@tinycloud/sdk-core 3.0.0-beta.14 → 3.0.0-beta.17

package/dist/index.d.cts

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { bo as CredentialHolderBinding, bp as CredentialFlowDescriptor, bq as CredentialRequirement, br as StoredCredentialRecord, bs as VerifiedCredential, bt as CredentialStorageReceipt, bu as IssuedCredentialEnvelope, bv as CredentialIssuerMetadata } from './credential-admission-CFjUChF8.cjs';
 export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bw as CREDENTIAL_ACQUISITION_PROTOCOL, bx as CREDENTIAL_CONTRACT_VERSION, by as CREDENTIAL_FORMAT, bw as CREDENTIAL_PROTOCOL, bz as CREDENTIAL_STEP_REGISTRY_VERSION, g as CompactUcanAuthorizationV1, bA as CredentialClaimDescriptor, bB as CredentialEndpointId, bC as CredentialInputDescriptor, bD as CredentialProgressEvent, bE as CredentialStepDescriptor, bF as CredentialStepType, bG as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, h as EIP191_JCS_SIGNATURE_SUITE, bH as HOLDER_BINDING_DOMAIN, bI as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, i as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, j as POLICY_CAPABILITY_V1_DOMAIN, k as POLICY_CAPABILITY_V1_SCHEMA, l as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, m as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, n as POLICY_ENGINE_RECORD_SCHEMA, o as POLICY_PRESENTATION_V3_DOMAIN, p as POLICY_PRESENTATION_V3_SCHEMA, q as POLICY_PRESENTATION_V4_DOMAIN, r as POLICY_PRESENTATION_V4_SCHEMA, s as POLICY_SCHEMA, t as POLICY_SESSION_UCAN_V1_PROFILE, u as POLICY_STATUS_SCHEMA, v as POLICY_V1_DOMAIN, w as POLICY_V1_SCHEMA, x as POLICY_V2_DOMAIN, y as POLICY_V2_SCHEMA, a as Policy, D as PolicyCredentialAdmissionV3, F as PolicyCredentialAdmissionV4, G as PolicyCredentialPresentationV3, H as PolicyCredentialPresentationV4, I as PolicyCredentialRequirementV1, P as PolicyEngineRecord, K as PolicyRootStatusV3, O as PolicyRootV3, Q as PolicySessionUcanFactV1, R as PolicySessionUcanV1, T as PolicyStatus, V as ROOT_REVOCATION_V1_DOMAIN, W as ROOT_REVOCATION_V1_SCHEMA, X as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Y as ROOT_STATUS_RENEWAL_V1_DOMAIN, Z as ROOT_STATUS_V1_DOMAIN, _ as RegisterPolicyV3Input, $ as RegisterPolicyV3Receipt, a0 as SignCompactUcanAuthorizationInput, a1 as SignCompactUcanRootAuthorizationInput, a2 as SignatureMaterialError, a3 as SignatureSuite, a4 as SignatureVerificationError, a5 as SignedObjectCanonicalizationError, a6 as SignedObjectDigestError, a7 as SignedObjectErrorCode, a8 as SignedObjectIdError, a9 as SignedObjectKind, aa as SignedObjectMaterial, ab as SignedObjectProfileError, ac as SignedObjectSchemaError, ad as SignedObjectSignature, S as SignedObjectSigner, ae as SignedObjectVerificationResult, af as SignedPolicyObject, ag as SigningKeyBindingError, ah as UnifiedContentSource, ai as UnifiedEncryptionCapability, aj as UnifiedKvCapability, ak as UnifiedNativeCapability, al as UnifiedPolicyCapability, am as UnifiedPolicyV1, an as UnifiedPolicyV2, ao as UnifiedResourceSelector, ap as UnsignedPolicy, aq as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, ar