@tinycloud/sdk-core 3.0.0-beta.0 → 3.0.0-beta.2

package/dist/index.js

@@ -565,6 +565,17 @@ function isDigest(value) {
 
 // src/credentials/requirement.ts
 var ID2 = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
+var EMAIL_CREDENTIAL_MAX_AGE_SECONDS = 3600;
+function createEmailCredentialRequirement(input) {
+  return validateCredentialRequirement({
+    type: "TinyCloudCredentialRequirement",
+    version: 1,
+    profile: input.profile,
+    credentialType: input.credentialType,
+    claims: { email: input.email },
+    maxAgeSeconds: EMAIL_CREDENTIAL_MAX_AGE_SECONDS
+  });
+}
 function validateCredentialRequirement(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential requirement is invalid");
   const raw = value;
@@ -3429,6 +3440,7 @@ async function requestPolicyChallengeV3(input) {
   const response = await fetchFn(new URL("/share/v3/policy/challenges", input.nodeOrigin), {
     method: "POST",
     redirect: "error",
+    signal: input.signal,
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ policyCid: input.policyCid, recipientDid: input.recipientDid, requestedCapabilities: input.requestedCapabilities.map(normalizeUnifiedPolicyCapability) })
   });
@@ -3598,6 +3610,11 @@ var POLICY_SESSION_FACT_KEYS = [
   "issuanceAuditDigestHex",
   "remainingRedelegationDepth"
 ];
+var POLICY_SESSION_V4_AUDIT_FACT_KEYS = [
+  "credentialIdAuditDigestHex",
+  "presentationJtiAuditDigestHex"
+];
+var LOWER_SHA256_HEX = /^[0-9a-f]{64}$/;
 var KV_ACTIONS = /* @__PURE__ */ new Set([
   "tinycloud.kv/get",
   "tinycloud.kv/list",
@@ -3990,9 +4007,13 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
   if (expectedProofs !== void 0 && (parsed.payload.prf[0] !== expectedProofs[0] || parsed.payload.prf[1] !== expectedProofs[1]))
     throw new Error("policy session UCAN ordered proofs do not match");
   const factKeys = Object.keys(fact);
-  if (factKeys.length !== POLICY_SESSION_FACT_KEYS.length || factKeys.some((key) => !POLICY_SESSION_FACT_KEYS.includes(key)) || POLICY_SESSION_FACT_KEYS.some((key) => !(key in fact)))
+  const hasLegacyFactShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact);
+  const hasV4AuditFactShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length + POLICY_SESSION_V4_AUDIT_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key) || POLICY_SESSION_V4_AUDIT_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact) && POLICY_SESSION_V4_AUDIT_FACT_KEYS.every((key) => key in fact);
+  if (!hasLegacyFactShape && !hasV4AuditFactShape)
     throw new Error("policy session UCAN fact is incomplete");
-  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.enforcerDid || parsed.payload.aud !== fact.recipientDid)
+  if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
+    throw new Error("policy session UCAN v4 audit facts are invalid");
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
     throw new Error("policy session UCAN fact is invalid");
   return {
     authorization,
@@ -4051,6 +4072,8 @@ var POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
 var POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE = "TinyCloudPolicyCredentialRequirement";
 var POLICY_PRESENTATION_V3_SCHEMA = "xyz.tinycloud.policy/presentation/v3";
 var POLICY_PRESENTATION_V3_DOMAIN = "xyz.tinycloud.policy/Presentation/v3\0";
+var POLICY_PRESENTATION_V4_SCHEMA = "xyz.tinycloud.policy/presentation/v4";
+var POLICY_PRESENTATION_V4_DOMAIN = "xyz.tinycloud.policy/Presentation/v4\0";
 function record(value, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     throw new Error(`${label} must be an object`);
@@ -4225,6 +4248,97 @@ function envelopeFromVerified(verified) {
   } = verified;
   return envelope;
 }
+function issuedCredentialEnvelopeFromVerified(verified) {
+  return envelopeFromVerified(verified);
+}
+async function signPolicyCredentialPresentationV4(value, sign) {
+  const item = record(value, "Policy presentation v4");
+  exactKeys2(item, [
+    "schema",
+    "jti",
+    "challengeId",
+    "nonce",
+    "policyCid",
+    "nodeAudience",
+    "holderDid",
+    "subjectDid",
+    "credentialDigest",
+    "requirementDigest",
