@tinycloud/sdk-core 3.0.0-beta.8 → 3.0.0

package/dist/index.d.cts

@@ -1,11 +1,12 @@
 import { z } from 'zod';
-import { bo as CredentialHolderBinding, bp as CredentialFlowDescriptor, bq as CredentialRequirement, br as StoredCredentialRecord, bs as VerifiedCredential, bt as CredentialStorageReceipt, bu as IssuedCredentialEnvelope, bv as CredentialIssuerMetadata } from './credential-admission-CFjUChF8.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bw as CREDENTIAL_ACQUISITION_PROTOCOL, bx as CREDENTIAL_CONTRACT_VERSION, by as CREDENTIAL_FORMAT, bw as CREDENTIAL_PROTOCOL, bz as CREDENTIAL_STEP_REGISTRY_VERSION, g as CompactUcanAuthorizationV1, bA as CredentialClaimDescriptor, bB as CredentialEndpointId, bC as CredentialInputDescriptor, bD as CredentialProgressEvent, bE as CredentialStepDescriptor, bF as CredentialStepType, bG as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, h as EIP191_JCS_SIGNATURE_SUITE, bH as HOLDER_BINDING_DOMAIN, bI as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, i as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, j as POLICY_CAPABILITY_V1_DOMAIN, k as POLICY_CAPABILITY_V1_SCHEMA, l as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, m as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, n as POLICY_ENGINE_RECORD_SCHEMA, o as POLICY_PRESENTATION_V3_DOMAIN, p as POLICY_PRESENTATION_V3_SCHEMA, q as POLICY_PRESENTATION_V4_DOMAIN, r as POLICY_PRESENTATION_V4_SCHEMA, s as POLICY_SCHEMA, t as POLICY_SESSION_UCAN_V1_PROFILE, u as POLICY_STATUS_SCHEMA, v as POLICY_V1_DOMAIN, w as POLICY_V1_SCHEMA, x as POLICY_V2_DOMAIN, y as POLICY_V2_SCHEMA, a as Policy, D as PolicyCredentialAdmissionV3, F as PolicyCredentialAdmissionV4, G as PolicyCredentialPresentationV3, H as PolicyCredentialPresentationV4, I as PolicyCredentialRequirementV1, P as PolicyEngineRecord, K as PolicyRootStatusV3, O as PolicyRootV3, Q as PolicySessionUcanFactV1, R as PolicySessionUcanV1, T as PolicyStatus, V as ROOT_REVOCATION_V1_DOMAIN, W as ROOT_REVOCATION_V1_SCHEMA, X as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Y as ROOT_STATUS_RENEWAL_V1_DOMAIN, Z as ROOT_STATUS_V1_DOMAIN, _ as RegisterPolicyV3Input, $ as RegisterPolicyV3Receipt, a0 as SignCompactUcanAuthorizationInput, a1 as SignCompactUcanRootAuthorizationInput, a2 as SignatureMaterialError, a3 as SignatureSuite, a4 as SignatureVerificationError, a5 as SignedObjectCanonicalizationError, a6 as SignedObjectDigestError, a7 as SignedObjectErrorCode, a8 as SignedObjectIdError, a9 as SignedObjectKind, aa as SignedObjectMaterial, ab as SignedObjectProfileError, ac as SignedObjectSchemaError, ad as SignedObjectSignature, S as SignedObjectSigner, ae as SignedObjectVerificationResult, af as SignedPolicyObject, ag as SigningKeyBindingError, ah as UnifiedContentSource, ai as UnifiedEncryptionCapability, aj as UnifiedKvCapability, ak as UnifiedNativeCapability, al as UnifiedPolicyCapability, am as UnifiedPolicyV1, an as UnifiedPolicyV2, ao as UnifiedResourceSelector, ap as UnsignedPolicy, aq as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, ar as UnsignedPolicyObject, as as UnsignedPolicyStatus, at as UnsignedUnifiedPolicyV2, au as UnsupportedSignatureSuiteError, av as admitPolicyCredentialV3, aw as admitPolicyCredentialV4, ax as buildPolicyCredentialPresentationV3, ay as buildPolicyCredentialPresentationV4, az as canonicalizeSignedObjectUnsigned, aA as canonicalizeUnifiedPolicyCapability, aB as compactAttenuationContains, aC as contentSourceDigestHex, aD as createAndSignPolicy, aE as createAndSignPolicyEngineRecord, aF as createAndSignPolicyStatus, aG as createAndSignSignedObject, aJ as deriveSignedObjectMaterial, aK as getPolicyRootStatusV3, aL as issuedCredentialEnvelopeFromVerified, aN as normalizeUnifiedPolicyCapability, aO as parseCompactUcanAuthorization, aP as parsePolicySessionUcan, aQ as policyCidFromCanonicalBytes, aR as policyDigestHex, aS as policyIdForDigestHex, aT as policyV2DigestHex, aU as projectUnifiedPolicyCapabilities, aV as projectUnifiedPolicyCapability, aW as registerPolicyV3, aX as renewPolicyRootStatusV3, aZ as revokePolicyRootV3, a_ as signCompactUcanAuthorization, a$ as signCompactUcanRootAuthorization, b0 as signPolicyCredentialPresentationV4, b1 as signedObjectIdFor, b2 as toSignedObjectError, b3 as unifiedNativeProjectionHashHex, b4 as unifiedPolicyCapabilityContains, b5 as unifiedPolicyCapabilityDigestHex, b6 as unifiedPolicyCapabilityFromNative, b7 as validatePolicyCredentialRequirementV1, b8 as validatePolicyEngineRecordSigned, b9 as validatePolicyEngineRecordSignedShape, ba as validatePolicyEngineRecordUnsigned, bb as validatePolicySigned, bc as validatePolicySignedShape, bd as validatePolicyStatusSigned, be as validatePolicyStatusSignedShape, bf as validatePolicyStatusUnsigned, bg as validatePolicyUnsigned, bh as validateUnifiedPolicyV2, bi as verifyPolicy, bj as verifyPolicyEngineRecord, bk as verifyPolicyRootRevocationV3, bl as verifyPolicyRootStatusCheckpointV3, bm as verifyPolicyStatus, bn as verifySignedObject } from './credential-admission-CFjUChF8.cjs';