as UnsignedPolicyObject, as as UnsignedPolicyStatus, at as UnsignedUnifiedPolicyV2, au as UnsupportedSignatureSuiteError, av as admitPolicyCredentialV3, aw as admitPolicyCredentialV4, ax as buildPolicyCredentialPresentationV3, ay as buildPolicyCredentialPresentationV4, az as canonicalizeSignedObjectUnsigned, aA as canonicalizeUnifiedPolicyCapability, aB as compactAttenuationContains, aC as contentSourceDigestHex, aD as createAndSignPolicy, aE as createAndSignPolicyEngineRecord, aF as createAndSignPolicyStatus, aG as createAndSignSignedObject, aJ as deriveSignedObjectMaterial, aK as getPolicyRootStatusV3, aL as issuedCredentialEnvelopeFromVerified, aN as normalizeUnifiedPolicyCapability, aO as parseCompactUcanAuthorization, aP as parsePolicySessionUcan, aQ as policyCidFromCanonicalBytes, aR as policyDigestHex, aS as policyIdForDigestHex, aT as policyV2DigestHex, aU as projectUnifiedPolicyCapabilities, aV as projectUnifiedPolicyCapability, aW as registerPolicyV3, aX as renewPolicyRootStatusV3, aZ as revokePolicyRootV3, a_ as signCompactUcanAuthorization, a$ as signCompactUcanRootAuthorization, b0 as signPolicyCredentialPresentationV4, b1 as signedObjectIdFor, b2 as toSignedObjectError, b3 as unifiedNativeProjectionHashHex, b4 as unifiedPolicyCapabilityContains, b5 as unifiedPolicyCapabilityDigestHex, b6 as unifiedPolicyCapabilityFromNative, b7 as validatePolicyCredentialRequirementV1, b8 as validatePolicyEngineRecordSigned, b9 as validatePolicyEngineRecordSignedShape, ba as validatePolicyEngineRecordUnsigned, bb as validatePolicySigned, bc as validatePolicySignedShape, bd as validatePolicyStatusSigned, be as validatePolicyStatusSignedShape, bf as validatePolicyStatusUnsigned, bg as validatePolicyUnsigned, bh as validateUnifiedPolicyV2, bi as verifyPolicy, bj as verifyPolicyEngineRecord, bk as verifyPolicyRootRevocationV3, bl as verifyPolicyRootStatusCheckpointV3, bm as verifyPolicyStatus, bn as verifySignedObject } from './credential-admission-CFjUChF8.cjs';
+export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, parseSecretCatalogKey, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
@@ -243,21 +244,6 @@ declare function credentialRequirementDigest(requirement: CredentialRequirement)
 declare function descriptorSatisfiesRequirement(descriptor: CredentialFlowDescriptor, requirement: CredentialRequirement): boolean;
 declare function credentialMatchesRequirement(requirement: CredentialRequirement, candidate: Pick<StoredCredentialRecord | VerifiedCredential, "profile" | "credentialType" | "claims" | "holderDid" | "expiresAt" | "issuedAt">, holderDid: string, now?: Date): boolean;
 
-declare function isCanonicalEmailDomain(value: string): boolean;
-/** Canonicalizes a sender-entered domain (`@Example.com` → `example.com`) or throws. */
-declare function canonicalEmailDomain(value: string): string;
-/**
- * Canonical form of a recipient-entered mailbox (trimmed, lowercased), or
- * undefined when it has no canonical domain. The issuer accepts only this
- * form, so the local check agrees with what the credential will contain.