+    "descriptorDigest",
+    "requestedCapabilities",
+    "issuedAt",
+    "expiresAt"
+  ], "Policy presentation v4");
+  if (item.schema !== POLICY_PRESENTATION_V4_SCHEMA || item.holderDid !== item.subjectDid || !Array.isArray(item.requestedCapabilities)) throw new Error("Policy presentation v4 is invalid");
+  const holderDid = nonEmpty(item.holderDid, "Policy presentation v4 holder DID");
+  didKeyBytes(holderDid);
+  const unsigned = Object.freeze({
+    schema: POLICY_PRESENTATION_V4_SCHEMA,
+    jti: nonEmpty(item.jti, "Policy presentation v4 jti"),
+    challengeId: nonEmpty(item.challengeId, "Policy presentation v4 challenge"),
+    nonce: nonEmpty(item.nonce, "Policy presentation v4 nonce"),
+    policyCid: nonEmpty(item.policyCid, "Policy presentation v4 policy CID"),
+    nodeAudience: nonEmpty(item.nodeAudience, "Policy presentation v4 audience"),
+    holderDid,
+    subjectDid: holderDid,
+    credentialDigest: nonEmpty(item.credentialDigest, "Policy presentation v4 credential digest"),
+    requirementDigest: nonEmpty(item.requirementDigest, "Policy presentation v4 requirement digest"),
+    descriptorDigest: nonEmpty(item.descriptorDigest, "Policy presentation v4 descriptor digest"),
+    // The low-level signer preserves the frozen wire bytes exactly. The
+    // policy-aware builder performs capability normalization and containment.
+    requestedCapabilities: Object.freeze(item.requestedCapabilities),
+    issuedAt: date(item.issuedAt, "Policy presentation v4 issuedAt"),
+    expiresAt: date(item.expiresAt, "Policy presentation v4 expiresAt")
+  });
+  const digest4 = sha2565(new TextEncoder().encode(
+    POLICY_PRESENTATION_V4_DOMAIN + jcsCanonicalize(unsigned)
+  ));
+  const signature = await sign(digest4);
+  if (signature.length !== 64 || !ed255194.verify(signature, digest4, didKeyBytes(holderDid))) throw new Error("policy presentation signature is invalid");
+  return Object.freeze({
+    ...unsigned,
+    signature: Object.freeze({
+      suite: "Ed25519",
+      signerDid: holderDid,
+      value: encodeBase64Url(signature)
+    })
+  });
+}
+async function buildPolicyCredentialPresentationV4(input) {
+  const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
+  const requirement = validateCredentialRequirement(input.requirement);
+  const commitment = policy.credentialRequirement;
+  const requirementDigest = await credentialRequirementDigest(requirement);
+  const credentialDigest = await sha256Base64Url(input.credential.credential);
+  if (requirementDigest !== commitment.requirementDigest || input.credential.descriptorDigest !== commitment.descriptorDigest || input.credential.credentialDigest !== credentialDigest || input.credential.issuerDid !== commitment.issuerDid || input.credential.issuerKid !== commitment.issuerKid || jcsCanonicalize(input.credential.profile) !== jcsCanonicalize(commitment.profile) || jcsCanonicalize(input.credential.credentialType) !== jcsCanonicalize(commitment.credentialType)) throw new Error("credential does not match the signed Policy/v2 requirement");
+  const requestedCapabilities = input.requestedCapabilities.map(normalizeUnifiedPolicyCapability);
+  if (requestedCapabilities.length === 0 || requestedCapabilities.some((requested) => !policy.capabilityCeiling.some((authority) => unifiedPolicyCapabilityContains(authority, requested)))) throw new Error("requested capabilities exceed the signed Policy/v2 ceiling");
+  const holderDid = input.credential.holderDid;
+  if (input.challenge.policyCid !== input.policyCid || input.challenge.recipientDid !== holderDid || input.credential.subjectDid !== holderDid || typeof input.challenge.nodeAudience !== "string" || input.challenge.nodeAudience.length === 0 || typeof input.challenge.expiresAt !== "string" || !Number.isFinite(Date.parse(input.challenge.expiresAt))) throw new Error("policy challenge binding is invalid");
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const expiresAtMs = Math.min(
+    now.getTime() + 6e4,
+    Date.parse(input.challenge.expiresAt),
+    Date.parse(input.credential.expiresAt)
+  );
