@tinycloud/sdk-core 3.0.0-beta.10 → 3.0.0-beta.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/dist/index.cjs +49 -2
  2. package/dist/index.cjs.map +1 -1
  3. package/dist/index.d.cts +25 -2
  4. package/dist/index.d.ts +25 -2
  5. package/dist/index.js +49 -2
  6. package/dist/index.js.map +1 -1
  7. package/dist/policy/index.cjs +3 -1
  8. package/dist/policy/index.cjs.map +1 -1
  9. package/dist/policy/index.js +3 -1
  10. package/dist/policy/index.js.map +1 -1
  11. package/package.json +2 -2
package/dist/index.d.cts CHANGED
@@ -202,7 +202,7 @@ declare function sha256Base64Url(value: string | Uint8Array): Promise<string>;
202
202
  declare function canonicalDigest(value: unknown): Promise<string>;
203
203
  declare function isDigest(value: unknown): value is string;
204
204
 
205
- declare const CREDENTIAL_ERROR_CODES: readonly ["ACTIVE_SESSION_REQUIRED", "CANCELED", "DESCRIPTOR_INVALID", "HOLDER_MISMATCH", "ISSUER_UNREADY", "OFFLINE", "POPUP_BLOCKED", "REQUEST_EXPIRED", "REQUEST_SUBSTITUTED", "SIGNATURE_REJECTED", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "VERIFICATION_FAILED", "VERIFIED_NOT_SAVED"];
205
+ declare const CREDENTIAL_ERROR_CODES: readonly ["ACTIVE_SESSION_REQUIRED", "CANCELED", "DESCRIPTOR_INVALID", "HOLDER_MISMATCH", "ISSUER_UNREADY", "OFFLINE", "POPUP_BLOCKED", "PROOF_REJECTED", "REQUEST_EXPIRED", "REQUEST_SUBSTITUTED", "SIGNATURE_REJECTED", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "VERIFICATION_FAILED", "VERIFIED_NOT_SAVED"];
206
206
  type CredentialErrorCode = (typeof CREDENTIAL_ERROR_CODES)[number];
207
207
  /** Stable, redaction-safe error returned by the credential acquisition module. */
208
208
  declare class CredentialError extends Error {
@@ -225,16 +225,39 @@ declare class CredentialError extends Error {
225
225
  declare function credentialError(value: unknown, fallbackCode?: CredentialErrorCode): CredentialError;
226
226
 
227
227
  declare const EMAIL_CREDENTIAL_MAX_AGE_SECONDS: 3600;
228
+ /** Matches the issuer's 300-second status freshness for mailbox proofs. */
229
+ declare const EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS: 300;
228
230
  declare function createEmailCredentialRequirement(input: {
229
231
  readonly email: string;
230
232
  readonly profile: CredentialRequirement["profile"];
231
233
  readonly credentialType: CredentialRequirement["credentialType"];
232
234
  }): CredentialRequirement;
235
+ /** Requirement satisfied by any proved mailbox whose issuer-derived domain equals `domain` exactly. */
236
+ declare function createEmailDomainCredentialRequirement(input: {
237
+ readonly domain: string;
238
+ readonly profile: CredentialRequirement["profile"];
239
+ readonly credentialType: CredentialRequirement["credentialType"];
240
+ }): CredentialRequirement;
233
241
  declare function validateCredentialRequirement(value: unknown): CredentialRequirement;
234
242
  declare function credentialRequirementDigest(requirement: CredentialRequirement): Promise<string>;
235
243
  declare function descriptorSatisfiesRequirement(descriptor: CredentialFlowDescriptor, requirement: CredentialRequirement): boolean;
236
244
  declare function credentialMatchesRequirement(requirement: CredentialRequirement, candidate: Pick<StoredCredentialRecord | VerifiedCredential, "profile" | "credentialType" | "claims" | "holderDid" | "expiresAt" | "issuedAt">, holderDid: string, now?: Date): boolean;
237
245
 