- */
-declare function canonicalMailbox(value: string): {
-    readonly email: string;
-    readonly domain: string;
-} | undefined;
-/** True only when the mailbox's canonical domain equals `domain` exactly (no suffix or subdomain match). */
-declare function mailboxBelongsToDomain(mailbox: string, domain: string): boolean;
-
 declare function credentialRecordKey(recordId: string): string;
 declare function credentialIndexKey(requirementDigest: string, recordId: string): string;
 declare function createStoredCredentialRecord(input: {
@@ -3430,6 +3416,11 @@ type LocationRecordSigner = {
 declare class LocationRecordValidationError extends Error {
     constructor(message: string);
 }
+/** The location registry answered with a non-success HTTP status. */
+declare class LocationRegistryHttpError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
 declare class CloudLocationResolutionError extends Error {
     readonly attempts: LocationResolutionAttempt[];
     constructor(subject: string, attempts: LocationResolutionAttempt[]);
@@ -3511,4 +3502,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalEmailDomain, canonicalLocationPayload, canonicalMailbox, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCanonicalEmailDomain, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, mailboxBelongsToDomain, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { bo as CredentialHolderBinding, bp as CredentialFlowDescriptor, bq as CredentialRequirement, br as StoredCredentialRecord, bs as VerifiedCredential, bt as CredentialStorageReceipt, bu as IssuedCredentialEnvelope, bv as CredentialIssuerMetadata } from './credential-admission-DIEPgQ0o.js';
 export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bw as CREDENTIAL_ACQUISITION_PROTOCOL, bx as CREDENTIAL_CONTRACT_VERSION, by as CREDENTIAL_FORMAT, bw as CREDENTIAL_PROTOCOL, bz as CREDENTIAL_STEP_REGISTRY_VERSION, g as CompactUcanAuthorizationV1, bA as CredentialClaimDescriptor, bB as CredentialEndpointId, bC as CredentialInputDescriptor, bD as CredentialProgressEvent, bE as CredentialStepDescriptor, bF as CredentialStepType, bG as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, h as EIP191_JCS_SIGNATURE_SUITE, bH as HOLDER_BINDING_DOMAIN, bI as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, i as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, j as POLICY_CAPABILITY_V1_DOMAIN, k as POLICY_CAPABILITY_V1_SCHEMA, l as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, m as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, n as POLICY_ENGINE_RECORD_SCHEMA, o as POLICY_PRESENTATION_V3_DOMAIN, p as POLICY_PRESENTATION_V3_SCHEMA, q as POLICY_PRESENTATION_V4_DOMAIN, r as POLICY_PRESENTATION_V4_SCHEMA, s as POLICY_SCHEMA, t as POLICY_SESSION_UCAN_V1_PROFILE, u as POLICY_STATUS_SCHEMA, v as POLICY_V1_DOMAIN, w as POLICY_V1_SCHEMA, x as POLICY_V2_DOMAIN, y as POLICY_V2_SCHEMA, a as Policy, D as PolicyCredentialAdmissionV3, F as PolicyCredentialAdmissionV4, G as PolicyCredentialPresentationV3, H as PolicyCredentialPresentationV4, I as PolicyCredentialRequirementV1, P as PolicyEngineRecord, K as PolicyRootStatusV3, O as PolicyRootV3, Q as PolicySessionUcanFactV1, R as PolicySessionUcanV1, T as PolicyStatus, V as ROOT_REVOCATION_V1_DOMAIN, W as ROOT_REVOCATION_V1_SCHEMA, X as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Y as ROOT_STATUS_RENEWAL_V1_DOMAIN, Z as ROOT_STATUS_V1_DOMAIN, _ as RegisterPolicyV3Input, $ as RegisterPolicyV3Receipt, a0 as SignCompactUcanAuthorizationInput, a1 as SignCompactUcanRootAuthorizationInput, a2 as SignatureMaterialError, a3 as SignatureSuite, a4 as SignatureVerificationError, a5 as SignedObjectCanonicalizationError, a6 as SignedObjectDigestError, a7 