+  if (expiresAtMs <= now.getTime()) throw new Error("policy challenge is expired");
+  return signPolicyCredentialPresentationV4(Object.freeze({
+    schema: POLICY_PRESENTATION_V4_SCHEMA,
+    jti: input.jti ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    challengeId: input.challenge.challengeId,
+    nonce: input.challenge.nonce,
+    policyCid: input.policyCid,
+    nodeAudience: input.challenge.nodeAudience,
+    holderDid,
+    subjectDid: holderDid,
+    credentialDigest,
+    requirementDigest,
+    descriptorDigest: input.credential.descriptorDigest,
+    requestedCapabilities: Object.freeze(requestedCapabilities),
+    issuedAt: rfc3339Seconds(now),
+    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+  }), input.sign);
+}
 async function buildPolicyCredentialPresentationV3(input) {
   const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
   const requirement = validateCredentialRequirement(input.requirement);
@@ -4314,7 +4428,8 @@ async function admitPolicyCredentialV3(input) {
     policyCid: input.policyCid,
     recipientDid: input.credential.holderDid,
     requestedCapabilities: input.requestedCapabilities,
-    fetch: fetchFn
+    fetch: fetchFn,
+    signal: input.signal
   });
   const presentation = await buildPolicyCredentialPresentationV3({
     ...input,
@@ -4326,6 +4441,7 @@ async function admitPolicyCredentialV3(input) {
     {
       method: "POST",
       redirect: "error",
+      signal: input.signal,
       headers: { accept: "application/json", "content-type": "application/json" },
       body: JSON.stringify({
         policyCid: input.policyCid,
@@ -4354,6 +4470,57 @@ async function admitPolicyCredentialV3(input) {
   if (session.cid !== value.sessionCid || session.aud !== input.credential.holderDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.credential.holderDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)) {
     throw new Error("policy delegation signed binding is invalid");
   }
+  input.signal?.throwIfAborted();
+  return Object.freeze({ challenge, presentation, session });
+}
+function validatePolicyCredentialAdmissionV4Authority(session, expected) {
+  if (session.iss.split("#", 1)[0] !== expected.nodeAudience || session.fact.nodeAudience !== expected.nodeAudience || session.fact.enforcerDid !== expected.enforcerDid) throw new Error("policy delegation authority binding is invalid");
+}
+async function admitPolicyCredentialV4(input) {
+  const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
+  const nodeOrigin = policyNodeOrigin(input.nodeOrigin);
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const challenge = await requestPolicyChallengeV3({
+    nodeOrigin,
+    policyCid: input.policyCid,
+    recipientDid: input.credential.holderDid,
+    requestedCapabilities: input.requestedCapabilities,
+    fetch: fetchFn,
+    signal: input.signal
+  });
+  const presentation = await buildPolicyCredentialPresentationV4({
+    ...input,
+    policy,
+    challenge
+  });
+  const response = await fetchFn(new URL("/share/v3/policy/delegations", nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    signal: input.signal,
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({
+      policyCid: input.policyCid,
+      challengeId: challenge.challengeId,
+      nonce: challenge.nonce,
+      requirement: validateCredentialRequirement(input.requirement),
+      credential: envelopeFromVerified(input.credential),
+      presentation
+    })
+  });
+  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  const value = record(await response.json(), "policy delegation");
+  if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") throw new Error("policy delegation response is invalid");
+  const session = parsePolicySessionUcan(value.authorization, [
+    input.policyRootCid,
+    input.enforcementRootCid
+  ]);
+  const expectedAttenuation = compactAttenuationForPolicyCapabilities(input.requestedCapabilities);
+  validatePolicyCredentialAdmissionV4Authority(session, {
+    nodeAudience: input.expectedNodeAudience,
+    enforcerDid: input.expectedEnforcerDid
+  });