246
+ declare function isCanonicalEmailDomain(value: string): boolean;
247
+ /** Canonicalizes a sender-entered domain (`@Example.com` → `example.com`) or throws. */
248
+ declare function canonicalEmailDomain(value: string): string;
249
+ /**
250
+ * Canonical form of a recipient-entered mailbox (trimmed, lowercased), or
251
+ * undefined when it has no canonical domain. The issuer accepts only this
252
+ * form, so the local check agrees with what the credential will contain.
253
+ */
254
+ declare function canonicalMailbox(value: string): {
255
+ readonly email: string;
256
+ readonly domain: string;
257
+ } | undefined;
258
+ /** True only when the mailbox's canonical domain equals `domain` exactly (no suffix or subdomain match). */
259
+ declare function mailboxBelongsToDomain(mailbox: string, domain: string): boolean;
260
+
238
261
  declare function credentialRecordKey(recordId: string): string;
239
262
  declare function credentialIndexKey(requirementDigest: string, recordId: string): string;
240
263
  declare function createStoredCredentialRecord(input: {
@@ -3488,4 +3511,4 @@ declare const EXPIRY: {
3488
3511
  declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
3489
3512
  type ExpiryTier = keyof typeof EXPIRY;
3490
3513
 
3491
- export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };
3514
+ export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalEmailDomain, canonicalLocationPayload, canonicalMailbox, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCanonicalEmailDomain, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, mailboxBelongsToDomain, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };
package/dist/index.d.ts CHANGED
@@ -202,7 +202,7 @@ declare function sha256Base64Url(value: string | Uint8Array): Promise<string>;
202
202
  declare function canonicalDigest(value: unknown): Promise<string>;
203
203
  declare function isDigest(value: unknown): value is string;
204
204
 
205
- declare const CREDENTIAL_ERROR_CODES: readonly ["ACTIVE_SESSION_REQUIRED", "CANCELED", "DESCRIPTOR_INVALID", "HOLDER_MISMATCH", "ISSUER_UNREADY", "OFFLINE", "POPUP_BLOCKED", "REQUEST_EXPIRED", "REQUEST_SUBSTITUTED", "SIGNATURE_REJECTED", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "VERIFICATION_FAILED", "VERIFIED_NOT_SAVED"];
205
+ declare const CREDENTIAL_ERROR_CODES: readonly ["ACTIVE_SESSION_REQUIRED", "CANCELED", "DESCRIPTOR_INVALID", "HOLDER_MISMATCH", "ISSUER_UNREADY", "OFFLINE", "POPUP_BLOCKED", "PROOF_REJECTED", "REQUEST_EXPIRED", "REQUEST_SUBSTITUTED", "SIGNATURE_REJECTED", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "VERIFICATION_FAILED", "VERIFIED_NOT_SAVED"];
206
206
  type CredentialErrorCode = (typeof CREDENTIAL_ERROR_CODES)[number];
207
207
  /** Stable, redaction-safe error returned by the credential acquisition module. */
208
208
  declare class CredentialError extends Error {
@@ -225,16 +225,39 @@ declare class CredentialError extends Error {
225
225
  declare function credentialError(value: unknown, fallbackCode?: CredentialErrorCode): CredentialError;
226
226
 
227
227
  declare const EMAIL_CREDENTIAL_MAX_AGE_SECONDS: 3600;
228
+ /** Matches the issuer's 300-second status freshness for mailbox proofs. */
229
+ declare const EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS: 300;
228
230
  declare function createEmailCredentialRequirement(input: {
229
231
  readonly email: string;
230
232
  readonly profile: CredentialRequirement["profile"];
231
233
  readonly credentialType: CredentialRequirement["credentialType"];
232
234
  }): CredentialRequirement;
235
+ /** Requirement satisfied by any proved mailbox whose issuer-derived domain equals `domain` exactly. */
236
+ declare function createEmailDomainCredentialRequirement(input: {
237
+ readonly domain: string;
238
+ readonly profile: CredentialRequirement["profile"];
239
+ readonly credentialType: CredentialRequirement["credentialType"];
240
+ }): CredentialRequirement;
233
241
  declare function validateCredentialRequirement(value: unknown): CredentialRequirement;
234
242
  declare function credentialRequirementDigest(requirement: CredentialRequirement): Promise<string>;
235
243
  declare function descriptorSatisfiesRequirement(descriptor: CredentialFlowDescriptor, requirement: CredentialRequirement): boolean;
236
244
  declare function credentialMatchesRequirement(requirement: CredentialRequirement, candidate: Pick<StoredCredentialRecord | VerifiedCredential, "profile" | "credentialType" | "claims" | "holderDid" | "expiresAt" | "issuedAt">, holderDid: string, now?: Date): boolean;
237
245
 
