytesAsync, bo as encodeInlineShareUrl, bp as encodeShareArtifact, bq as encodeShareUrl, br as encryptShareBytes, bs as encryptShareBytesAsync, bt as intersectShareCapabilities, bu as isV2ShareLink, bv as normalizeShareActions, bw as normalizeShareRecipientTarget, bx as normalizeShareResource, by as parseShareArtifact, bz as parseShareUrl, bA as restoreDelegatedShareKey, bB as shareCapabilityAllows, bC as shareDeliveryTrustedKid, bD as signShareEnvelope, bE as validateOwnerSharePolicyRegistration, bF as validateOwnerSharePolicyRegistrationBytes, bG as validateShareDeliveryAuthorizationBytes, bH as verifyShareCid, bI as verifyShareEnvelope } from '../recipient-types.schema-CWIt63Qp.cjs';
 import { z } from 'zod';
 import { ServiceSession, InvokeFunction, FetchFunction, IKVService } from '@tinycloud/sdk-services';
 

package/dist/delegations/index.d.ts

@@ -1,5 +1,5 @@
-import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-B2wH53_t.js';
-export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationParams, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, m as Delegation, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, w as DelegationRevocationReceipt, x as DelegationStatus, E as EncodedShareData, G as GenerateShareParams, y as ISharingService, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationReceipt, T as OwnerShareAction, U as OwnerShareMatcher, V as OwnerSharePolicyRegistration, W as OwnerSharePolicyRegistrationReceipt, X as OwnerSharePolicyV2, Y as ReceiveOptions, Z as RegisterOwnerSharePolicyParams, _ as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, $ as SenderShareKeyStorage, a0 as SenderShareRecord, a1 as SenderShareRecordStorage, a2 as SenderShareRevocationScope, a3 as SenderShareStore, a4 as ShareAccess, a5 as ShareAccessError, a6 as ShareAccessV2, a7 as ShareAction, a8 as ShareActionSchema, a9 as ShareAddressedDelegationEnvelopeV2, aa as ShareAddressedDelegationEnvelopeV2Schema, ab as ShareAddressedDelegationRequestV2, ac as ShareAddressedDelegationRequestV2Schema, ad as ShareAddressedDelegationResponseV2, ae as ShareAddressedDelegationResponseV2Schema, af as ShareAddressedRecipientMatcher, ag as ShareArtifactInput, ah as ShareArtifactResult, ai as ShareArtifactV2, aj as ShareCache, ak as ShareCacheEntry, al as ShareCacheKey, am as ShareCacheMetadata, an as ShareCapabilityLike, ao as ShareConflict, ap as ShareContentMetadata, aq as ShareContentSource, ar as ShareDeliveryAuthorization, as as ShareDeliveryAuthorizationReceipt, at as ShareDeliveryAuthorizationRequest, au as ShareDetachedProof, av as ShareEnvelopeError, aw as ShareEnvelopeV2, ax as ShareExpiryBounds, ay as ShareKvContentSource, az as ShareLink, aA as ShareLinkData, aB as ShareLinkLocation, aC as ShareListEntry, aD as ShareListResult, aE as ShareNativeAction, aF as ShareNativeInvokeEnvelopeV1, aG as ShareNativeInvokeErrorResult, aH as ShareNativeInvokeInput, aI as ShareNativeInvokeResult, aJ as ShareNativeInvokeSuccessResult, aK as ShareNativeResponse, aL as ShareNativeResponseSchema, aM as SharePolicy, aN as SharePolicyBinding, aO as SharePolicySession, aP as SharePolicySessionV1, aQ as SharePolicySessionWireV1, aR as ShareReadInvocationV1, aS as ShareReadResult, aT as ShareRecipientClient, aU as ShareRecipientClientOptions, aV as ShareRecipientClientOptionsSchema, aW as ShareRecipientPolicy, aX as ShareRecipientPolicySchema, aY as ShareRecipientResult, aZ as ShareRecipientTarget, a_ as ShareRecipientTargetSchema, a$ as ShareResource, b0 as ShareResourceSchema, b1 as ShareSaveOptions, b2 as ShareSchema, b3 as ShareSqlContentSource, b4 as ShareWireAction, b5 as SharingService, b6 as SharingServiceConfig, b7 as SignedDelegation, b8 as SpaceInfo, b9 as SpaceOwnership, ba as ValidateShareDeliveryAuthorizationExpected, bb as VerifyShareEnvelopeOptions, bc as canonicalOwnerSharePolicy, bd as computeOwnerShareRegistrationCid, be as computeShareCid, bf as createDelegatedShareKey, bg as createPolicyEnforcementDelegation, bh as createShareArtifact, bi as createShareArtifactAsync, bj as createSharePolicy, bk as createSharingService, bl as decryptShareBytesAsync, bm as encodeInlineShareUrl, bn as encodeShareArtifact, bo as encodeShareUrl, bp as encryptShareBytes, bq as encryptShareBytesAsync, br as intersectShareCapabilities, bs as isV2ShareLink, bt as normalizeShareActions, bu as normalizeShareRecipientTarget, bv as normalizeShareResource, bw as parseShareArtifact, bx as parseShareUrl, by as restoreDelegatedShareKey, bz as shareCapabilityAllows, bA as shareDeliveryTrustedKid, bB as signShareEnvelope, bC as validateOwnerSharePolicyRegistration, bD as validateOwnerSharePolicyRegistrationBytes, bE as validateShareDeliveryAuthorizationBytes, bF as verifyShareCid, bG as verifyShareEnvelope } from '../recipient-types.schema-B2wH53_t.js';