as SignedObjectErrorCode, a8 as SignedObjectIdError, a9 as SignedObjectKind, aa as SignedObjectMaterial, ab as SignedObjectProfileError, ac as SignedObjectSchemaError, ad as SignedObjectSignature, S as SignedObjectSigner, ae as SignedObjectVerificationResult, af as SignedPolicyObject, ag as SigningKeyBindingError, ah as UnifiedContentSource, ai as UnifiedEncryptionCapability, aj as UnifiedKvCapability, ak as UnifiedNativeCapability, al as UnifiedPolicyCapability, am as UnifiedPolicyV1, an as UnifiedPolicyV2, ao as UnifiedResourceSelector, ap as UnsignedPolicy, aq as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, ar as UnsignedPolicyObject, as as UnsignedPolicyStatus, at as UnsignedUnifiedPolicyV2, au as UnsupportedSignatureSuiteError, av as admitPolicyCredentialV3, aw as admitPolicyCredentialV4, ax as buildPolicyCredentialPresentationV3, ay as buildPolicyCredentialPresentationV4, az as canonicalizeSignedObjectUnsigned, aA as canonicalizeUnifiedPolicyCapability, aB as compactAttenuationContains, aC as contentSourceDigestHex, aD as createAndSignPolicy, aE as createAndSignPolicyEngineRecord, aF as createAndSignPolicyStatus, aG as createAndSignSignedObject, aJ as deriveSignedObjectMaterial, aK as getPolicyRootStatusV3, aL as issuedCredentialEnvelopeFromVerified, aN as normalizeUnifiedPolicyCapability, aO as parseCompactUcanAuthorization, aP as parsePolicySessionUcan, aQ as policyCidFromCanonicalBytes, aR as policyDigestHex, aS as policyIdForDigestHex, aT as policyV2DigestHex, aU as projectUnifiedPolicyCapabilities, aV as projectUnifiedPolicyCapability, aW as registerPolicyV3, aX as renewPolicyRootStatusV3, aZ as revokePolicyRootV3, a_ as signCompactUcanAuthorization, a$ as signCompactUcanRootAuthorization, b0 as signPolicyCredentialPresentationV4, b1 as signedObjectIdFor, b2 as toSignedObjectError, b3 as unifiedNativeProjectionHashHex, b4 as unifiedPolicyCapabilityContains, b5 as unifiedPolicyCapabilityDigestHex, b6 as unifiedPolicyCapabilityFromNative, b7 as validatePolicyCredentialRequirementV1, b8 as validatePolicyEngineRecordSigned, b9 as validatePolicyEngineRecordSignedShape, ba as validatePolicyEngineRecordUnsigned, bb as validatePolicySigned, bc as validatePolicySignedShape, bd as validatePolicyStatusSigned, be as validatePolicyStatusSignedShape, bf as validatePolicyStatusUnsigned, bg as validatePolicyUnsigned, bh as validateUnifiedPolicyV2, bi as verifyPolicy, bj as verifyPolicyEngineRecord, bk as verifyPolicyRootRevocationV3, bl as verifyPolicyRootStatusCheckpointV3, bm as verifyPolicyStatus, bn as verifySignedObject } from './credential-admission-DIEPgQ0o.js';
+export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, parseSecretCatalogKey, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
@@ -243,21 +244,6 @@ declare function credentialRequirementDigest(requirement: CredentialRequirement)
 declare function descriptorSatisfiesRequirement(descriptor: CredentialFlowDescriptor, requirement: CredentialRequirement): boolean;
 declare function credentialMatchesRequirement(requirement: CredentialRequirement, candidate: Pick<StoredCredentialRecord | VerifiedCredential, "profile" | "credentialType" | "claims" | "holderDid" | "expiresAt" | "issuedAt">, holderDid: string, now?: Date): boolean;
 
-declare function isCanonicalEmailDomain(value: string): boolean;
-/** Canonicalizes a sender-entered domain (`@Example.com` → `example.com`) or throws. */
-declare function canonicalEmailDomain(value: string): string;
-/**
- * Canonical form of a recipient-entered mailbox (trimmed, lowercased), or
- * undefined when it has no canonical domain. The issuer accepts only this
- * form, so the local check agrees with what the credential will contain.
