@tinycloud/sdk-core 3.0.0-beta.13 → 3.0.0-beta.15

package/dist/index.cjs

@@ -127,6 +127,7 @@ __export(index_exports, {
   LOCAL_LINK_PROBE_TIMEOUT_MS: () => LOCAL_LINK_PROBE_TIMEOUT_MS,
   LOCAL_LOOPBACK_PROBE_TIMEOUT_MS: () => LOCAL_LOOPBACK_PROBE_TIMEOUT_MS,
   LocationRecordValidationError: () => LocationRecordValidationError,
+  LocationRegistryHttpError: () => LocationRegistryHttpError,
   MAX_CONTENT_BYTES: () => MAX_CONTENT_BYTES,
   MAX_LEGACY_ENVELOPE_EXPIRES_AT: () => MAX_LEGACY_ENVELOPE_EXPIRES_AT,
   MAX_SEALED_SHARE_CONTENT_BYTES: () => MAX_SEALED_SHARE_CONTENT_BYTES,
@@ -246,10 +247,10 @@ __export(index_exports, {
   buildPolicyCredentialPresentationV4: () => buildPolicyCredentialPresentationV4,
   buildSpaceUri: () => buildSpaceUri,
   canonicalDigest: () => canonicalDigest,
-  canonicalEmailDomain: () => canonicalEmailDomain,
+  canonicalEmailDomain: () => import_share_envelope.canonicalEmailDomain,
   canonicalHashHex: () => import_sdk_services8.canonicalHashHex,
   canonicalLocationPayload: () => canonicalLocationPayload,
-  canonicalMailbox: () => canonicalMailbox,
+  canonicalMailbox: () => import_share_envelope.canonicalMailbox,
   canonicalOwnerSharePolicy: () => canonicalOwnerSharePolicy,
   canonicalSignedResponse: () => import_sdk_services8.canonicalSignedResponse,
   canonicalizeAddress: () => canonicalizeAddress,
@@ -350,7 +351,7 @@ __export(index_exports, {
   importPortableDelegation: () => importPortableDelegation,
   installTinyCloudDebugGlobals: () => import_sdk_services8.installTinyCloudDebugGlobals,
   intersectShareCapabilities: () => intersectShareCapabilities,
-  isCanonicalEmailDomain: () => isCanonicalEmailDomain,
+  isCanonicalEmailDomain: () => import_share_envelope.isCanonicalEmailDomain,
   isCapabilitySubset: () => isCapabilitySubset,
   isDigest: () => isDigest,
   isEvmAddress: () => isEvmAddress,
@@ -361,7 +362,7 @@ __export(index_exports, {
   jcsCanonicalize: () => jcsCanonicalize,
   loadManifest: () => loadManifest,
   locationPayloadForRecord: () => locationPayloadForRecord,
-  mailboxBelongsToDomain: () => mailboxBelongsToDomain,
+  mailboxBelongsToDomain: () => import_share_envelope.mailboxBelongsToDomain,
   makePkhSpaceId: () => makePkhSpaceId,
   makePublicSpaceId: () => makePublicSpaceId,
   manifestAbilitiesUnion: () => manifestAbilitiesUnion,
@@ -1030,29 +1031,7 @@ function isDigest(value) {
 }
 
 // src/credentials/email-domain.ts
-var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-function isCanonicalEmailDomain(value) {
-  if (value.length === 0 || value.length > 253) return false;
-  const labels = value.split(".");
-  return labels.length >= 2 && labels.every((label) => LABEL.test(label)) && !/^[0-9]+$/.test(labels.at(-1));
-}
-function canonicalEmailDomain(value) {
-  const domain = value.trim().replace(/^@/, "").toLowerCase();
-  if (!/^[\x21-\x7e]+$/.test(domain) || !isCanonicalEmailDomain(domain)) throw new TypeError("email domain must be lowercase ASCII DNS labels (use the xn-- form for international domains)");
-  return domain;
-}
-function canonicalMailbox(value) {
-  const email = value.trim().toLowerCase();
-  const at = email.indexOf("@");
-  if (at <= 0 || at !== email.lastIndexOf("@")) return void 0;
-  const local = email.slice(0, at);
-  const domain = email.slice(at + 1);
-  if (local.length > 64 || !/^[a-z0-9#$&'*+/=?^_`{|}~-]+(?:\.[a-z0-9#$&'*+/=?^_`{|}~-]+)*$/.test(local) || !isCanonicalEmailDomain(domain)) return void 0;
-  return Object.freeze({ email, domain });
-}
-function mailboxBelongsToDomain(mailbox, domain) {
-  return canonicalMailbox(mailbox)?.domain === domain && isCanonicalEmailDomain(domain);
-}
+var import_share_envelope = require("@tinycloud/share-envelope");
 