+import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-CWIt63Qp.js';
+export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationParams, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, m as Delegation, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, w as DelegationRevocationReceipt, x as DelegationStatus, E as EncodedShareData, G as GenerateShareParams, y as ISharingService, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as ReceiveOptions, $ as RegisterOwnerSharePolicyParams, a0 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a1 as SenderShareKeyStorage, a2 as SenderShareRecord, a3 as SenderShareRecordStorage, a4 as SenderShareRevocationScope, a5 as SenderShareStore, a6 as ShareAccess, a7 as ShareAccessError, a8 as ShareAccessV2, a9 as ShareAction, aa as ShareActionSchema, ab as ShareAddressedDelegationEnvelopeV2, ac as ShareAddressedDelegationEnvelopeV2Schema, ad as ShareAddressedDelegationRequestV2, ae as ShareAddressedDelegationRequestV2Schema, af as ShareAddressedDelegationResponseV2, ag as ShareAddressedDelegationResponseV2Schema, ah as ShareAddressedRecipientMatcher, ai as ShareArtifactInput, aj as ShareArtifactResult, ak as ShareArtifactV2, al as ShareCache, am as ShareCacheEntry, an as ShareCacheKey, ao as ShareCacheMetadata, ap as ShareCapabilityLike, aq as ShareConflict, ar as ShareContentMetadata, as as ShareContentSource, at as ShareDeliveryAuthorization, au as ShareDeliveryAuthorizationReceipt, av as ShareDeliveryAuthorizationRequest, aw as ShareDetachedProof, ax as ShareEnvelopeError, ay as ShareEnvelopeV2, az as ShareExpiryBounds, aA as ShareKvContentSource, aB as ShareLink, aC as ShareLinkData, aD as ShareLinkLocation, aE as ShareListEntry, aF as ShareListResult, aG as ShareNativeAction, aH as ShareNativeInvokeEnvelopeV1, aI as ShareNativeInvokeErrorResult, aJ as ShareNativeInvokeInput, aK as ShareNativeInvokeResult, aL as ShareNativeInvokeSuccessResult, aM as ShareNativeResponse, aN as ShareNativeResponseSchema, aO as SharePolicy, aP as SharePolicyBinding, aQ as SharePolicySession, aR as SharePolicySessionV1, aS as SharePolicySessionWireV1, aT as ShareReadInvocationV1, aU as ShareReadResult, aV as ShareRecipientClient, aW as ShareRecipientClientOptions, aX as ShareRecipientClientOptionsSchema, aY as ShareRecipientPolicy, aZ as ShareRecipientPolicySchema, a_ as ShareRecipientResult, a$ as ShareRecipientTarget, b0 as ShareRecipientTargetSchema, b1 as ShareResource, b2 as ShareResourceSchema, b3 as ShareSaveOptions, b4 as ShareSchema, b5 as ShareSqlContentSource, b6 as ShareWireAction, b7 as SharingService, b8 as SharingServiceConfig, b9 as SignedDelegation, ba as SpaceInfo, bb as SpaceOwnership, bc as ValidateShareDeliveryAuthorizationExpected, bd as VerifyShareEnvelopeOptions, be as canonicalOwnerSharePolicy, bf as computeOwnerShareRegistrationCid, bg as computeShareCid, bh as createDelegatedShareKey, bi as createPolicyEnforcementDelegation, bj as createShareArtifact, bk as createShareArtifactAsync, bl as createSharePolicy, bm as createSharingService, bn as decryptShareBytesAsync, bo as encodeInlineShareUrl, bp as encodeShareArtifact, bq as encodeShareUrl, br as encryptShareBytes, bs as encryptShareBytesAsync, bt as intersectShareCapabilities, bu as isV2ShareLink, bv as normalizeShareActions, bw as normalizeShareRecipientTarget, bx as normalizeShareResource, by as parseShareArtifact, bz as parseShareUrl, bA as restoreDelegatedShareKey, bB as shareCapabilityAllows, bC as shareDeliveryTrustedKid, bD as signShareEnvelope, bE as validateOwnerSharePolicyRegistration, bF as validateOwnerSharePolicyRegistrationBytes, bG as validateShareDeliveryAuthorizationBytes, bH as verifyShareCid, bI as verifyShareEnvelope } from '../recipient-types.schema-CWIt63Qp.js';
 import { z } from 'zod';
 import { ServiceSession, InvokeFunction, FetchFunction, IKVService } from '@tinycloud/sdk-services';
 

package/dist/delegations/index.js

@@ -4655,6 +4655,33 @@ function createError2(code3, message, cause, meta) {
     meta
   };
 }
+function rootDelegationSigningError(err) {
+  const cause = err instanceof Error ? err : void 0;