+  if (session.cid !== value.sessionCid || session.aud !== input.credential.holderDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.credential.holderDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)) throw new Error("policy delegation signed binding is invalid");
+  input.signal?.throwIfAborted();
   return Object.freeze({ challenge, presentation, session });
 }
 
@@ -15048,6 +15215,236 @@ function createOpenKeyCallbackSigningStrategy(options2) {
 }
 var defaultSignStrategy = { type: "auto-sign" };
 
+// src/authorization/manage-key.ts
+var TINYCLOUD_MANAGE_KEY_SCOPE = "tinycloud:manage-key";
+var TINYCLOUD_CANONICAL_IDENTITY_CLAIM = "https://tinycloud.xyz/canonical_identity";
+function requestTinyCloudManageKeyScope(scopes = []) {
+  const requested = typeof scopes === "string" ? scopes.split(/\s+/u) : scopes;
+  return [
+    ...new Set([...requested, TINYCLOUD_MANAGE_KEY_SCOPE].filter(Boolean))
+  ].sort().join(" ");
+}
+function hasTinyCloudManageKeyScope(scopes) {
+  const values = Array.isArray(scopes) ? scopes : typeof scopes === "string" ? scopes.split(/\s+/u) : [];
+  return values.includes(TINYCLOUD_MANAGE_KEY_SCOPE);
+}
+var OpenKeyManageKeyError = class extends Error {
+  constructor(code3, message, approvalUrl, retryable = false) {
+    super(message);
+    this.code = code3;
+    this.approvalUrl = approvalUrl;
+    this.retryable = retryable;
+    this.name = "OpenKeyManageKeyError";
+  }
+};
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function rejected(message) {
+  return new OpenKeyManageKeyError("MESSAGE_REJECTED", message);
+}
+function identityMismatch(message) {
+  return new OpenKeyManageKeyError("IDENTITY_MISMATCH", message);
+}
+function parseCanonicalTinyCloudIdentity(value) {
+  if (!isRecord2(value))
+    throw rejected("Canonical TinyCloud identity is missing");
+  const expectedKeys = [
+    "address",
+    "chainId",
+    "did",
+    "keyId",
+    "spaceId",
+    "version"
+  ];
+  const actualKeys = Object.keys(value).sort();
+  if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
+    throw rejected("Canonical TinyCloud identity has an invalid shape");
+  }
+  if (value.version !== "v1")
+    throw rejected("Canonical TinyCloud identity version is unsupported");
+  if (typeof value.keyId !== "string" || value.keyId.trim() === "") {
+    throw rejected("Canonical TinyCloud identity key ID is invalid");
+  }
+  if (typeof value.address !== "string") {
+    throw rejected("Canonical TinyCloud identity address is invalid");
+  }
+  let address;
+  try {
+    address = canonicalizeAddress(value.address);
+  } catch {
+    throw rejected("Canonical TinyCloud identity address is invalid");
+  }
+  if (address !== value.address) {
+    throw rejected(
+      "Canonical TinyCloud identity address must use EIP-55 checksum casing"
+    );
+  }
+  if (typeof value.chainId !== "number" || !Number.isSafeInteger(value.chainId) || value.chainId <= 0) {
+    throw rejected("Canonical TinyCloud identity chain ID is invalid");
+  }
+  const did = pkhDid(address, value.chainId);
+  const spacePrefix = `tinycloud:pkh:eip155:${value.chainId}:${address}:`;
+  if (typeof value.spaceId !== "string" || !value.spaceId.startsWith(spacePrefix)) {
+    throw rejected("Canonical TinyCloud identity space is invalid");
+  }
+  const spaceName = value.spaceId.slice(spacePrefix.length);
+  let spaceId;
+  try {
+    spaceId = makePkhSpaceId(address, value.chainId, spaceName);
+  } catch {
+    throw rejected("Canonical TinyCloud identity space is invalid");
+  }
+  if (value.did !== did || value.spaceId !== spaceId) {
+    throw rejected("Canonical TinyCloud identity does not match its address");
+  }
+  return {
+    version: "v1",
+    keyId: value.keyId,
+    address,
+    chainId: value.chainId,
+    did,
+    spaceId
+  };
+}
+function parseCanonicalTinyCloudIdentityClaims(claims) {
+  if (!isRecord2(claims)) throw rejected("OAuth claims are missing");
+  return parseCanonicalTinyCloudIdentity(
+    claims[TINYCLOUD_CANONICAL_IDENTITY_CLAIM]
+  );
+}
+function identitiesEqual(left, right) {
