@tinycloud/sdk-core 3.0.0-beta.8 → 3.0.0

package/dist/index.cjs

@@ -101,6 +101,7 @@ __export(index_exports, {
   ED25519_JCS_SIGNATURE_SUITE: () => ED25519_JCS_SIGNATURE_SUITE,
   EIP191_JCS_SIGNATURE_SUITE: () => EIP191_JCS_SIGNATURE_SUITE,
   EMAIL_CREDENTIAL_MAX_AGE_SECONDS: () => EMAIL_CREDENTIAL_MAX_AGE_SECONDS,
+  EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS: () => EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS,
   ENCRYPTION: () => import_bootstrap4.ENCRYPTION,
   ENCRYPTION_MANIFEST_SPACE: () => ENCRYPTION_MANIFEST_SPACE,
   ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_services8.ENCRYPTION_NETWORK_URN_PREFIX,
@@ -126,6 +127,7 @@ __export(index_exports, {
   LOCAL_LINK_PROBE_TIMEOUT_MS: () => LOCAL_LINK_PROBE_TIMEOUT_MS,
   LOCAL_LOOPBACK_PROBE_TIMEOUT_MS: () => LOCAL_LOOPBACK_PROBE_TIMEOUT_MS,
   LocationRecordValidationError: () => LocationRecordValidationError,
+  LocationRegistryHttpError: () => LocationRegistryHttpError,
   MAX_CONTENT_BYTES: () => MAX_CONTENT_BYTES,
   MAX_LEGACY_ENVELOPE_EXPIRES_AT: () => MAX_LEGACY_ENVELOPE_EXPIRES_AT,
   MAX_SEALED_SHARE_CONTENT_BYTES: () => MAX_SEALED_SHARE_CONTENT_BYTES,
@@ -139,6 +141,7 @@ __export(index_exports, {
   NETWORK_NAME_PATTERN: () => import_sdk_services8.NETWORK_NAME_PATTERN,
   NetworkIdError: () => import_sdk_services8.NetworkIdError,
   OPENKEY_ACTION_ID_SEPARATOR: () => OPENKEY_ACTION_ID_SEPARATOR,
+  OWNER_NODE_BINDING_TIMEOUT_MS: () => OWNER_NODE_BINDING_TIMEOUT_MS,
   OpenKeyManageKeyError: () => OpenKeyManageKeyError,
   POLICY_CAPABILITY_V1_DOMAIN: () => POLICY_CAPABILITY_V1_DOMAIN,
   POLICY_CAPABILITY_V1_SCHEMA: () => POLICY_CAPABILITY_V1_SCHEMA,
@@ -178,7 +181,6 @@ __export(index_exports, {
   SECRET_RECORDS_SCHEMA: () => import_bootstrap4.SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT: () => SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG: () => SERVICE_SHORT_TO_LONG,
-  SHARE_DELIVERY_AUTHORIZATION_DOMAIN: () => SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
   SPACE: () => import_bootstrap4.SPACE,
   SQL: () => import_bootstrap4.SQL,
   SQLAction: () => import_sdk_services8.SQLAction,
@@ -245,8 +247,10 @@ __export(index_exports, {
   buildPolicyCredentialPresentationV4: () => buildPolicyCredentialPresentationV4,
   buildSpaceUri: () => buildSpaceUri,
   canonicalDigest: () => canonicalDigest,
+  canonicalEmailDomain: () => import_share_envelope.canonicalEmailDomain,
   canonicalHashHex: () => import_sdk_services8.canonicalHashHex,
   canonicalLocationPayload: () => canonicalLocationPayload,
+  canonicalMailbox: () => import_share_envelope.canonicalMailbox,
   canonicalOwnerSharePolicy: () => canonicalOwnerSharePolicy,
   canonicalSignedResponse: () => import_sdk_services8.canonicalSignedResponse,
   canonicalizeAddress: () => canonicalizeAddress,
@@ -274,6 +278,7 @@ __export(index_exports, {
   createCapabilityKeyRegistry: () => createCapabilityKeyRegistry,
   createDelegatedShareKey: () => createDelegatedShareKey,
   createEmailCredentialRequirement: () => createEmailCredentialRequirement,
+  createEmailDomainCredentialRequirement: () => createEmailDomainCredentialRequirement,
   createHolderBinding: () => createHolderBinding,
   createInMemoryLocalNodeIdentityStore: () => createInMemoryLocalNodeIdentityStore,
   createLocalStorageLocalNodeIdentityStore: () => createLocalStorageLocalNodeIdentityStore,
@@ -346,6 +351,7 @@ __export(index_exports, {
   importPortableDelegation: () => importPortableDelegation,
   installTinyCloudDebugGlobals: () => import_sdk_services8.installTinyCloudDebugGlobals,
   intersectShareCapabilities: () => intersectShareCapabilities,
+  isCanonicalEmailDomain: () => import_share_envelope.isCanonicalEmailDomain,
   isCapabilitySubset: () => isCapabilitySubset,
   isDigest: () => isDigest,
   isEvmAddress: () => isEvmAddress,
@@ -356,6 +362,7 @@ __export(index_exports, {
   jcsCanonicalize: () => jcsCanonicalize,
   loadManifest: () => loadManifest,
   locationPayloadForRecord: () => locationPayloadForRecord,
+  mailboxBelongsToDomain: () => import_share_envelope.mailboxBelongsToDomain,
   makePkhSpaceId: () => makePkhSpaceId,
   makePublicSpaceId: () => makePublicSpaceId,
   manifestAbilitiesUnion: () => manifestAbilitiesUnion,
@@ -394,6 +401,7 @@ __export(index_exports, {
   principalDidEquals: () => principalDidEquals,
   projectUnifiedPolicyCapabilities: () => projectUnifiedPolicyCapabilities,
   projectUnifiedPolicyCapability: () => projectUnifiedPolicyCapability,
+  publishLocationRecord: () => publishLocationRecord,
   recapCaveatsEqual: () => recapCaveatsEqual,
   registerPolicyV3: () => registerPolicyV3,
   renewPolicyRootStatusV3: () => renewPolicyRootStatusV3,
@@ -413,7 +421,7 @@ __export(index_exports, {
   serviceError: () => import_sdk_services8.serviceError,
   sha256Base64Url: () => sha256Base64Url,
   shareCapabilityAllows: () => shareCapabilityAllows,
-  shareDeliveryTrustedKid: () => shareDeliveryTrustedKid,
+  signCompactPolicyDescendant: () => signCompactPolicyDescendant,
   signCompactUcanAuthorization: () => signCompactUcanAuthorization,