+  const code3 = err && typeof err === "object" && "code" in err ? String(err.code ?? "") : "";
+  const name2 = err instanceof Error ? err.name : "";
+  const message = err instanceof Error ? err.message : String(err ?? "");
+  const aborted = code3 === DelegationErrorCodes.ABORTED || name2 === "AbortError" || /\bcancell?ed\b|\brejected\b|user denied/i.test(message);
+  if (aborted) {
+    return createError2(
+      DelegationErrorCodes.ABORTED,
+      "The signature that authorizes this sharing link was cancelled. Approve the signing prompt to finish creating the link.",
+      cause
+    );
+  }
+  const timedOut = code3 === DelegationErrorCodes.TIMEOUT || name2 === "TimeoutError" || /timed out|timeout/i.test(message);
+  if (timedOut) {
+    return createError2(
+      DelegationErrorCodes.TIMEOUT,
+      "Timed out waiting for the signature that authorizes this sharing link. Creating a long-lived link re-opens the signing prompt after sign-in; if you did not see one, check for a blocked popup or a hidden signing frame, then try again.",
+      cause
+    );
+  }
+  return createError2(
+    DelegationErrorCodes.PERMISSION_DENIED,
+    "The active session ReCap does not authorize this sharing delegation.",
+    cause
+  );
+}
 function base64UrlEncode(data) {
   let base642;
   if (typeof btoa !== "undefined") {
@@ -4873,14 +4900,7 @@ var SharingService = class {
           };
         }
       } catch (err) {
-        return {
-          ok: false,
-          error: createError2(
-            DelegationErrorCodes.PERMISSION_DENIED,
-            "The active session ReCap does not authorize this sharing delegation.",
-            err instanceof Error ? err : void 0
-          )
-        };
+        return { ok: false, error: rootDelegationSigningError(err) };
       }
     } else {
       return {
@@ -6084,6 +6104,10 @@ async function createPolicyEnforcementDelegation(input) {
     spaceId: input.spaceId,
     path: input.path,
     actions: [...input.actions],
+    ...input.decryption === void 0 ? {} : {
+      decryptionNetworkId: input.decryption.networkId,
+      decryptionAction: input.decryption.action
+    },
     contentSourceDigest: input.contentSourceDigest,
     expiresAt: input.expiresAt
   };
@@ -6103,7 +6127,9 @@ function computeOwnerShareRegistrationCid(registration) {
 function validateOwnerSharePolicyRegistration(value, expected) {
   if (cid(expected.policy.bytes) !== expected.policy.cid) throw new Error("submitted owner-share policy bytes do not match its CID");
   const root = assertObject(value, ["registration", "proof"], "owner-share registration response");
-  const registration = assertObject(root.registration, ["registrationCid", "policyCid", "ownerDelegationCid", "enforcementDelegationCid", "ownerDid", "shareKeyDid", "enforcerDid", "shareId", "recipientMatcher", "target", "resource", "actions", "contentSource", "contentSourceDigest", "registeredAt", "expiresAt"], "owner-share registration");
+  const rawRegistration = root.registration;
+  const hasDecryption = typeof rawRegistration === "object" && rawRegistration !== null && Object.prototype.hasOwnProperty.call(rawRegistration, "decryption");
+  const registration = assertObject(root.registration, ["registrationCid", "policyCid", "ownerDelegationCid", "enforcementDelegationCid", "ownerDid", "shareKeyDid", "enforcerDid", "shareId", "recipientMatcher", "target", "resource", "actions", ...hasDecryption ? ["decryption"] : [], "contentSource", "contentSourceDigest", "registeredAt", "expiresAt"], "owner-share registration");
   const proof = assertObject(root.proof, ["alg", "kid", "signature"], "owner-share registration proof");
   if (registration.policyCid !== expected.policy.cid || registration.ownerDelegationCid !== expected.ownerDelegation.delegationCid || registration.enforcementDelegationCid !== expected.enforcementDelegation.cid || registration.contentSourceDigest !== expected.contentSourceDigest) throw new Error("owner-share registration is not bound to the submitted chain");
   let policyValue;
@@ -6119,7 +6145,9 @@ function validateOwnerSharePolicyRegistration(value, expected) {
   const registrationTarget = registration.target;
   const registrationResource = registration.resource;
   const enforcementFacts = expected.enforcementDelegation.facts;