+  return left.version === right.version && left.keyId === right.keyId && left.address === right.address && left.chainId === right.chainId && left.did === right.did && left.spaceId === right.spaceId;
+}
+function errorForResponse(body, status) {
+  const message = body?.reason ?? body?.error ?? `OpenKey manage-key signing failed with HTTP ${status}`;
+  switch (body?.code ?? body?.error) {
+    case "missing_scope":
+    case "consent_required":
+      return new OpenKeyManageKeyError("CONSENT_REQUIRED", message, body?.approvalUrl);
+    case "client_disabled":
+    case "signing_disabled":
+    case "grant_disabled":
+      return new OpenKeyManageKeyError("GRANT_DISABLED", message, body?.approvalUrl);
+    case "user_exclusive":
+      return new OpenKeyManageKeyError("USER_EXCLUSIVE", message, body?.approvalUrl);
+    case "token_expired":
+    case "token_too_old":
+    case "invalid_token":
+    case "expired_token":
+      return new OpenKeyManageKeyError("TOKEN_EXPIRED", message, body?.approvalUrl);
+    case "canonical_key_unavailable":
+    case "signer_failed":
+      return new OpenKeyManageKeyError(
+        "SIGNER_UNAVAILABLE",
+        "The canonical key signer is temporarily unavailable",
+        void 0,
+        true
+      );
+    default:
+      return new OpenKeyManageKeyError(
+        status === 401 ? "TOKEN_EXPIRED" : "MESSAGE_REJECTED",
+        message,
+        body?.approvalUrl
+      );
+  }
+}
+async function resolveToken(token) {
+  const value = typeof token === "function" ? await token() : token;
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new OpenKeyManageKeyError(
+      "CONSENT_REQUIRED",
+      "A manage-key OAuth bearer token is required"
+    );
+  }
+  return value;
+}
+function normalizeEndpoint(value) {
+  let endpoint;
+  try {
+    endpoint = new URL(value);
+  } catch {
+    throw rejected("OpenKey manage-key signing endpoint must be an absolute URL");
+  }
+  const rawHttpAuthority = value.match(/^http:\/\/([^/?#]*)/iu)?.[1];
+  const loopback = rawHttpAuthority !== void 0 && /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/u.test(rawHttpAuthority);
+  if (endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && loopback) || endpoint.username !== "" || endpoint.password !== "" || endpoint.search !== "" || endpoint.hash !== "") {
+    throw rejected("OpenKey manage-key signing endpoint must use HTTPS or exact loopback HTTP");
+  }
+  return endpoint.href;
+}
+function assertSignInRequest(request, identity3) {
+  if (request.type !== "siwe" || request.purpose !== "sign-in" || request.chainId !== identity3.chainId || request.address !== identity3.address || typeof request.message !== "string" || request.message.length === 0) {
+    throw rejected(
+      "Manage-key signing only permits the canonical sign-in SIWE request"
+    );
+  }
+}
+function createOpenKeyManageKeySigningStrategy(options2) {
+  const identity3 = parseCanonicalTinyCloudIdentity(options2.identity);
+  const endpoint = normalizeEndpoint(options2.endpoint);
+  return {
+    type: "callback",
+    openKeyAutoSign: true,
+    handler: async (request) => {
+      assertSignInRequest(request, identity3);
+      const fetchImpl = options2.fetch ?? globalThis.fetch;
+      if (!fetchImpl)
+        throw rejected("OpenKey manage-key signing requires fetch");
+      if (!hasTinyCloudManageKeyScope(options2.scopes)) {
+        throw new OpenKeyManageKeyError(
+          "CONSENT_REQUIRED",
+          "The OAuth bearer token was not granted tinycloud:manage-key"
+        );
+      }
+      const token = await resolveToken(options2.token);
+      const response = await fetchImpl(endpoint, {
+        method: "POST",
+        credentials: "omit",
+        headers: {
+          authorization: `Bearer ${token}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({
+          address: request.address,
+          chainId: request.chainId,
+          message: request.message,
+          type: "siwe"
+        })
+      });
+      let body;
+      try {
+        const value = await response.json();
+        body = isRecord2(value) ? value : void 0;
+      } catch {
+        body = void 0;
+      }
+      if (!response.ok || body?.approved !== true)