+import { bq as CredentialHolderBinding, br as CredentialFlowDescriptor, bs as CredentialRequirement, bt as StoredCredentialRecord, bu as VerifiedCredential, bv as CredentialStorageReceipt, bw as IssuedCredentialEnvelope, bx as CredentialIssuerMetadata } from './credential-admission-BxpkckU0.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, by as CREDENTIAL_ACQUISITION_PROTOCOL, bz as CREDENTIAL_CONTRACT_VERSION, bA as CREDENTIAL_FORMAT, by as CREDENTIAL_PROTOCOL, bB as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bC as CredentialClaimDescriptor, bD as CredentialEndpointId, bE as CredentialInputDescriptor, bF as CredentialProgressEvent, bG as CredentialStepDescriptor, bH as CredentialStepType, bI as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bJ as HOLDER_BINDING_DOMAIN, bK as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as policyCidFromCanonicalBytes, aS as policyDigestHex, aT as policyIdForDigestHex, aU as policyV2DigestHex, aV as projectUnifiedPolicyCapabilities, aW as projectUnifiedPolicyCapability, aX as registerPolicyV3, aY as renewPolicyRootStatusV3, a_ as revokePolicyRootV3, a$ as signCompactPolicyDescendant, b0 as signCompactUcanAuthorization, b1 as signCompactUcanRootAuthorization, b2 as signPolicyCredentialPresentationV4, b3 as signedObjectIdFor, b4 as toSignedObjectError, b5 as unifiedNativeProjectionHashHex, b6 as unifiedPolicyCapabilityContains, b7 as unifiedPolicyCapabilityDigestHex, b8 as unifiedPolicyCapabilityFromNative, b9 as validatePolicyCredentialRequirementV1, ba as validatePolicyEngineRecordSigned, bb as validatePolicyEngineRecordSignedShape, bc as validatePolicyEngineRecordUnsigned, bd as validatePolicySigned, be as validatePolicySignedShape, bf as validatePolicyStatusSigned, bg as validatePolicyStatusSignedShape, bh as validatePolicyStatusUnsigned, bi as validatePolicyUnsigned, bj as validateUnifiedPolicyV2, bk as verifyPolicy, bl as verifyPolicyEngineRecord, bm as verifyPolicyRootRevocationV3, bn as verifyPolicyRootStatusCheckpointV3, bo as verifyPolicyStatus, bp as verifySignedObject } from './credential-admission-BxpkckU0.cjs';
+export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, parseSecretCatalogKey, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
-import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aI as ShareLink, bi as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-DjmM_yJu.cjs';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bW as CapabilityKeyRegistry, bX as CapabilityKeyRegistryErrorCode, bY as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a6 as SenderShareKeyStorage, a7 as SenderShareRecord, a8 as SenderShareRecordStorage, a9 as SenderShareRevocationScope, aa as SenderShareStore, ab as ShareAccess, ac as ShareAccessError, ad as ShareAccessV2, ae as ShareAction, ag as ShareAddressedDelegationEnvelopeV2, ah as ShareAddressedDelegationEnvelopeV2Schema, ai as ShareAddressedDelegationRequestV2, aj as ShareAddressedDelegationRequestV2Schema, ak as ShareAddressedDelegationResponseV2, al as ShareAddressedDelegationResponseV2Schema, am as ShareAddressedRecipientMatcher, an as ShareArtifactInput, ao as ShareArtifactResult, ap as ShareArtifactV2, aq as ShareCache, ar as ShareCacheEntry, as as ShareCacheKey, at as ShareCacheMetadata, au as ShareCapabilityLike, av as ShareConflict, aw as ShareContentMetadata, ax as ShareContentSource, ay as ShareDeliveryAuthorization, az as ShareDeliveryAuthorizationReceipt, aA as ShareDeliveryAuthorizationRequest, aB as ShareDeliveryAuthorizationV3Receipt, aC as ShareDeliveryAuthorizationV3Request, aD as ShareDetachedProof, aE as ShareEnvelopeError, aF as ShareEnvelopeV2, aG as ShareExpiryBounds, aH as ShareKvContentSource, aJ as ShareLinkData, aK as ShareLinkLocation, aL as ShareListEntry, aM as ShareListResult, aN as ShareNativeAction, aO as ShareNativeInvokeEnvelopeV1, aP as ShareNativeInvokeErrorResult, aQ as ShareNativeInvokeInput, aR as ShareNativeInvokeResult, aS as ShareNativeInvokeSuccessResult, aT as ShareNativeResponse, aU as ShareNativeResponseSchema, aV as SharePolicy, aW as SharePolicyBinding, aX as SharePolicySession, aY