- */
-declare function canonicalMailbox(value: string): {
-    readonly email: string;
-    readonly domain: string;
-} | undefined;
-/** True only when the mailbox's canonical domain equals `domain` exactly (no suffix or subdomain match). */
-declare function mailboxBelongsToDomain(mailbox: string, domain: string): boolean;
-
 declare function credentialRecordKey(recordId: string): string;
 declare function credentialIndexKey(requirementDigest: string, recordId: string): string;
 declare function createStoredCredentialRecord(input: {
@@ -3430,6 +3416,11 @@ type LocationRecordSigner = {
 declare class LocationRecordValidationError extends Error {
     constructor(message: string);
 }
+/** The location registry answered with a non-success HTTP status. */
+declare class LocationRegistryHttpError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
 declare class CloudLocationResolutionError extends Error {
     readonly attempts: LocationResolutionAttempt[];
     constructor(subject: string, attempts: LocationResolutionAttempt[]);
@@ -3511,4 +3502,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalEmailDomain, canonicalLocationPayload, canonicalMailbox, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCanonicalEmailDomain, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, mailboxBelongsToDomain, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };

package/dist/index.js

@@ -567,29 +567,7 @@ function isDigest(value) {
 }
 
 // src/credentials/email-domain.ts
-var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-function isCanonicalEmailDomain(value) {
-  if (value.length === 0 || value.length > 253) return false;
-  const labels = value.split(".");
-  return labels.length >= 2 && labels.every((label) => LABEL.test(label)) && !/^[0-9]+$/.test(labels.at(-1));
-}
-function canonicalEmailDomain(value) {
-  const domain = value.trim().replace(/^@/, "").toLowerCase();
-  if (!/^[\x21-\x7e]+$/.test(domain) || !isCanonicalEmailDomain(domain)) throw new TypeError("email domain must be lowercase ASCII DNS labels (use the xn-- form for international domains)");
-  return domain;
-}
-function canonicalMailbox(value) {
-  const email = value.trim().toLowerCase();
-  const at = email.indexOf("@");
-  if (at <= 0 || at !== email.lastIndexOf("@")) return void 0;
-  const local = email.slice(0, at);
-  const domain = email.slice(at + 1);
-  if (local.length > 64 || !/^[a-z0-9#$&'*+/=?^_`{|}~-]+(?:\.[a-z0-9#$&'*+/=?^_`{|}~-]+)*$/.test(local) || !isCanonicalEmailDomain(domain)) return void 0;
-  return Object.freeze({ email, domain });
-}
-function mailboxBelongsToDomain(mailbox, domain) {
-  return canonicalMailbox(mailbox)?.domain === domain && isCanonicalEmailDomain(domain);
-}
+import { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from "@tinycloud/share-envelope";
 
 // src/credentials/requirement.ts
 var ID2 = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
@@ -17685,6 +17663,13 @@ var LocationRecordValidationError = class extends Error {
     this.name = "LocationRecordValidationError";
   }
 };
+var LocationRegistryHttpError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "LocationRegistryHttpError";
+  }
+};
 var CloudLocationResolutionError = class extends Error {
   constructor(subject, attempts) {
     super(`Unable to resolve TinyCloud location for ${subject}`);
@@ -17778,7 +17763,7 @@ async function fetchLocationRecord(registryUrl, subject, fetchFn = globalThis.fe
     return null;
   }
   if (!response.ok) {
-    throw new Error(`location registry returned HTTP ${response.status}`);
+    throw new LocationRegistryHttpError(`location registry returned HTTP ${response.status}`, response.status);
   }
   const text2 = await boundedResponseText(response, "location registry", 64 * 1024);
   let body;
@@ -17823,7 +17808,7 @@ async function publishLocationRecord(options2) {
     }
   );
   if (!response.ok) {
-    throw new Error(`location registry publish returned HTTP ${response.status}`);
+    throw new LocationRegistryHttpError(`location registry publish returned HTTP ${response.status}`, response.status);
   }
   const text2 = await boundedResponseText(response, "location registry", 64 * 1024);
   let body;
@@ -18532,6 +18517,7 @@ export {
   LOCAL_LINK_PROBE_TIMEOUT_MS,
   LOCAL_LOOPBACK_PROBE_TIMEOUT_MS,
   LocationRecordValidationError,
+  LocationRegistryHttpError,
   MAX_CONTENT_BYTES,
   MAX_LEGACY_ENVELOPE_EXPIRES_AT,
   MAX_SEALED_SHARE_CONTENT_BYTES,