-  if (typeof target?.origin !== "string" || typeof target.nodeAudience !== "string" || typeof target.enforcerDid !== "string" || typeof target.spaceId !== "string" || typeof resource?.kind !== "string" || !["exact", "prefix"].includes(resource.kind) || typeof resource?.path !== "string" || !Array.isArray(policy.actions) || policy.ownerDid !== registration.ownerDid || policy.shareKeyDid !== registration.shareKeyDid || policy.shareId !== registration.shareId || canonicalizeSignedObjectUnsigned(policy.recipientMatcher) !== canonicalizeSignedObjectUnsigned(registration.recipientMatcher) || target.origin !== registrationTarget.origin || target.nodeAudience !== registrationTarget.nodeAudience || target.enforcerDid !== registration.enforcerDid || target.spaceId !== registrationTarget.spaceId || resource.kind !== registrationResource.kind || resource.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(policy.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || canonicalizeSignedObjectUnsigned(policy.contentSource) !== canonicalizeSignedObjectUnsigned(registration.contentSource) || policy.expiresAt !== registration.expiresAt || policy.contentSourceDigest !== registration.contentSourceDigest || enforcementFacts.ownerDelegationCid !== registration.ownerDelegationCid || enforcementFacts.policyCid !== registration.policyCid || enforcementFacts.shareKeyDid !== registration.shareKeyDid || enforcementFacts.enforcerDid !== registration.enforcerDid || enforcementFacts.nodeAudience !== registrationTarget.nodeAudience || enforcementFacts.spaceId !== registrationTarget.spaceId || enforcementFacts.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(enforcementFacts.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || enforcementFacts.expiresAt !== registration.expiresAt) throw new Error("owner-share registration is not bound to the canonical policy");
+  const decryption = policy.decryption;
+  const decryptionMatches = decryption === void 0 ? registration.decryption === void 0 : registration.decryption !== void 0 && canonicalizeSignedObjectUnsigned(decryption) === canonicalizeSignedObjectUnsigned(registration.decryption);
+  if (typeof target?.origin !== "string" || typeof target.nodeAudience !== "string" || typeof target.enforcerDid !== "string" || typeof target.spaceId !== "string" || typeof resource?.kind !== "string" || !["exact", "prefix"].includes(resource.kind) || typeof resource?.path !== "string" || !Array.isArray(policy.actions) || policy.ownerDid !== registration.ownerDid || policy.shareKeyDid !== registration.shareKeyDid || policy.shareId !== registration.shareId || canonicalizeSignedObjectUnsigned(policy.recipientMatcher) !== canonicalizeSignedObjectUnsigned(registration.recipientMatcher) || target.origin !== registrationTarget.origin || target.nodeAudience !== registrationTarget.nodeAudience || target.enforcerDid !== registration.enforcerDid || target.spaceId !== registrationTarget.spaceId || resource.kind !== registrationResource.kind || resource.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(policy.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || !decryptionMatches || canonicalizeSignedObjectUnsigned(policy.contentSource) !== canonicalizeSignedObjectUnsigned(registration.contentSource) || policy.expiresAt !== registration.expiresAt || policy.contentSourceDigest !== registration.contentSourceDigest || enforcementFacts.ownerDelegationCid !== registration.ownerDelegationCid || enforcementFacts.policyCid !== registration.policyCid || enforcementFacts.shareKeyDid !== registration.shareKeyDid || enforcementFacts.enforcerDid !== registration.enforcerDid || enforcementFacts.nodeAudience !== registrationTarget.nodeAudience || enforcementFacts.spaceId !== registrationTarget.spaceId || enforcementFacts.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(enforcementFacts.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || enforcementFacts.decryptionNetworkId !== decryption?.networkId || enforcementFacts.decryptionAction !== decryption?.action || enforcementFacts.expiresAt !== registration.expiresAt) throw new Error("owner-share registration is not bound to the canonical policy");
   if (typeof registration.registrationCid !== "string" || typeof registration.expiresAt !== "string" || typeof registration.registeredAt !== "string") throw new Error("owner-share registration timestamps are invalid");
   if (new Date(registration.expiresAt).toISOString() !== registration.expiresAt || Date.parse(registration.expiresAt) <= Date.now()) throw new Error("owner-share registration is expired or non-canonical");
   const { registrationCid: _registrationCid, ...registrationCore } = registration;