as SharePolicySessionV1, aZ as SharePolicySessionWireV1, a_ as SharePortableDelegation, a$ as ShareReadInvocationV1, b0 as ShareReadResult, b1 as ShareRecipientClient, b2 as ShareRecipientClientOptions, b4 as ShareRecipientPolicy, b6 as ShareRecipientResult, b7 as ShareRecipientTarget, b9 as ShareResource, bb as ShareSaveOptions, bc as ShareSchema, bd as ShareSqlContentSource, be as ShareWireAction, bf as SharingService, bg as SharingServiceConfig, bh as SignedDelegation, bj as SpaceOwnership, bZ as StoredDelegationChain, bk as ValidateShareDeliveryAuthorizationExpected, bl as VerifyShareEnvelopeOptions, bm as canonicalOwnerSharePolicy, bn as computeOwnerShareRegistrationCid, bo as computeShareCid, b_ as createCapabilityKeyRegistry, bp as createDelegatedShareKey, bq as createPolicyEnforcementDelegation, br as createShareArtifact, bs as createShareArtifactAsync, bt as createSharePolicy, bu as createSharingService, bv as decryptShareBytesAsync, bw as delegatePortablePolicySession, bx as encodeInlineShareUrl, by as encodeShareArtifact, bz as encodeShareUrl, bA as encryptShareBytes, bB as encryptShareBytesAsync, bC as importPortableDelegation, bD as intersectShareCapabilities, bE as isV2ShareLink, bF as normalizeShareActions, bG as normalizeShareRecipientTarget, bH as normalizeShareResource, bI as parsePortableDelegation, bJ as parseShareArtifact, bK as parseShareUrl, bL as restoreDelegatedShareKey, bM as serializePortableDelegation, bN as shareCapabilityAllows, bO as shareDeliveryTrustedKid, bP as signShareEnvelope, bQ as validateOwnerSharePolicyRegistration, bR as validateOwnerSharePolicyRegistrationBytes, bS as validateShareDeliveryAuthorizationBytes, bT as validateShareDeliveryAuthorizationV3Bytes, bU as verifyShareCid, bV as verifyShareEnvelope } from './recipient-types.schema-DjmM_yJu.cjs';
+import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-D9AI8tjN.cjs';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-D9AI8tjN.cjs';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.cjs';
 export { SiweMessage } from 'siwe';
@@ -202,7 +203,7 @@ declare function sha256Base64Url(value: string | Uint8Array): Promise<string>;
 declare function canonicalDigest(value: unknown): Promise<string>;
 declare function isDigest(value: unknown): value is string;
 
-declare const CREDENTIAL_ERROR_CODES: readonly ["ACTIVE_SESSION_REQUIRED", "CANCELED", "DESCRIPTOR_INVALID", "HOLDER_MISMATCH", "ISSUER_UNREADY", "OFFLINE", "POPUP_BLOCKED", "REQUEST_EXPIRED", "REQUEST_SUBSTITUTED", "SIGNATURE_REJECTED", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "VERIFICATION_FAILED", "VERIFIED_NOT_SAVED"];
+declare const CREDENTIAL_ERROR_CODES: readonly ["ACTIVE_SESSION_REQUIRED", "CANCELED", "DESCRIPTOR_INVALID", "HOLDER_MISMATCH", "ISSUER_UNREADY", "OFFLINE", "POPUP_BLOCKED", "PROOF_REJECTED", "REQUEST_EXPIRED", "REQUEST_SUBSTITUTED", "SIGNATURE_REJECTED", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "VERIFICATION_FAILED", "VERIFIED_NOT_SAVED"];
 type CredentialErrorCode = (typeof CREDENTIAL_ERROR_CODES)[number];
 /** Stable, redaction-safe error returned by the credential acquisition module. */
 declare class CredentialError extends Error {
@@ -225,11 +226,19 @@ declare class CredentialError extends Error {
 declare function credentialError(value: unknown, fallbackCode?: CredentialErrorCode): CredentialError;
 
 declare const EMAIL_CREDENTIAL_MAX_AGE_SECONDS: 3600;
+/** Matches the issuer's 300-second status freshness for mailbox proofs. */
+declare const EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS: 300;
 declare function createEmailCredentialRequirement(input: {
     readonly email: string;
     readonly profile: CredentialRequirement["profile"];
     readonly credentialType: CredentialRequirement["credentialType"];
 }): CredentialRequirement;
+/** Requirement satisfied by any proved mailbox whose issuer-derived domain equals `domain` exactly. */
+declare function createEmailDomainCredentialRequirement(input: {
+    readonly domain: string;
+    readonly profile: CredentialRequirement["profile"];
+    readonly credentialType: CredentialRequirement["credentialType"];
+}): CredentialRequirement;
 declare function validateCredentialRequirement(value: unknown): CredentialRequirement;
 declare function credentialRequirementDigest(requirement: CredentialRequirement): Promise<string>;
 declare function descriptorSatisfiesRequirement(descriptor: CredentialFlowDescriptor, requirement: CredentialRequirement): boolean;
@@ -3212,6 +3221,39 @@ interface LocationRecordPayload {
 interface LocationRecord extends LocationRecordPayload {