   signCompactUcanRootAuthorization: () => signCompactUcanRootAuthorization,
   signLocationRecord: () => signLocationRecord,
@@ -450,7 +458,6 @@ __export(index_exports, {
   validatePolicyStatusSignedShape: () => validatePolicyStatusSignedShape,
   validatePolicyStatusUnsigned: () => validatePolicyStatusUnsigned,
   validatePolicyUnsigned: () => validatePolicyUnsigned,
-  validateShareDeliveryAuthorizationBytes: () => validateShareDeliveryAuthorizationBytes,
   validateShareDeliveryAuthorizationV3Bytes: () => validateShareDeliveryAuthorizationV3Bytes,
   validateUnifiedPolicyV2: () => validateUnifiedPolicyV2,
   verifyDecryptResponse: () => import_sdk_services8.verifyDecryptResponse,
@@ -458,6 +465,7 @@ __export(index_exports, {
   verifyEip191MessageSignature: () => verifyEip191MessageSignature,
   verifyIssuedCredential: () => verifyIssuedCredential,
   verifyLocationRecord: () => verifyLocationRecord,
+  verifyOwnerNodeBinding: () => verifyOwnerNodeBinding,
   verifyPolicy: () => verifyPolicy,
   verifyPolicyEngineRecord: () => verifyPolicyEngineRecord,
   verifyPolicyRootRevocationV3: () => verifyPolicyRootRevocationV3,
@@ -768,6 +776,7 @@ var CREDENTIAL_ERROR_CODES = [
   "ISSUER_UNREADY",
   "OFFLINE",
   "POPUP_BLOCKED",
+  "PROOF_REJECTED",
   "REQUEST_EXPIRED",
   "REQUEST_SUBSTITUTED",
   "SIGNATURE_REJECTED",
@@ -781,6 +790,7 @@ var RECOVERABLE = /* @__PURE__ */ new Set([
   "ISSUER_UNREADY",
   "OFFLINE",
   "POPUP_BLOCKED",
+  "PROOF_REJECTED",
   "REQUEST_EXPIRED",
   "SIGNATURE_REJECTED",
   "UNSUPPORTED_PROFILE",
@@ -849,6 +859,7 @@ function holderBindingSigningBytes(binding) {
 
 // src/credentials/descriptor.ts
 var ID = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
+var CLAIM_NAME = /^[a-z0-9][A-Za-z0-9._-]{0,127}$/;
 var STEP_TYPES = /* @__PURE__ */ new Set(["collect_input", "mailbox_otp", "holder_signature"]);
 var ENDPOINTS = {
   request: "request",
@@ -929,7 +940,7 @@ function validateCredentialFlowDescriptor(value) {
   for (const value2 of raw.claims) {
     const claim = object(value2, "claim");
     exact(claim, ["name", "matching", "selectiveDisclosure"], "claim");
-    const name2 = text(claim.name, "claim.name", ID);
+    const name2 = text(claim.name, "claim.name", CLAIM_NAME);
     if (claimNames.has(name2) || claim.matching !== "normalized_exact" || typeof claim.selectiveDisclosure !== "boolean") fail("claim is invalid");
     claimNames.add(name2);
   }
@@ -1020,9 +1031,14 @@ function isDigest(value) {
   return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
 }
 
+// src/credentials/email-domain.ts
+var import_share_envelope = require("@tinycloud/share-envelope");
+
 // src/credentials/requirement.ts
 var ID2 = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
 var EMAIL_CREDENTIAL_MAX_AGE_SECONDS = 3600;
+var EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS = 300;
+var CLAIM_NAME2 = /^[a-z0-9][A-Za-z0-9._-]{0,127}$/;
 function createEmailCredentialRequirement(input) {
   return validateCredentialRequirement({
     type: "TinyCloudCredentialRequirement",
@@ -1033,6 +1049,17 @@ function createEmailCredentialRequirement(input) {
     maxAgeSeconds: EMAIL_CREDENTIAL_MAX_AGE_SECONDS
   });
 }
+function createEmailDomainCredentialRequirement(input) {
+  if (!(0, import_share_envelope.isCanonicalEmailDomain)(input.domain)) throw new CredentialError("UNSUPPORTED_PROFILE", "Email domain is not canonical");
+  return validateCredentialRequirement({
+    type: "TinyCloudCredentialRequirement",
+    version: 1,
+    profile: input.profile,
+    credentialType: input.credentialType,
+    claims: { emailDomain: input.domain },
+    maxAgeSeconds: EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS
+  });
+}
 function validateCredentialRequirement(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential requirement is invalid");
   const raw = value;
@@ -1046,7 +1073,7 @@ function validateCredentialRequirement(value) {
   if (typeof raw.claims !== "object" || raw.claims === null || Array.isArray(raw.claims)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claims are invalid");
   const claims = {};
   for (const [key, value2] of Object.entries(raw.claims).sort(([a], [b]) => a.localeCompare(b))) {
-    if (!ID2.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
+    if (!CLAIM_NAME2.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
     claims[key] = value2;
   }
   if (raw.maxAgeSeconds !== void 0 && (!Number.isSafeInteger(raw.maxAgeSeconds) || raw.maxAgeSeconds < 1)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential freshness is invalid");
@@ -4469,8 +4496,9 @@ async function signCompactUcanAuthorization(input) {
     throw new Error("compact invocation lifetime must be between one and 60 seconds");
   return signCompactUcan(input);
 }
+var MAX_POLICY_ROOT_SECONDS = 31 * 24 * 60 * 60;
 async function signCompactUcanRootAuthorization(input) {
-  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 31 * 24 * 60 * 60)
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > MAX_POLICY_ROOT_SECONDS)
     throw new Error("compact policy root lifetime must be between one second and 31 days");