246
+ declare function isCanonicalEmailDomain(value: string): boolean;
247
+ /** Canonicalizes a sender-entered domain (`@Example.com` → `example.com`) or throws. */
248
+ declare function canonicalEmailDomain(value: string): string;
249
+ /**
250
+ * Canonical form of a recipient-entered mailbox (trimmed, lowercased), or
251
+ * undefined when it has no canonical domain. The issuer accepts only this
252
+ * form, so the local check agrees with what the credential will contain.
253
+ */
254
+ declare function canonicalMailbox(value: string): {
255
+ readonly email: string;
256
+ readonly domain: string;
257
+ } | undefined;
258
+ /** True only when the mailbox's canonical domain equals `domain` exactly (no suffix or subdomain match). */
259
+ declare function mailboxBelongsToDomain(mailbox: string, domain: string): boolean;
260
+
238
261
  declare function credentialRecordKey(recordId: string): string;
239
262
  declare function credentialIndexKey(requirementDigest: string, recordId: string): string;
240
263
  declare function createStoredCredentialRecord(input: {
@@ -3488,4 +3511,4 @@ declare const EXPIRY: {
3488
3511
  declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
3489
3512
  type ExpiryTier = keyof typeof EXPIRY;
3490
3513
 
3491
- export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };
3514
+ export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalEmailDomain, canonicalLocationPayload, canonicalMailbox, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCanonicalEmailDomain, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, mailboxBelongsToDomain, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };
package/dist/index.js CHANGED
@@ -311,6 +311,7 @@ var CREDENTIAL_ERROR_CODES = [
311
311
  "ISSUER_UNREADY",
312
312
  "OFFLINE",
313
313
  "POPUP_BLOCKED",
314
+ "PROOF_REJECTED",
314
315
  "REQUEST_EXPIRED",
315
316
  "REQUEST_SUBSTITUTED",
316
317
  "SIGNATURE_REJECTED",
@@ -324,6 +325,7 @@ var RECOVERABLE = /* @__PURE__ */ new Set([
324
325
  "ISSUER_UNREADY",
325
326
  "OFFLINE",
326
327
  "POPUP_BLOCKED",
328
+ "PROOF_REJECTED",
327
329
  "REQUEST_EXPIRED",
328
330
  "SIGNATURE_REJECTED",
329
331
  "UNSUPPORTED_PROFILE",
@@ -392,6 +394,7 @@ function holderBindingSigningBytes(binding) {
392
394
 
393
395
  // src/credentials/descriptor.ts
394
396
  var ID = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
397
+ var CLAIM_NAME = /^[a-z0-9][A-Za-z0-9._-]{0,127}$/;
395
398
  var STEP_TYPES = /* @__PURE__ */ new Set(["collect_input", "mailbox_otp", "holder_signature"]);
396
399
  var ENDPOINTS = {
397
400
  request: "request",
@@ -472,7 +475,7 @@ function validateCredentialFlowDescriptor(value) {
472
475
  for (const value2 of raw.claims) {
473
476
  const claim = object(value2, "claim");
474
477
  exact(claim, ["name", "matching", "selectiveDisclosure"], "claim");
475
- const name2 = text(claim.name, "claim.name", ID);
478
+ const name2 = text(claim.name, "claim.name", CLAIM_NAME);
476
479
  if (claimNames.has(name2) || claim.matching !== "normalized_exact" || typeof claim.selectiveDisclosure !== "boolean") fail("claim is invalid");
477
480
  claimNames.add(name2);
478
481
  }
@@ -563,9 +566,36 @@ function isDigest(value) {
563
566
  return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
564
567
  }
565
568
 