     signature: string;
 }
+interface VerifyOwnerNodeBindingOptions {
+    /** Registry that serves the owner's signed location record. */
+    registryUrl: string;
+    /** Owner DID that signed both the location record and share policy. */
+    ownerDid: string;
+    /** Exact node origin carried by the share target. */
+    nodeOrigin: string;
+    /** Exact node DID carried by the node-attested share target. */
+    nodeDid: string;
+    /** Custom fetch implementation. Defaults to globalThis.fetch. */
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+    /** Total registry + Node identity lookup budget. Defaults to 5 seconds. */
+    timeoutMs?: number;
+}
+interface VerifiedOwnerNodeBinding {
+    readonly record: LocationRecord;
+    readonly nodeOrigin: string;
+    readonly nodeDid: string;
+}
+interface PublishLocationRecordOptions {
+    /** Public registry that stores the signed discovery record. */
+    registryUrl: string;
+    /** DID that owns the active TinyCloud session. */
+    subject: string;
+    /** Exact active TinyCloud node origin to publish. */
+    nodeOrigin: string;
+    /** Signer for `subject`; the registry never receives private key material. */
+    signer: LocationRecordSigner;
+    /** Custom fetch implementation. Defaults to globalThis.fetch. */
+    fetch?: typeof fetch;
+    now?: () => Date;
+}
 /**
  * Where a resolved TinyCloud host came from, ordered highest to lowest
  * priority. `local-loopback` and `local-link` are probed + identity-verified
@@ -3231,6 +3273,8 @@ declare const LOCAL_LOOPBACK_PROBE_TIMEOUT_MS = 250;
 declare const LOCAL_LINK_PROBE_TIMEOUT_MS = 750;
 /** Hostname suffix identifying a local-link tunnel candidate. */
 declare const LOCAL_LINK_HOST_SUFFIX = ".local.tinycloud.link";
+/** Total network budget for an owner registry record plus live Node identity. */
+declare const OWNER_NODE_BINDING_TIMEOUT_MS = 5000;
 interface LocationCandidate {
     source: LocationSource;
     multiaddrs: string[];
@@ -3372,6 +3416,11 @@ type LocationRecordSigner = {
 declare class LocationRecordValidationError extends Error {
     constructor(message: string);
 }
+/** The location registry answered with a non-success HTTP status. */
+declare class LocationRegistryHttpError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
 declare class CloudLocationResolutionError extends Error {
     readonly attempts: LocationResolutionAttempt[];
     constructor(subject: string, attempts: LocationResolutionAttempt[]);
@@ -3382,7 +3431,16 @@ declare function signLocationRecord(payload: LocationRecordPayload, signer: Loca
 declare function validateLocationRecordPayload(input: unknown): LocationRecordPayload;
 declare function validateLocationRecord(input: unknown): LocationRecord;
 declare function verifyLocationRecord(input: LocationRecord): Promise<boolean>;
-declare function fetchLocationRecord(registryUrl: string, subject: string, fetchFn?: typeof fetch): Promise<LocationRecord | null>;
+declare function fetchLocationRecord(registryUrl: string, subject: string, fetchFn?: typeof fetch, signal?: AbortSignal): Promise<LocationRecord | null>;
+/**
+ * Publish the active owner node as a subject-signed discovery record.
+ *
+ * Existing signed multiaddrs are preserved and the exact active origin is
+ * added once. A matching live record is returned without another signature.
+ * This makes registry publication idempotent for application sign-in/share
+ * flows while keeping the registry a cache, never an authority.
+ */
+declare function publishLocationRecord(options: PublishLocationRecordOptions): Promise<LocationRecord>;
 declare function resolveCloudLocation(subject: string, options?: ResolveCloudLocationOptions): Promise<ResolvedCloudLocation>;
 declare function resolveTinyCloudHosts(subject: string, options?: ResolveTinyCloudHostsOptions): Promise<ResolvedTinyCloudHosts>;
 /**
@@ -3403,6 +3461,15 @@ declare function resolveTinyCloudHosts(subject: string, options?: ResolveTinyClo
  */
 declare function discoverLocalTinyCloudNode(options?: DiscoverLocalTinyCloudNodeOptions): Promise<DiscoveredLocalTinyCloudNode | null>;
 declare function multiaddrToHttpUrl(input: string): string;
+/**
+ * Proves that an addressed-share target is the owner's published TinyCloud.
+ *
+ * The share envelope alone can only prove that its keys agree with each
+ * other. This adds the external discovery anchor: the owner must have signed
+ * a registry record naming the exact target origin, and that origin must
+ * answer `/info` with the exact node DID attested in the share.