   return signCompactUcan({ ...input, proofs: [] });
 }
@@ -4505,7 +4533,7 @@ function createCompactPolicyInvocation(input) {
   const signature = import_ed255193.ed25519.sign(signingInput, input.privateKey);
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url2(signature)}`);
 }
-function createCompactPolicyDescendant(input) {
+function compactPolicyDescendantClaims(input) {
   const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);
   if (parent.payload.aud !== input.issuerDid) throw new Error("policy descendant issuer is not the parent audience");
   const parentFact = parent.payload.fct[0];
@@ -4513,29 +4541,53 @@ function createCompactPolicyDescendant(input) {
   if (!Number.isInteger(depth) || depth <= 0) throw new Error("policy descendant depth is exhausted");
   if (!compactAttenuationContains(parent.payload.att, input.attenuation))
     throw new Error("policy descendant exceeds the parent attenuation");
+  const now = Math.max(input.now ?? parent.payload.nbf + 1, parent.payload.nbf + 1);
+  const exp = Math.min(input.expiresAt ?? parent.payload.exp - 1, parent.payload.exp - 1);
+  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
+  return {
+    parentCid: parent.cid,
+    fact: { ...parentFact, remainingRedelegationDepth: depth - 1 },
+    notBefore: now,
+    expiresAt: exp,
+    nonce: input.nonce ?? encodeBase64Url2(crypto.getRandomValues(new Uint8Array(16)))
+  };
+}
+function createCompactPolicyDescendant(input) {
+  const claims = compactPolicyDescendantClaims(input);
   const principal = input.issuerDid.split("#", 1)[0];
   const didMaterial = base58btc.decode(principal.slice("did:key:".length));
   const publicKey = import_ed255193.ed25519.getPublicKey(input.privateKey);
   if (didMaterial.length !== 34 || !equalBytes(publicKey, didMaterial.slice(2))) throw new Error("policy descendant signer does not bind issuer DID");
-  const now = Math.max(input.now ?? Math.floor(Date.now() / 1e3), parent.payload.nbf + 1);
-  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);
-  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
   const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url2(publicKey) }, typ: "JWT", ucv: "0.10.0" };
   const payload = {
     att: input.attenuation,
     aud: input.audienceDid,
-    exp,
-    fct: [{ ...parentFact, remainingRedelegationDepth: depth - 1 }],
+    exp: claims.expiresAt,
+    fct: [claims.fact],
     iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
-    nbf: now,
-    nnc: input.nonce ?? encodeBase64Url2(crypto.getRandomValues(new Uint8Array(16))),
-    prf: [parent.cid]
+    nbf: claims.notBefore,
+    nnc: claims.nonce,
+    prf: [claims.parentCid]
   };
   const protectedSegment = encodeBase64Url2(new TextEncoder().encode(jcsCanonicalize(header)));
   const payloadSegment = encodeBase64Url2(new TextEncoder().encode(jcsCanonicalize(payload)));
   const signature = import_ed255193.ed25519.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`), input.privateKey);
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url2(signature)}`);
 }
+async function signCompactPolicyDescendant(input) {
+  const claims = compactPolicyDescendantClaims(input);
+  return signCompactUcan({
+    issuerDid: input.issuerDid,
+    audienceDid: input.audienceDid,
+    attenuation: input.attenuation,
+    facts: [claims.fact],
+    proofs: [claims.parentCid],
+    notBefore: claims.notBefore,
+    expiresAt: claims.expiresAt,
+    nonce: claims.nonce,
+    sign: input.sign
+  });
+}
 function compactAttenuationContains(parent, child) {
   const selector = (value) => {
     if (value.length !== 1 || !isRecordValue(value[0])) return void 0;
@@ -4605,7 +4657,7 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
     throw new Error("policy session UCAN fact is incomplete");
   if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
     throw new Error("policy session UCAN v4 audit facts are invalid");
-  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > MAX_POLICY_ROOT_SECONDS || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
     throw new Error("policy session UCAN fact is invalid");
   return {
     authorization,
@@ -5029,24 +5081,21 @@ async function admitPolicyCredentialV3(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(
+  const response = await postPolicyDelegation(
+    fetchFn,
     new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
     {
-      method: "POST",
-      redirect: "error",
-      signal: input.signal,
-      headers: { accept: "application/json", "content-type": "application/json" },
-      body: JSON.stringify({
-        policyCid: input.policyCid,
-        challengeId: challenge.challengeId,
-        nonce: challenge.nonce,
-        requirement: validateCredentialRequirement(input.requirement),
-        credential: envelopeFromVerified(input.credential),
-        accountAuthorizationCid,
-        credentialSpaceId,
-        presentation
-      })
-    }
+      policyCid: input.policyCid,
+      challengeId: challenge.challengeId,
+      nonce: challenge.nonce,
+      requirement: validateCredentialRequirement(input.requirement),