 // src/credentials/requirement.ts
 var ID2 = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
@@ -1070,7 +1049,7 @@ function createEmailCredentialRequirement(input) {
   });
 }
 function createEmailDomainCredentialRequirement(input) {
-  if (!isCanonicalEmailDomain(input.domain)) throw new CredentialError("UNSUPPORTED_PROFILE", "Email domain is not canonical");
+  if (!(0, import_share_envelope.isCanonicalEmailDomain)(input.domain)) throw new CredentialError("UNSUPPORTED_PROFILE", "Email domain is not canonical");
   return validateCredentialRequirement({
     type: "TinyCloudCredentialRequirement",
     version: 1,
@@ -6546,6 +6525,7 @@ var DelegationErrorSchema = import_zod4.z.object({
 });
 var DelegationErrorCodes = {
   AUTH_REQUIRED: "AUTH_REQUIRED",
+  AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
   AUTH_EXPIRED: "AUTH_EXPIRED",
   NOT_INITIALIZED: "NOT_INITIALIZED",
   NOT_FOUND: "NOT_FOUND",
@@ -10928,6 +10908,13 @@ var ShareRecipientClient = class {
 };
 
 // src/delegations/SharingService.ts
+function spaceIdsEqual(left, right) {
+  const normalizeOwnerAddress = (space) => {
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
+  };
+  return normalizeOwnerAddress(left) === normalizeOwnerAddress(right);
+}
 function inferShortServiceFromActionUrns(actions) {
   let short;
   for (const action of actions) {
@@ -11250,7 +11237,7 @@ var SharingService = class {
     for (const key of allKeys) {
       const delegations = this.registry.getDelegationsForKey(key.id);
       for (const delegation of delegations) {
-        if (delegation.spaceId !== this.session?.spaceId) {
+        if (delegation.spaceId === void 0 || !spaceIdsEqual(delegation.spaceId, this.session?.spaceId ?? "")) {
           continue;
         }
         if ((delegation.caveats?.length ?? 0) > 0) {
@@ -11378,11 +11365,23 @@ var SharingService = class {
           const errorText = await registerRes.text();
           const registrationTextActiveError = this.retiredGraphError();
           if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };
+          const message = `Failed to register delegation with server: ${registerRes.status} ${errorText}`;
+          if (registerRes.status === 401 || registerRes.status === 403) {
+            return {
+              ok: false,
+              error: createError2(
+                DelegationErrorCodes.AUTH_UNAUTHORIZED,
+                message,
+                void 0,
+                { status: registerRes.status }
+              )
+            };
+          }
           return {
             ok: false,
             error: createError2(
               DelegationErrorCodes.CREATION_FAILED,
-              `Failed to register delegation with server: ${registerRes.status} ${errorText}`
+              message
             )
           };
         }
@@ -17982,6 +17981,13 @@ var LocationRecordValidationError = class extends Error {
     this.name = "LocationRecordValidationError";
   }
 };
+var LocationRegistryHttpError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "LocationRegistryHttpError";
+  }
+};
 var CloudLocationResolutionError = class extends Error {
   constructor(subject, attempts) {
     super(`Unable to resolve TinyCloud location for ${subject}`);
@@ -18075,7 +18081,7 @@ async function fetchLocationRecord(registryUrl, subject, fetchFn = globalThis.fe
     return null;
   }
   if (!response.ok) {
-    throw new Error(`location registry returned HTTP ${response.status}`);
+    throw new LocationRegistryHttpError(`location registry returned HTTP ${response.status}`, response.status);
   }
   const text2 = await boundedResponseText(response, "location registry", 64 * 1024);
   let body;
@@ -18120,7 +18126,7 @@ async function publishLocationRecord(options2) {
     }
   );
   if (!response.ok) {
-    throw new Error(`location registry publish returned HTTP ${response.status}`);
+    throw new LocationRegistryHttpError(`location registry publish returned HTTP ${response.status}`, response.status);
   }
   const text2 = await boundedResponseText(response, "location registry", 64 * 1024);
   let body;