+ */
+declare function verifyOwnerNodeBinding(options: VerifyOwnerNodeBindingOptions): Promise<VerifiedOwnerNodeBinding>;
 declare function httpUrlToMultiaddr(input: string): string;
 declare function verifyDidKeyEd25519Signature(did: string, payload: Uint8Array, signature: Uint8Array): boolean;
 
@@ -3435,4 +3502,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };

package/dist/index.d.ts

@@ -1,11 +1,12 @@
 import { z } from 'zod';
-import { bo as CredentialHolderBinding, bp as CredentialFlowDescriptor, bq as CredentialRequirement, br as StoredCredentialRecord, bs as VerifiedCredential, bt as CredentialStorageReceipt, bu as IssuedCredentialEnvelope, bv as CredentialIssuerMetadata } from './credential-admission-DIEPgQ0o.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bw as CREDENTIAL_ACQUISITION_PROTOCOL, bx as CREDENTIAL_CONTRACT_VERSION, by as CREDENTIAL_FORMAT, bw as CREDENTIAL_PROTOCOL, bz as CREDENTIAL_STEP_REGISTRY_VERSION, g as CompactUcanAuthorizationV1, bA as CredentialClaimDescriptor, bB as CredentialEndpointId, bC as CredentialInputDescriptor, bD as CredentialProgressEvent, bE as CredentialStepDescriptor, bF as CredentialStepType, bG as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, h as EIP191_JCS_SIGNATURE_SUITE, bH as HOLDER_BINDING_DOMAIN, bI as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, i as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, j as POLICY_CAPABILITY_V1_DOMAIN, k as POLICY_CAPABILITY_V1_SCHEMA, l as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, m as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, n as POLICY_ENGINE_RECORD_SCHEMA, o as POLICY_PRESENTATION_V3_DOMAIN, p as POLICY_PRESENTATION_V3_SCHEMA, q as POLICY_PRESENTATION_V4_DOMAIN, r as POLICY_PRESENTATION_V4_SCHEMA, s as POLICY_SCHEMA, t as POLICY_SESSION_UCAN_V1_PROFILE, u as POLICY_STATUS_SCHEMA, v as POLICY_V1_DOMAIN, w as POLICY_V1_SCHEMA, x as POLICY_V2_DOMAIN, y as POLICY_V2_SCHEMA, a as Policy, D as PolicyCredentialAdmissionV3, F as PolicyCredentialAdmissionV4, G as PolicyCredentialPresentationV3, H as PolicyCredentialPresentationV4, I as PolicyCredentialRequirementV1, P as PolicyEngineRecord, K as PolicyRootStatusV3, O as PolicyRootV3, Q as PolicySessionUcanFactV1, R as PolicySessionUcanV1, T as PolicyStatus, V as ROOT_REVOCATION_V1_DOMAIN, W as ROOT_REVOCATION_V1_SCHEMA, X as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Y as ROOT_STATUS_RENEWAL_V1_DOMAIN, Z as ROOT_STATUS_V1_DOMAIN, _ as RegisterPolicyV3Input, $ as RegisterPolicyV3Receipt, a0 as SignCompactUcanAuthorizationInput, a1 as SignCompactUcanRootAuthorizationInput, a2 as SignatureMaterialError, a3 as SignatureSuite, a4 as SignatureVerificationError, a5 as SignedObjectCanonicalizationError, a6 as SignedObjectDigestError, a7 as SignedObjectErrorCode, a8 as SignedObjectIdError, a9 as SignedObjectKind, aa as SignedObjectMaterial, ab as SignedObjectProfileError, ac as SignedObjectSchemaError, ad as SignedObjectSignature, S as SignedObjectSigner, ae as SignedObjectVerificationResult, af as SignedPolicyObject, ag as SigningKeyBindingError, ah as UnifiedContentSource, ai as UnifiedEncryptionCapability, aj as UnifiedKvCapability, ak as UnifiedNativeCapability, al as UnifiedPolicyCapability, am as UnifiedPolicyV1, an as UnifiedPolicyV2, ao as UnifiedResourceSelector, ap as UnsignedPolicy, aq as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, ar as UnsignedPolicyObject, as as UnsignedPolicyStatus, at as UnsignedUnifiedPolicyV2, au as UnsupportedSignatureSuiteError, av as admitPolicyCredentialV3, aw as admitPolicyCredentialV4, ax as buildPolicyCredentialPresentationV3, ay as buildPolicyCredentialPresentationV4, az as canonicalizeSignedObjectUnsigned, aA as canonicalizeUnifiedPolicyCapability, aB as compactAttenuationContains, aC as contentSourceDigestHex, aD as createAndSignPolicy, aE as createAndSignPolicyEngineRecord, aF as createAndSignPolicyStatus, aG as createAndSignSignedObject, aJ as deriveSignedObjectMaterial, aK as getPolicyRootStatusV3, aL as issuedCredentialEnvelopeFromVerified, aN as normalizeUnifiedPolicyCapability, aO as parseCompactUcanAuthorization, aP as parsePolicySessionUcan, aQ as policyCidFromCanonicalBytes, aR as policyDigestHex, aS as policyIdForDigestHex, aT as policyV2DigestHex, aU as projectUnifiedPolicyCapabilities, aV as projectUnifiedPolicyCapability, aW as registerPolicyV3, aX as renewPolicyRootStatusV3, aZ as revokePolicyRootV3, a_ as signCompactUcanAuthorization, a$ as signCompactUcanRootAuthorization, b0 as signPolicyCredentialPresentationV4, b1 as signedObjectIdFor, b2 as toSignedObjectError, b3 as unifiedNativeProjectionHashHex, b4 as unifiedPolicyCapabilityContains, b5 as unifiedPolicyCapabilityDigestHex, b6 as unifiedPolicyCapabilityFromNative, b7 as validatePolicyCredentialRequirementV1, b8 as validatePolicyEngineRecordSigned, b9 as validatePolicyEngineRecordSignedShape, ba as validatePolicyEngineRecordUnsigned, bb as validatePolicySigned, bc as validatePolicySignedShape, bd as validatePolicyStatusSigned, be as validatePolicyStatusSignedShape, bf as validatePolicyStatusUnsigned, bg as validatePolicyUnsigned, bh as validateUnifiedPolicyV2, bi as verifyPolicy, bj as verifyPolicyEngineRecord, bk as verifyPolicyRootRevocationV3, bl as verifyPolicyRootStatusCheckpointV3, bm as verifyPolicyStatus, bn as verifySignedObject } from './credential-admission-DIEPgQ0o.js';