+      credential: envelopeFromVerified(input.credential),
+      accountAuthorizationCid,
+      credentialSpaceId,
+      presentation
+    },
+    requestedSessionExpiry(input.requestedExpiresAt, policy),
+    input.signal
   );
   if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
   const value = record(await response.json(), "policy delegation");
@@ -5087,20 +5136,20 @@ async function admitPolicyCredentialV4(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin), {
-    method: "POST",
-    redirect: "error",
-    signal: input.signal,
-    headers: { accept: "application/json", "content-type": "application/json" },
-    body: JSON.stringify({
+  const response = await postPolicyDelegation(
+    fetchFn,
+    new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
+    {
       policyCid: input.policyCid,
       challengeId: challenge.challengeId,
       nonce: challenge.nonce,
       requirement: validateCredentialRequirement(input.requirement),
       credential: envelopeFromVerified(input.credential),
       presentation
-    })
-  });
+    },
+    requestedSessionExpiry(input.requestedExpiresAt, policy),
+    input.signal
+  );
   if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") throw new Error("policy delegation response is invalid");
@@ -5124,6 +5173,27 @@ async function admitPolicyCredentialV4(input) {
   input.signal?.throwIfAborted();
   return Object.freeze({ challenge, presentation, session, delegationImported: true });
 }
+function requestedSessionExpiry(requested, policy) {
+  const value = requested === void 0 ? policy.expiresAt : requested;
+  if (value === null || value === void 0) return void 0;
+  const seconds = Math.floor(Date.parse(value) / 1e3);
+  if (!Number.isFinite(seconds) || seconds <= Math.floor(Date.now() / 1e3) + 60) return void 0;
+  return new Date(seconds * 1e3).toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+async function postPolicyDelegation(fetchFn, url, body, requestedExpiresAt, signal) {
+  const send = (payload) => fetchFn(url, {
+    method: "POST",
+    redirect: "error",
+    signal,
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify(payload)
+  });
+  if (requestedExpiresAt === void 0) return send(body);
+  const response = await send({ ...body, requestedExpiresAt });
+  if (response.status !== 422) return response;
+  await response.body?.cancel().catch(() => void 0);
+  return send(body);
+}
 function policyRuntimeBasePath2(value) {
   const path = value ?? "/policy/v3";
   if (!/^\/policy(?:\/[a-z0-9-]+)*$/.test(path)) {
@@ -6499,6 +6569,7 @@ var DelegationErrorSchema = import_zod4.z.object({
 });
 var DelegationErrorCodes = {
   AUTH_REQUIRED: "AUTH_REQUIRED",
+  AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
   AUTH_EXPIRED: "AUTH_EXPIRED",
   NOT_INITIALIZED: "NOT_INITIALIZED",
   NOT_FOUND: "NOT_FOUND",
@@ -6863,7 +6934,7 @@ var CreateDelegationWasmResultSchema = import_zod4.z.object({
 // src/expiry.ts
 var EPHEMERAL_MS = 60 * 60 * 1e3;
 var SIGNED_READ_URL_MS = 5 * 60 * 1e3;
-var SESSION_MS = 7 * 24 * 60 * 60 * 1e3;
+var SESSION_MS = 30 * 24 * 60 * 60 * 1e3;
 var SHARE_MS = 7 * 24 * 60 * 60 * 1e3;
 var APP_MS = 30 * 24 * 60 * 60 * 1e3;
 var MAX_MS = 10 * 365 * 24 * 60 * 60 * 1e3;
@@ -8627,7 +8698,6 @@ var import_ed255195 = require("@noble/curves/ed25519");
 var import_blake33 = require("@noble/hashes/blake3");
 var import_sha2563 = require("@noble/hashes/sha256");
 var ENVELOPE_SCHEMA = "xyz.tinycloud.share/envelope";
-var INLINE_PREFIX = "tc2:";
 var RAW_CID_CODEC = 85;
 var BLAKE3_256_CODE = 30;
 var DEFAULT_MAX_INLINE_BYTES = 256 * 1024;
@@ -9332,25 +9402,8 @@ function parsePublishedShareLink(link, options2 = {}) {
   }
   const origin2 = normalizeOrigin(url.origin);
   if (options2.trustedOrigins !== void 0 && !options2.trustedOrigins.map(normalizeOrigin).includes(origin2)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
-  if (url.search !== "" || url.username !== "" || url.password !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
-  if (url.pathname === "/s/inline" && url.hash.startsWith("#v=2&p=")) {
-    let payload;
-    try {
-      const bytes2 = base64UrlToBytes(url.hash.slice("#v=2&p=".length));
-      if (bytes2.length > (options2.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES) * 2) throw new Error("inline payload too large");
-      const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
-      if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("inline payload shape");
-      payload = value;
-    } catch (error) {
-      throw new ShareEnvelopeError("invalid-link", error instanceof Error ? error.message : "invalid inline payload");
-    }
-    if (payload.v !== 2 || typeof payload.c !== "string" || typeof payload.cid !== "string" || payload.k !== void 0 && typeof payload.k !== "string" || Object.keys(payload).some((key3) => !["v", "c", "cid", "k"].includes(key3))) throw new ShareEnvelopeError("invalid-link", "inline payload fields are invalid");
-    const sealed = base64UrlToBytes(payload.c);
-    if (!verifyPublishedShareCid(payload.cid, sealed)) throw new ShareEnvelopeError("cid-mismatch", "inline payload CID does not match");