569
+ // src/credentials/email-domain.ts
570
+ var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
571
+ function isCanonicalEmailDomain(value) {
572
+ if (value.length === 0 || value.length > 253) return false;
573
+ const labels = value.split(".");
574
+ return labels.length >= 2 && labels.every((label) => LABEL.test(label)) && !/^[0-9]+$/.test(labels.at(-1));
575
+ }
576
+ function canonicalEmailDomain(value) {
577
+ const domain = value.trim().replace(/^@/, "").toLowerCase();
578
+ if (!/^[\x21-\x7e]+$/.test(domain) || !isCanonicalEmailDomain(domain)) throw new TypeError("email domain must be lowercase ASCII DNS labels (use the xn-- form for international domains)");
579
+ return domain;
580
+ }
581
+ function canonicalMailbox(value) {
582
+ const email = value.trim().toLowerCase();
583
+ const at = email.indexOf("@");
584
+ if (at <= 0 || at !== email.lastIndexOf("@")) return void 0;
585
+ const local = email.slice(0, at);
586
+ const domain = email.slice(at + 1);
587
+ if (local.length > 64 || !/^[a-z0-9#$&'*+/=?^_`{|}~-]+(?:\.[a-z0-9#$&'*+/=?^_`{|}~-]+)*$/.test(local) || !isCanonicalEmailDomain(domain)) return void 0;
588
+ return Object.freeze({ email, domain });
589
+ }
590
+ function mailboxBelongsToDomain(mailbox, domain) {
591
+ return canonicalMailbox(mailbox)?.domain === domain && isCanonicalEmailDomain(domain);
592
+ }
593
+
566
594
  // src/credentials/requirement.ts
567
595
  var ID2 = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
568
596
  var EMAIL_CREDENTIAL_MAX_AGE_SECONDS = 3600;
597
+ var EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS = 300;
598
+ var CLAIM_NAME2 = /^[a-z0-9][A-Za-z0-9._-]{0,127}$/;
569
599
  function createEmailCredentialRequirement(input) {
570
600
  return validateCredentialRequirement({
571
601
  type: "TinyCloudCredentialRequirement",
@@ -576,6 +606,17 @@ function createEmailCredentialRequirement(input) {
576
606
  maxAgeSeconds: EMAIL_CREDENTIAL_MAX_AGE_SECONDS
577
607
  });
578
608
  }
609
+ function createEmailDomainCredentialRequirement(input) {
610
+ if (!isCanonicalEmailDomain(input.domain)) throw new CredentialError("UNSUPPORTED_PROFILE", "Email domain is not canonical");
611
+ return validateCredentialRequirement({
612
+ type: "TinyCloudCredentialRequirement",
613
+ version: 1,
614
+ profile: input.profile,
615
+ credentialType: input.credentialType,
616
+ claims: { emailDomain: input.domain },
617
+ maxAgeSeconds: EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS
618
+ });
619
+ }
579
620
  function validateCredentialRequirement(value) {
580
621
  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential requirement is invalid");
581
622
  const raw = value;
@@ -589,7 +630,7 @@ function validateCredentialRequirement(value) {
589
630
  if (typeof raw.claims !== "object" || raw.claims === null || Array.isArray(raw.claims)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claims are invalid");
590
631
  const claims = {};
591
632
  for (const [key, value2] of Object.entries(raw.claims).sort(([a], [b]) => a.localeCompare(b))) {
592
- if (!ID2.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
633
+ if (!CLAIM_NAME2.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
593
634
  claims[key] = value2;
594
635
  }
595
636
  if (raw.maxAgeSeconds !== void 0 && (!Number.isSafeInteger(raw.maxAgeSeconds) || raw.maxAgeSeconds < 1)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential freshness is invalid");
@@ -18445,6 +18486,7 @@ export {
18445
18486
  ED25519_JCS_SIGNATURE_SUITE,
18446
18487
  EIP191_JCS_SIGNATURE_SUITE,
18447
18488
  EMAIL_CREDENTIAL_MAX_AGE_SECONDS,
18489
+ EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS,
18448
18490
  ENCRYPTION,
18449
18491
  ENCRYPTION_MANIFEST_SPACE,
18450
18492
  ENCRYPTION_NETWORK_URN_PREFIX,
@@ -18589,8 +18631,10 @@ export {
18589
18631
  buildPolicyCredentialPresentationV4,
18590
18632
  buildSpaceUri,
18591
18633
  canonicalDigest,
18634
+ canonicalEmailDomain,
18592
18635
  canonicalHashHex,
18593
18636
  canonicalLocationPayload,
18637
+ canonicalMailbox,
18594
18638
  canonicalOwnerSharePolicy,
18595
18639
  canonicalSignedResponse,
18596
18640
  canonicalizeAddress,
@@ -18618,6 +18662,7 @@ export {
18618
18662
  createCapabilityKeyRegistry,
18619
18663
  createDelegatedShareKey,
18620
18664
  createEmailCredentialRequirement,
18665
+ createEmailDomainCredentialRequirement,
18621
18666
  createHolderBinding,
18622
18667
  createInMemoryLocalNodeIdentityStore,
18623
18668
  createLocalStorageLocalNodeIdentityStore,
@@ -18690,6 +18735,7 @@ export {
18690
18735
  importPortableDelegation,
18691
18736
  installTinyCloudDebugGlobals,
18692
18737
  intersectShareCapabilities,
18738
+ isCanonicalEmailDomain,
18693
18739
  isCapabilitySubset,
18694
18740
  isDigest,
18695
18741
  isEvmAddress,
@@ -18700,6 +18746,7 @@ export {
18700
18746
  jcsCanonicalize,
18701
18747
  loadManifest,
18702
18748
  locationPayloadForRecord,
18749
+ mailboxBelongsToDomain,
18703
18750
  makePkhSpaceId,
18704
18751
  makePublicSpaceId,
18705
18752
  manifestAbilitiesUnion,