+import { bq as CredentialHolderBinding, br as CredentialFlowDescriptor, bs as CredentialRequirement, bt as StoredCredentialRecord, bu as VerifiedCredential, bv as CredentialStorageReceipt, bw as IssuedCredentialEnvelope, bx as CredentialIssuerMetadata } from './credential-admission-CO9WMtGs.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, by as CREDENTIAL_ACQUISITION_PROTOCOL, bz as CREDENTIAL_CONTRACT_VERSION, bA as CREDENTIAL_FORMAT, by as CREDENTIAL_PROTOCOL, bB as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bC as CredentialClaimDescriptor, bD as CredentialEndpointId, bE as CredentialInputDescriptor, bF as CredentialProgressEvent, bG as CredentialStepDescriptor, bH as CredentialStepType, bI as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bJ as HOLDER_BINDING_DOMAIN, bK as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as policyCidFromCanonicalBytes, aS as policyDigestHex, aT as policyIdForDigestHex, aU as policyV2DigestHex, aV as projectUnifiedPolicyCapabilities, aW as projectUnifiedPolicyCapability, aX as registerPolicyV3, aY as renewPolicyRootStatusV3, a_ as revokePolicyRootV3, a$ as signCompactPolicyDescendant, b0 as signCompactUcanAuthorization, b1 as signCompactUcanRootAuthorization, b2 as signPolicyCredentialPresentationV4, b3 as signedObjectIdFor, b4 as toSignedObjectError, b5 as unifiedNativeProjectionHashHex, b6 as unifiedPolicyCapabilityContains, b7 as unifiedPolicyCapabilityDigestHex, b8 as unifiedPolicyCapabilityFromNative, b9 as validatePolicyCredentialRequirementV1, ba as validatePolicyEngineRecordSigned, bb as validatePolicyEngineRecordSignedShape, bc as validatePolicyEngineRecordUnsigned, bd as validatePolicySigned, be as validatePolicySignedShape, bf as validatePolicyStatusSigned, bg as validatePolicyStatusSignedShape, bh as validatePolicyStatusUnsigned, bi as validatePolicyUnsigned, bj as validateUnifiedPolicyV2, bk as verifyPolicy, bl as verifyPolicyEngineRecord, bm as verifyPolicyRootRevocationV3, bn as verifyPolicyRootStatusCheckpointV3, bo as verifyPolicyStatus, bp as verifySignedObject } from './credential-admission-CO9WMtGs.js';
+export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, parseSecretCatalogKey, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
-import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aI as ShareLink, bi as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-DjmM_yJu.js';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bW as CapabilityKeyRegistry, bX as CapabilityKeyRegistryErrorCode, bY as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a6 as SenderShareKeyStorage, a7 as SenderShareRecord, a8 as SenderShareRecordStorage, a9 as SenderShareRevocationScope, aa as SenderShareStore, ab as ShareAccess, ac as ShareAccessError, ad as ShareAccessV2, ae as ShareAction, ag as ShareAddressedDelegationEnvelopeV2, ah as ShareAddressedDelegationEnvelopeV2Schema, ai as ShareAddressedDelegationRequestV2, aj as ShareAddressedDelegationRequestV2Schema, ak as ShareAddressedDelegationResponseV2, al as ShareAddressedDelegationResponseV2Schema, am as ShareAddressedRecipientMatcher, an as ShareArtifactInput, ao as ShareArtifactResult, ap as ShareArtifactV2, aq as ShareCache, ar as ShareCacheEntry, as as ShareCacheKey, at as ShareCacheMetadata, au as ShareCapabilityLike, av as ShareConflict, aw as ShareContentMetadata, ax as ShareContentSource, ay as ShareDeliveryAuthorization, az as ShareDeliveryAuthorizationReceipt, aA as ShareDeliveryAuthorizationRequest, aB as ShareDeliveryAuthorizationV3Receipt, aC as ShareDeliveryAuthorizationV3Request, aD as ShareDetachedProof, aE as ShareEnvelopeError, aF as ShareEnvelopeV2, aG as ShareExpiryBounds, aH as ShareKvContentSource, aJ as ShareLinkData, aK as ShareLinkLocation, aL as ShareListEntry, aM as ShareListResult, aN as ShareNativeAction, aO as ShareNativeInvokeEnvelopeV1, aP as ShareNativeInvokeErrorResult, aQ as ShareNativeInvokeInput, aR as ShareNativeInvokeResult, aS as ShareNativeInvokeSuccessResult, aT as ShareNativeResponse, aU as ShareNativeResponseSchema, aV as SharePolicy, aW as SharePolicyBinding, aX as SharePolicySession, aY as SharePolicySessionV1, aZ as SharePolicySessionWireV1, a_ as SharePortableDelegation, a$ as ShareReadInvocationV1, b0 as ShareReadResult, b1 as ShareRecipientClient, b2 as ShareRecipientClientOptions, b4 as ShareRecipientPolicy, b6 as ShareRecipientResult, b7 as ShareRecipientTarget, b9 as ShareResource, bb as ShareSaveOptions, bc as ShareSchema, bd as ShareSqlContentSource, be as ShareWireAction, bf as SharingService, bg as SharingServiceConfig, bh as SignedDelegation, bj as SpaceOwnership, bZ as StoredDelegationChain, bk as ValidateShareDeliveryAuthorizationExpected, bl as VerifyShareEnvelopeOptions, bm as canonicalOwnerSharePolicy, bn as computeOwnerShareRegistrationCid, bo as computeShareCid, b_ as