-    const key2 = payload.k === void 0 ? void 0 : base64UrlToBytes(payload.k);
-    if (key2 !== void 0 && key2.length !== 32) throw new ShareEnvelopeError("invalid-link", "inline payload key is invalid");
-    return { origin: origin2, cid: payload.cid, ...key2 === void 0 ? {} : { key: key2 }, sealed };
-  }
+  if (url.username !== "" || url.password !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
+  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
   const match = /^\/s\/([a-z2-7]+)$/.exec(url.pathname);
   if (match === null || !url.hash.startsWith("#k=")) throw new ShareEnvelopeError("invalid-link", "published share link is invalid");
   const key = base64UrlToBytes(url.hash.slice(3));
@@ -9370,13 +9423,10 @@ function parseShareUrl(link, options2 = {}) {
   } catch {
     throw new ShareEnvelopeError("invalid-link", "share link must be an absolute URL");
   }
-  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share links must not contain query parameters");
   const origin2 = normalizeOrigin(url.origin);
   if (options2.trustedOrigins !== void 0 && !options2.trustedOrigins.map(normalizeOrigin).includes(origin2)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
-  if (url.pathname === "/s/inline" && url.hash.startsWith("#v=2&p=")) {
-    const published = parsePublishedShareLink(link, options2);
-    return { kind: "inline", origin: origin2, cid: published.cid, key: published.key, url: `${url.origin}${url.pathname}`, protocol: "share-envelope-v2" };
-  }
+  if (url.pathname === "/viewer") throw new ShareEnvelopeError("invalid-link", "retired viewer links are not accepted");
+  if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share links must not contain query parameters");
   const match = url.pathname.match(/^\/s\/(i\/)?([^/]+)$/);
   if (!match) throw new ShareEnvelopeError("invalid-link", "share link path is invalid");
   const fragmentParams = url.hash === "" ? void 0 : new URLSearchParams(url.hash.slice(1));
@@ -9399,9 +9449,10 @@ function parseShareUrl(link, options2 = {}) {
 }
 function isV2ShareLink(link) {
   try {
-    return new URL(link).pathname.startsWith("/s/");
+    const url = new URL(link);
+    return url.search === "" && url.pathname.startsWith("/s/");
   } catch {
-    return link.startsWith(INLINE_PREFIX);
+    return false;
   }
 }
 async function encryptShareBytes(bytes2, key) {
@@ -10901,6 +10952,13 @@ var ShareRecipientClient = class {
 };
 
 // src/delegations/SharingService.ts
+function spaceIdsEqual(left, right) {
+  const normalizeOwnerAddress = (space) => {
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
+  };
+  return normalizeOwnerAddress(left) === normalizeOwnerAddress(right);
+}
 function inferShortServiceFromActionUrns(actions) {
   let short;
   for (const action of actions) {
@@ -11136,11 +11194,11 @@ var SharingService = class {
       }
       return result;
     };
-    const canSatisfyFromRegistry = this.findSuitableKeyForDelegation(
+    const canSatisfyFromRegistry = this.classifyDelegationAuthority(
       fullPath,
       actions,
       requestedExpiry
-    );
+    ) === "ok";
     if (canSatisfyFromRegistry) {
       const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);
       const childDelegationActiveError = this.retiredGraphError();
@@ -11210,49 +11268,58 @@ var SharingService = class {
     return { ok: true, data: shareLink };
   }
   /**
-   * Check if any key in the registry can satisfy the delegation request.
-   * A key can satisfy if it has a delegation that:
-   * 1. Covers the required path (exact match or parent path)
-   * 2. Has all required actions
-   * 3. Has sufficient expiry (delegation.expiry >= requestedExpiry)
-   * 4. Allows sub-delegation
+   * Report, without side effects, whether this session's registry authority
+   * can issue the child delegation {@link generate} would create for the same
+   * `path`, `actions` and `expiry` (defaults and `pathPrefix` applied the
+   * same way):
+   *
+   * - `"ok"`: an uncaveated entry covers it.
+   * - `"caveated"`: only caveated entries cover it. SharingService cannot
+   *   carry signed ReCap caveats into a child delegation.
+   * - `"not-covered"`: no entry covers it, or there is no session.
+   *
+   * It does not consult `onRootDelegationNeeded`, so a signer-backed session
+   * may still generate when this is not `"ok"`.
+   */
+  preflightGenerate(params) {
+    if (!this.session || !params.path) return "not-covered";
+    const fullPath = this.pathPrefix ? `${this.pathPrefix}/${params.path}`.replace(/\/+/g, "/") : params.path;
+    return this.classifyDelegationAuthority(
+      fullPath,
+      params.actions ?? DEFAULT_READ_ACTIONS,
+      params.expiry ?? new Date(Date.now() + DEFAULT_EXPIRY_MS)
+    );
+  }
+  /**
+   * Classify the registry's authority for a child delegation. An entry
+   * satisfies it when it is in the session space, valid, lasts at least until
+   * `requestedExpiry`, allows sub-delegation, covers `path` (exact or parent)
+   * and grants every action. Satisfying entries with caveats are unusable.