+        throw errorForResponse(body, response.status);
+      if (typeof body.signature !== "string")
+        throw rejected("OpenKey manage-key signer did not return a signature");
+      const responseIdentity = parseCanonicalTinyCloudIdentity(
+        body.canonicalIdentity
+      );
+      if (!identitiesEqual(identity3, responseIdentity)) {
+        throw identityMismatch(
+          "OpenKey manage-key signer returned a different canonical identity"
+        );
+      }
+      if (!await verifyEip191MessageSignature(
+        request.message,
+        body.signature,
+        identity3.address
+      )) {
+        throw rejected(
+          "OpenKey manage-key signer returned an invalid signature"
+        );
+      }
+      return { approved: true, signature: body.signature };
+    }
+  };
+}
+
 // src/authorization/spaceCreation.ts
 var AutoApproveSpaceCreationHandler = class {
   /**
@@ -17778,6 +18175,7 @@ export {
   DuckDbService2 as DuckDbService,
   ED25519_JCS_SIGNATURE_SUITE,
   EIP191_JCS_SIGNATURE_SUITE,
+  EMAIL_CREDENTIAL_MAX_AGE_SECONDS,
   ENCRYPTION,
   ENCRYPTION_MANIFEST_SPACE,
   ENCRYPTION_NETWORK_URN_PREFIX,
@@ -17816,6 +18214,7 @@ export {
   NETWORK_NAME_PATTERN,
   NetworkIdError,
   OPENKEY_ACTION_ID_SEPARATOR,
+  OpenKeyManageKeyError,
   POLICY_CAPABILITY_V1_DOMAIN,
   POLICY_CAPABILITY_V1_SCHEMA,
   POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE,
@@ -17828,6 +18227,8 @@ export {
   POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA,
   POLICY_PRESENTATION_V3_DOMAIN,
   POLICY_PRESENTATION_V3_SCHEMA,
+  POLICY_PRESENTATION_V4_DOMAIN,
+  POLICY_PRESENTATION_V4_SCHEMA,
   POLICY_SCHEMA,
   POLICY_SESSION_UCAN_V1_PROFILE,
   POLICY_STATUS_SCHEMA,
@@ -17886,7 +18287,9 @@ export {
   SpaceService,
   TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
   TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_CANONICAL_IDENTITY_CLAIM,
   TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_MANAGE_KEY_SCOPE,
   TINYCLOUD_PUBLIC_SPACE_MANIFEST,
   TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud,
@@ -17903,6 +18306,7 @@ export {
   activateSessionWithHost,
   addressStorageKey,
   admitPolicyCredentialV3,
+  admitPolicyCredentialV4,
   applyPrefix,
   bootstrapEncryptionNetworkId,
   bootstrapSpaceId,
@@ -17913,6 +18317,7 @@ export {
   buildDecryptInvocation,
   buildNetworkId2 as buildNetworkId,
   buildPolicyCredentialPresentationV3,
+  buildPolicyCredentialPresentationV4,
   buildSpaceUri,
   canonicalDigest,
   canonicalHashHex,
@@ -17943,10 +18348,12 @@ export {
   createAndSignSignedObject,
   createCapabilityKeyRegistry,
   createDelegatedShareKey,
+  createEmailCredentialRequirement,
   createHolderBinding,
   createInMemoryLocalNodeIdentityStore,
   createLocalStorageLocalNodeIdentityStore,
   createOpenKeyCallbackSigningStrategy,
+  createOpenKeyManageKeySigningStrategy,
   createPolicyEnforcementDelegation,
   createShareArtifact,
   createShareArtifactAsync,
@@ -18005,6 +18412,7 @@ export {
   generateRandomReceiverKey,
   getPolicyRootStatusV3,
   getTinyCloudDebugLogs,
+  hasTinyCloudManageKeyScope,
   hexDecode,
   hexEncode,
   holderBindingCanonicalBytes,
@@ -18019,6 +18427,7 @@ export {
   isNetworkId,
   isPlausibleOpenKeyActionId,
   isV2ShareLink,
+  issuedCredentialEnvelopeFromVerified,
   jcsCanonicalize,
   loadManifest,
   locationPayloadForRecord,
@@ -18037,6 +18446,8 @@ export {
   openWrappedKey,
   parseCanonicalNetworkId,
   parseCanonicalRecapResource,
+  parseCanonicalTinyCloudIdentity,
+  parseCanonicalTinyCloudIdentityClaims,
   parseCompactUcanAuthorization,
   parseExpiry,
   parseNetworkId2 as parseNetworkId,
@@ -18059,6 +18470,7 @@ export {
   projectUnifiedPolicyCapability,
   recapCaveatsEqual,
   renewPolicyRootStatusV3,
+  requestTinyCloudManageKeyScope,
   resolveCloudLocation,
   resolveManifest,
   resolveManifestKnowledgeRoot,
@@ -18078,6 +18490,7 @@ export {
   signCompactUcanAuthorization,
   signCompactUcanRootAuthorization,
   signLocationRecord,
+  signPolicyCredentialPresentationV4,
   signShareEnvelope,
   signedObjectIdFor,
   submitHostDelegation,