createCapabilityKeyRegistry, bp as createDelegatedShareKey, bq as createPolicyEnforcementDelegation, br as createShareArtifact, bs as createShareArtifactAsync, bt as createSharePolicy, bu as createSharingService, bv as decryptShareBytesAsync, bw as delegatePortablePolicySession, bx as encodeInlineShareUrl, by as encodeShareArtifact, bz as encodeShareUrl, bA as encryptShareBytes, bB as encryptShareBytesAsync, bC as importPortableDelegation, bD as intersectShareCapabilities, bE as isV2ShareLink, bF as normalizeShareActions, bG as normalizeShareRecipientTarget, bH as normalizeShareResource, bI as parsePortableDelegation, bJ as parseShareArtifact, bK as parseShareUrl, bL as restoreDelegatedShareKey, bM as serializePortableDelegation, bN as shareCapabilityAllows, bO as shareDeliveryTrustedKid, bP as signShareEnvelope, bQ as validateOwnerSharePolicyRegistration, bR as validateOwnerSharePolicyRegistrationBytes, bS as validateShareDeliveryAuthorizationBytes, bT as validateShareDeliveryAuthorizationV3Bytes, bU as verifyShareCid, bV as verifyShareEnvelope } from './recipient-types.schema-DjmM_yJu.js';
+import { p as Delegation, f as CreateDelegationParams, G as GenerateShareParams, aF as ShareLink, bf as SpaceInfo, I as ICapabilityKeyRegistry, H as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, z as DelegationRevocationReceipt } from './recipient-types.schema-D9AI8tjN.js';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CREDENTIAL_INVITATION_REQUEST_DOMAIN, e as CapabilityEntry, bQ as CapabilityKeyRegistry, bR as CapabilityKeyRegistryErrorCode, bS as CapabilityKeyRegistryErrorCodes, g as CreateDelegationWasmParams, h as CreateDelegationWasmResult, i as CreateOwnerDelegationParams, j as CredentialInvitationRequest, k as DELIVERY_ADMISSION_DOMAIN, l as DelegateReceivedShareParams, m as DelegatedResource, n as DelegatedShareAccess, o as DelegatedShareKey, q as DelegationApiResponse, r as DelegationChain, s as DelegationChainV2, t as DelegationDirection, a as DelegationError, u as DelegationErrorCode, v as DelegationErrorCodes, w as DelegationFilters, x as DelegationManagerConfig, y as DelegationRecord, R as DelegationResult, B as DelegationStatus, E as DeliveryAdmission, F as EncodedShareData, J as IngestOptions, K as JWK, L as KeyInfo, M as KeyProvider, N as KeyType, O as MAX_CONTENT_BYTES, P as MAX_SEALED_SHARE_CONTENT_BYTES, Q as MAX_SHARE_ARTIFACT_BYTES, S as MAX_SHARE_CONTENT_BYTES, T as MemorySenderShareKeyStorage, U as MemorySenderShareRecordStorage, V as MemoryShareCache, W as OwnerDelegationPermission, X as OwnerDelegationReceipt, Y as OwnerShareAction, Z as OwnerShareDecryption, _ as OwnerShareMatcher, $ as OwnerSharePolicyRegistration, a0 as OwnerSharePolicyRegistrationReceipt, a1 as OwnerSharePolicyV2, a2 as PortableDelegationImportReceipt, a3 as ReceiveOptions, a4 as RegisterOwnerSharePolicyParams, a5 as SenderShareKeyStorage, a6 as SenderShareRecord, a7 as SenderShareRecordStorage, a8 as SenderShareRevocationScope, a9 as SenderShareStore, aa as ShareAccess, ab as ShareAccessError, ac as ShareAccessV2, ad as ShareAction, af as ShareAddressedDelegationEnvelopeV2, ag as ShareAddressedDelegationEnvelopeV2Schema, ah as ShareAddressedDelegationRequestV2, ai as ShareAddressedDelegationRequestV2Schema, aj as ShareAddressedDelegationResponseV2, ak as ShareAddressedDelegationResponseV2Schema, al as ShareAddressedRecipientMatcher, am as ShareArtifactInput, an as ShareArtifactResult, ao as ShareArtifactV2, ap as ShareCache, aq as ShareCacheEntry, ar as ShareCacheKey, as as ShareCacheMetadata, at as ShareCapabilityLike, au as ShareConflict, av as ShareContentMetadata, aw as ShareContentSource, ax as ShareDelegationPreflight, ay as ShareDeliveryAuthorizationV3Receipt, az as ShareDeliveryAuthorizationV3Request, aA as ShareDetachedProof, aB as ShareEnvelopeError, aC as ShareEnvelopeV2, aD as ShareExpiryBounds, aE as ShareKvContentSource, aG as ShareLinkData, aH as ShareLinkLocation, aI as ShareListEntry, aJ as ShareListResult, aK as ShareNativeAction, aL as ShareNativeInvokeEnvelopeV1, aM as ShareNativeInvokeErrorResult, aN as ShareNativeInvokeInput, aO as ShareNativeInvokeResult, aP as ShareNativeInvokeSuccessResult, aQ as ShareNativeResponse, aR as ShareNativeResponseSchema, aS as SharePolicy, aT as SharePolicyBinding, aU as SharePolicySession, aV as SharePolicySessionV1, aW as SharePolicySessionWireV1, aX as SharePortableDelegation, aY as ShareReadInvocationV1, aZ as ShareReadResult, a_ as ShareRecipientClient, a$ as ShareRecipientClientOptions, b1 as ShareRecipientPolicy, b3 as ShareRecipientResult, b4 as ShareRecipientTarget, b6 as ShareResource, b8 as ShareSaveOptions, b9 as ShareSchema, ba as ShareSqlContentSource, bb as ShareWireAction, bc as SharingService, bd as SharingServiceConfig, be as SignedDelegation, bg as SpaceOwnership, bT as StoredDelegationChain, bh as VerifyShareEnvelopeOptions, bi as canonicalOwnerSharePolicy, bj as computeOwnerShareRegistrationCid, bk as computeShareCid, bU as createCapabilityKeyRegistry, bl as createDelegatedShareKey, bm as createPolicyEnforcementDelegation, bn as createShareArtifact, bo as