    * @internal
    */
-  findSuitableKeyForDelegation(path, actions, requestedExpiry) {
-    const allKeys = this.registry.getAllKeys();
-    for (const key of allKeys) {
-      const delegations = this.registry.getDelegationsForKey(key.id);
-      for (const delegation of delegations) {
-        if (delegation.spaceId !== this.session?.spaceId) {
-          continue;
-        }
-        if ((delegation.caveats?.length ?? 0) > 0) {
-          continue;
-        }
-        if (!this.registry.isDelegationValid(delegation)) {
+  classifyDelegationAuthority(path, actions, requestedExpiry) {
+    let coveredOnlyByCaveated = false;
+    for (const key of this.registry.getAllKeys()) {
+      for (const delegation of this.registry.getDelegationsForKey(key.id)) {
+        if (delegation.spaceId === void 0 || !spaceIdsEqual(delegation.spaceId, this.session?.spaceId ?? "")) {
           continue;
         }
-        if (delegation.expiry < requestedExpiry) {
-          continue;
-        }
-        if (delegation.allowSubDelegation === false) {
-          continue;
-        }
-        const delegationPath = delegation.path || "";
-        if (!this.pathMatches(delegationPath, path)) {
+        if (!this.registry.isDelegationValid(delegation)) continue;
+        if (delegation.expiry < requestedExpiry) continue;
+        if (delegation.allowSubDelegation === false) continue;
+        if (!this.pathMatches(delegation.path || "", path)) continue;
+        const delegationActions = delegation.actions || [];
+        if (!actions.every((action) => delegationActions.includes(action) || delegationActions.includes("*"))) {
           continue;
         }
-        const delegationActions = delegation.actions || [];
-        const hasAllActions = actions.every(
-          (action) => delegationActions.includes(action) || delegationActions.includes("*")
-        );
-        if (!hasAllActions) {
+        if ((delegation.caveats?.length ?? 0) > 0) {
+          coveredOnlyByCaveated = true;
           continue;
         }
-        return true;
+        return "ok";
       }
     }
-    return false;
+    return coveredOnlyByCaveated ? "caveated" : "not-covered";
   }
   retiredGraphError() {
     try {
@@ -11351,11 +11418,23 @@ var SharingService = class {
           const errorText = await registerRes.text();
           const registrationTextActiveError = this.retiredGraphError();
           if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };
+          const message = `Failed to register delegation with server: ${registerRes.status} ${errorText}`;
+          if (registerRes.status === 401 || registerRes.status === 403) {
+            return {
+              ok: false,
+              error: createError2(
+                DelegationErrorCodes.AUTH_UNAUTHORIZED,
+                message,
+                void 0,
+                { status: registerRes.status }
+              )
+            };
+          }
           return {
             ok: false,
             error: createError2(
               DelegationErrorCodes.CREATION_FAILED,
-              `Failed to register delegation with server: ${registerRes.status} ${errorText}`
+              message
             )
           };
         }
@@ -12212,114 +12291,13 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
   return validateOwnerSharePolicyRegistration(value, expected);
 }
 
-// src/delegations/share-delivery.ts
-var import_ed255199 = require("@noble/curves/ed25519");
-var SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
-function isCanonicalHttpsOrigin(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  return url.protocol === "https:" && url.origin === value && url.pathname === "/" && url.search === "" && url.hash === "" && url.username === "" && url.password === "";
-}
-var AUTHORIZATION_KEYS = [
-  "type",
-  "version",
-  "jti",
-  "shareCid",
-  "shareId",
-  "registrationCid",
-  "delegationCid",
-  "enforcementDelegationCid",
-  "envelopeCid",
-  "policyCid",
-  "nodeAudience",
-  "targetOrigin",
-  "openCredentialsAudience",
-  "holder",
-  "recipientMatcher",
-  "deliveryEmail",
-  "shareUrl",
-  "returnOrigin",
-  "documentName",
-  "senderDid",
-  "senderTrust",
-  "contentSource",
-  "contentSourceDigest",
-  "shareExpiresAt",
-  "issuedAt",
-  "reportAbuseToken",
-  "actions",
-  "resource",
-  "authorityMaterialHandle",
-  "authorityMaterialDigest",
-  "requestBodyDigest",
-  "idempotencyKey",
-  "expiresAt",
-  "dataAuthority"
-];
-function assertObject2(value, keys, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const record2 = value;
-  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) throw new Error(`${label} has unknown or missing fields`);
-  return record2;
-}
-function fromB642(value) {
-  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
-  if (typeof atob === "function") {
-    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
-    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
-  }
-  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64url"));
-  throw new Error("base64url decoding is unavailable");
-}
-function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
-  let value;
-  try {
-    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytesValue));
-  } catch {
-    throw new Error("share delivery authorization response is not valid UTF-8 JSON");
-  }
-  const root = assertObject2(value, ["authorization", "proof"], "share delivery authorization response");
-  const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
-  const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
-  const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
-    throw new Error("share delivery authorization is not bound to the submitted request");
-  }
-  if (typeof authorization.issuedAt !== "string" || Date.parse(authorization.issuedAt) > Date.now() + 6e4) throw new Error("share delivery authorization issuedAt is invalid");
-  if (new Date(authorization.expiresAt).toISOString() !== authorization.expiresAt) throw new Error("share delivery authorization expiresAt is non-canonical");
-  if (typeof authorization.openCredentialsAudience !== "string" || !isCanonicalHttpsOrigin(authorization.openCredentialsAudience) || authorization.openCredentialsAudience !== expected.credentialsAudience || authorization.openCredentialsAudience === authorization.nodeAudience || authorization.openCredentialsAudience === authorization.returnOrigin) {
-    throw new Error("share delivery authorization openCredentialsAudience is missing or untrusted");
-  }
-  if (proof.alg !== "EdDSA" || typeof proof.kid !== "string" || typeof proof.signature !== "string") throw new Error("share delivery authorization proof is invalid");
-  if (proof.kid !== expected.nodeProof.kid) throw new Error("share delivery authorization proof key is not trusted");
-  const encodedKid = expected.nodeProof.publicKey;
-  const publicKey = encodedKid.length === 34 && encodedKid[0] === 237 && encodedKid[1] === 1 ? encodedKid.slice(2) : encodedKid;
-  if (publicKey.length !== 32) throw new Error("share delivery authorization proof key is invalid");
-  const signatureBytes = fromB642(proof.signature);
-  const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
-  if (signatureBytes.length !== 64 || !import_ed255199.ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
-  return { authorization, proof };
-}
-function shareDeliveryTrustedKid(publicKey) {
-  if (publicKey.length !== 32) throw new Error("share delivery node key must be a raw 32-byte Ed25519 public key");
-  const prefixed = new Uint8Array(34);
-  prefixed.set([237, 1]);
-  prefixed.set(publicKey, 2);
-  const did = `did:key:${base58btc.encode(prefixed)}`;
-  return `${did}#${did.slice("did:key:".length)}`;
-}
-
 // src/delegations/share-delivery-v3.ts
-var import_ed2551910 = require("@noble/curves/ed25519");
+var import_ed255199 = require("@noble/curves/ed25519");
 var import_sha2567 = require("@noble/hashes/sha256");
 var CREDENTIAL_INVITATION_REQUEST_DOMAIN = "xyz.tinycloud.credentials/invitation-request/v1\0";
 var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v0\0";
-var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
-var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
+var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
+var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
 function exactObject2(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
   const record2 = value;
@@ -12363,15 +12341,16 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   const contentSource = object3(envelope.contentSource, "v3 content source");
   const envelopeSignature = object3(envelope.signature, "v3 envelope signature");
   const target = object3(envelope.target, "v3 target");
-  const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
-  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.audience !== expected.credentialsAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || signature.signerDid !== target.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  const binding = object3(envelope.attestedEnforcerBinding, "v3 attested enforcer binding");
+  const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "label", "shareExpiresAt", "audience", "issuedAt", "expiresAt", "nonce"];
+  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.label !== expected.request.documentName || request.shareExpiresAt !== envelope.expiry || request.audience !== expected.deliveryAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || target.nodeAudience !== binding.nodeAudience || signature.signerDid !== binding.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
   const issuedAt = Date.parse(String(request.issuedAt));
   const expiresAt = Date.parse(String(request.expiresAt));
   if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 15 * 6e4) throw new Error("v3 share delivery authorization time is invalid");
   const admissionSignature = decodeBase64Url3(signature.value);
   const { signature: _signature, ...unsignedAdmission } = admission;
   const digest4 = (0, import_sha2567.sha256)(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
-  if (admissionSignature.length !== 64 || !import_ed2551910.ed25519.verify(admissionSignature, digest4, didKeyBytes2(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
+  if (admissionSignature.length !== 64 || !import_ed255199.ed25519.verify(admissionSignature, digest4, didKeyBytes2(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
   return { request, admission };
 }
 
@@ -17996,7 +17975,7 @@ function portForProtocol(protocol) {
 }
 
 // src/location.ts
-var import_ed2551911 = require("@noble/curves/ed25519");
+var import_ed2551910 = require("@noble/curves/ed25519");
 var import_viem5 = require("viem");
 var DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 var DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
@@ -18004,6 +17983,7 @@ var DEFAULT_LOCAL_NODE_URL = "http://127.0.0.1:8000";
 var LOCAL_LOOPBACK_PROBE_TIMEOUT_MS = 250;
 var LOCAL_LINK_PROBE_TIMEOUT_MS = 750;
 var LOCAL_LINK_HOST_SUFFIX = ".local.tinycloud.link";
+var OWNER_NODE_BINDING_TIMEOUT_MS = 5e3;
 function createInMemoryLocalNodeIdentityStore() {
   const pins = /* @__PURE__ */ new Map();
   return {
@@ -18054,6 +18034,13 @@ var LocationRecordValidationError = class extends Error {
     this.name = "LocationRecordValidationError";
   }
 };
+var LocationRegistryHttpError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "LocationRegistryHttpError";
+  }
+};
 var CloudLocationResolutionError = class extends Error {
   constructor(subject, attempts) {
     super(`Unable to resolve TinyCloud location for ${subject}`);
@@ -18136,21 +18123,80 @@ async function verifyLocationRecord(input) {
   }
   return false;
 }
-async function fetchLocationRecord(registryUrl, subject, fetchFn = globalThis.fetch) {
+async function fetchLocationRecord(registryUrl, subject, fetchFn = globalThis.fetch, signal) {
   const url = `${registryUrl.replace(/\/$/, "")}/v1/locations/${encodeURIComponent(subject)}`;
-  const response = await fetchFn(url);
+  const response = await fetchFn(url, {
+    redirect: "error",
+    headers: { accept: "application/json" },
+    ...signal === void 0 ? {} : { signal }
+  });
   if (response.status === 404) {
     return null;
   }
   if (!response.ok) {
-    throw new Error(`location registry returned HTTP ${response.status}`);
+    throw new LocationRegistryHttpError(`location registry returned HTTP ${response.status}`, response.status);
+  }
+  const text2 = await boundedResponseText(response, "location registry", 64 * 1024);
+  let body;
+  try {
+    body = JSON.parse(text2);
+  } catch {
+    throw new LocationRecordValidationError("registry response is not JSON");
   }
-  const body = await response.json();
   if (body.record === void 0) {
     throw new LocationRecordValidationError("registry response missing record");
   }
   return validateLocationRecord(body.record);
 }
+async function publishLocationRecord(options2) {
+  validateSubject(options2.subject);
+  const registryUrl = exactHttpOrigin(options2.registryUrl, "registry URL");
+  const nodeOrigin = exactHttpOrigin(options2.nodeOrigin, "node origin");
+  const fetchFn = options2.fetch ?? globalThis.fetch.bind(globalThis);
+  const current = await fetchLocationRecord(registryUrl, options2.subject, fetchFn);
+  if (current !== null) {
+    if (current.subject !== options2.subject || !await verifyLocationRecord(current)) {
+      throw new LocationRecordValidationError("existing location record signature is invalid");
+    }
+    if (publishedHttpOrigins(current).includes(nodeOrigin)) {
+      return current;
+    }
+  }
+  const record2 = await signLocationRecord({
+    version: 1,
+    subject: options2.subject,
+    multiaddrs: [...current?.multiaddrs ?? [], httpUrlToMultiaddr(nodeOrigin)],
+    updated_at: (options2.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
+    sequence: (current?.sequence ?? -1) + 1
+  }, options2.signer);
+  const response = await fetchFn(
+    `${registryUrl}/v1/locations/${encodeURIComponent(options2.subject)}`,
+    {
+      method: "PUT",
+      redirect: "error",
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify(record2)
+    }
+  );
+  if (!response.ok) {
+    throw new LocationRegistryHttpError(`location registry publish returned HTTP ${response.status}`, response.status);
+  }
+  const text2 = await boundedResponseText(response, "location registry", 64 * 1024);
+  let body;
+  try {
+    body = JSON.parse(text2);
+  } catch {
+    throw new LocationRecordValidationError("registry publish response is not JSON");
+  }
+  if (body.record === void 0) {
+    throw new LocationRecordValidationError("registry publish response missing record");
+  }
+  const published = validateLocationRecord(body.record);
+  if (canonicalLocationPayload(locationPayloadForRecord(published)) !== canonicalLocationPayload(locationPayloadForRecord(record2)) || published.signature !== record2.signature || !await verifyLocationRecord(published)) {
+    throw new LocationRecordValidationError("registry publish response does not match the signed record");
+  }
+  return published;
+}
 async function resolveCloudLocation(subject, options2 = {}) {
   validateSubject(subject);
   const verifyRecords = options2.verifyRecords ?? true;
@@ -18401,6 +18447,123 @@ function multiaddrToHttpUrl(input) {
   }
   return uri;
 }
+function exactHttpOrigin(value, label) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new LocationRecordValidationError(`${label} must be an absolute URL origin`);
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new LocationRecordValidationError(`${label} must use HTTPS (or loopback HTTP)`);
+  }
+  if (url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+    throw new LocationRecordValidationError(`${label} must be an origin without credentials, path, query, or fragment`);
+  }
+  return url.origin;
+}
+function publishedHttpOrigins(record2) {
+  const origins = [];
+  for (const address of record2.multiaddrs) {
+    try {
+      origins.push(exactHttpOrigin(multiaddrToHttpUrl(address), "published node URL"));
+    } catch {
+    }
+  }
+  return origins;
+}
+async function boundedResponseText(response, label, maxBytes) {
+  const declaredLength = response.headers.get("content-length");
+  if (declaredLength !== null && (!/^\d+$/.test(declaredLength) || Number(declaredLength) > maxBytes)) {
+    throw new LocationRecordValidationError(`${label} response is too large`);
+  }
+  if (response.body === null) return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value === void 0) continue;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel().catch(() => void 0);
+        throw new LocationRecordValidationError(`${label} response is too large`);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes2 = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes2.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
+}
+function boundedSignal(parent, timeoutMs) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new LocationRecordValidationError("owner-node binding timeout must be positive");
+  }
+  const controller = new AbortController();
+  const abortFromParent = () => controller.abort(parent?.reason);
+  if (parent?.aborted) abortFromParent();
+  else parent?.addEventListener("abort", abortFromParent, { once: true });
+  const timer = setTimeout(() => controller.abort(new DOMException("owner-node binding timed out", "TimeoutError")), timeoutMs);
+  return {
+    signal: controller.signal,
+    dispose() {
+      clearTimeout(timer);
+      parent?.removeEventListener("abort", abortFromParent);
+    }
+  };
+}
+async function verifyOwnerNodeBinding(options2) {
+  validateSubject(options2.ownerDid);
+  validateSubject(options2.nodeDid);
+  const registryUrl = exactHttpOrigin(options2.registryUrl, "registry URL");
+  const nodeOrigin = exactHttpOrigin(options2.nodeOrigin, "node origin");
+  const fetchFn = options2.fetch ?? globalThis.fetch.bind(globalThis);
+  const lookup = boundedSignal(options2.signal, options2.timeoutMs ?? OWNER_NODE_BINDING_TIMEOUT_MS);
+  try {
+    const record2 = await fetchLocationRecord(registryUrl, options2.ownerDid, fetchFn, lookup.signal);
+    if (record2 === null) {
+      throw new LocationRecordValidationError("owner has no published location record");
+    }
+    if (record2.subject !== options2.ownerDid || !await verifyLocationRecord(record2)) {
+      throw new LocationRecordValidationError("owner location record signature is invalid");
+    }
+    const publishedOrigins = publishedHttpOrigins(record2);
+    if (!publishedOrigins.includes(nodeOrigin)) {
+      throw new LocationRecordValidationError("share target is not in the owner's signed location record");
+    }
+    const response = await fetchFn(new URL("/info", nodeOrigin), {
+      redirect: "error",
+      headers: { accept: "application/json" },
+      signal: lookup.signal
+    });
+    if (!response.ok) {
+      throw new LocationRecordValidationError(`target node /info returned HTTP ${response.status}`);
+    }
+    const text2 = await boundedResponseText(response, "target node /info", 16 * 1024);
+    let body;
+    try {
+      body = JSON.parse(text2);
+    } catch {
+      throw new LocationRecordValidationError("target node /info response is not JSON");
+    }
+    if (body === null || typeof body !== "object" || Array.isArray(body) || body.nodeId !== options2.nodeDid) {
+      throw new LocationRecordValidationError("target node identity does not match the share attestation");
+    }
+    return Object.freeze({ record: record2, nodeOrigin, nodeDid: options2.nodeDid });
+  } finally {
+    lookup.dispose();
+  }
+}
 function httpUrlToMultiaddr(input) {
   const url = new URL(input);
   if (url.protocol !== "http:" && url.protocol !== "https:") {
@@ -18568,7 +18731,7 @@ function verifyDidKeySignature(did, payload, signature) {
       "did:key signature must be a base64url Ed25519 signature"
     );
   }
-  return import_ed2551911.ed25519.verify(
+  return import_ed2551910.ed25519.verify(
     signatureBytes,
     new TextEncoder().encode(payload),
     publicKey
@@ -18576,7 +18739,7 @@ function verifyDidKeySignature(did, payload, signature) {
 }
 function verifyDidKeyEd25519Signature(did, payload, signature) {
   const publicKey = ed25519PublicKeyFromDidKey2(did);
-  return import_ed2551911.ed25519.verify(signature, payload, publicKey);
+  return import_ed2551910.ed25519.verify(signature, payload, publicKey);
 }
 function ed25519PublicKeyFromDidKey2(did) {
   const identifier = did.slice("did:key:".length);