createShareArtifactAsync, bp as createSharePolicy, bq as createSharingService, br as decryptShareBytesAsync, bs as delegatePortablePolicySession, bt as encodeInlineShareUrl, bu as encodeShareArtifact, bv as encodeShareUrl, bw as encryptShareBytes, bx as encryptShareBytesAsync, by as importPortableDelegation, bz as intersectShareCapabilities, bA as isV2ShareLink, bB as normalizeShareActions, bC as normalizeShareRecipientTarget, bD as normalizeShareResource, bE as parsePortableDelegation, bF as parseShareArtifact, bG as parseShareUrl, bH as restoreDelegatedShareKey, bI as serializePortableDelegation, bJ as shareCapabilityAllows, bK as signShareEnvelope, bL as validateOwnerSharePolicyRegistration, bM as validateOwnerSharePolicyRegistrationBytes, bN as validateShareDeliveryAuthorizationV3Bytes, bO as verifyShareCid, bP as verifyShareEnvelope } from './recipient-types.schema-D9AI8tjN.js';
 export { ACCOUNT_INDEX_SCHEMA, ACCOUNT_MANIFEST_PERMISSIONS, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';
 export { SiweMessage } from 'siwe';
@@ -202,7 +203,7 @@ declare function sha256Base64Url(value: string | Uint8Array): Promise<string>;
 declare function canonicalDigest(value: unknown): Promise<string>;
 declare function isDigest(value: unknown): value is string;
 
-declare const CREDENTIAL_ERROR_CODES: readonly ["ACTIVE_SESSION_REQUIRED", "CANCELED", "DESCRIPTOR_INVALID", "HOLDER_MISMATCH", "ISSUER_UNREADY", "OFFLINE", "POPUP_BLOCKED", "REQUEST_EXPIRED", "REQUEST_SUBSTITUTED", "SIGNATURE_REJECTED", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "VERIFICATION_FAILED", "VERIFIED_NOT_SAVED"];
+declare const CREDENTIAL_ERROR_CODES: readonly ["ACTIVE_SESSION_REQUIRED", "CANCELED", "DESCRIPTOR_INVALID", "HOLDER_MISMATCH", "ISSUER_UNREADY", "OFFLINE", "POPUP_BLOCKED", "PROOF_REJECTED", "REQUEST_EXPIRED", "REQUEST_SUBSTITUTED", "SIGNATURE_REJECTED", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "VERIFICATION_FAILED", "VERIFIED_NOT_SAVED"];
 type CredentialErrorCode = (typeof CREDENTIAL_ERROR_CODES)[number];
 /** Stable, redaction-safe error returned by the credential acquisition module. */
 declare class CredentialError extends Error {
@@ -225,11 +226,19 @@ declare class CredentialError extends Error {
 declare function credentialError(value: unknown, fallbackCode?: CredentialErrorCode): CredentialError;
 
 declare const EMAIL_CREDENTIAL_MAX_AGE_SECONDS: 3600;
+/** Matches the issuer's 300-second status freshness for mailbox proofs. */
+declare const EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS: 300;
 declare function createEmailCredentialRequirement(input: {
     readonly email: string;
     readonly profile: CredentialRequirement["profile"];
     readonly credentialType: CredentialRequirement["credentialType"];
 }): CredentialRequirement;
+/** Requirement satisfied by any proved mailbox whose issuer-derived domain equals `domain` exactly. */
+declare function createEmailDomainCredentialRequirement(input: {
+    readonly domain: string;
+    readonly profile: CredentialRequirement["profile"];
+    readonly credentialType: CredentialRequirement["credentialType"];
+}): CredentialRequirement;
 declare function validateCredentialRequirement(value: unknown): CredentialRequirement;
 declare function credentialRequirementDigest(requirement: CredentialRequirement): Promise<string>;
 declare function descriptorSatisfiesRequirement(descriptor: CredentialFlowDescriptor, requirement: CredentialRequirement): boolean;
@@ -3212,6 +3221,39 @@ interface LocationRecordPayload {
 interface LocationRecord extends LocationRecordPayload {
     signature: string;
 }
+interface VerifyOwnerNodeBindingOptions {
+    /** Registry that serves the owner's signed location record. */
+    registryUrl: string;
+    /** Owner DID that signed both the location record and share policy. */
+    ownerDid: string;
+    /** Exact node origin carried by the share target. */
+    nodeOrigin: string;
+    /** Exact node DID carried by the node-attested share target. */
+    nodeDid: string;
+    /** Custom fetch implementation. Defaults to globalThis.fetch. */
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+    /** Total registry + Node identity lookup budget. Defaults to 5 seconds. */
+    timeoutMs?: number;
+}
+interface VerifiedOwnerNodeBinding {
+    readonly record: LocationRecord;
+    readonly nodeOrigin: string;
+    readonly nodeDid: string;
+}
+interface PublishLocationRecordOptions {
+    /** Public registry that stores the signed discovery record. */
+    registryUrl: string;
+    /** DID that owns the active TinyCloud session. */
+    subject: string;
+    /** Exact active TinyCloud node origin to publish. */
+    nodeOrigin: string;
+    /** Signer for `subject`; the registry never receives private key material. */
+    signer: LocationRecordSigner;
+    /** Custom fetch implementation. Defaults to globalThis.fetch. */
+    fetch?: typeof fetch;
+    now?: () => Date;
+}
 /**
  * Where a resolved TinyCloud host came from, ordered highest to lowest
  * priority. `local-loopback` and `local-link` are probed + identity-verified
@@ -3231,6 +3273,8 @@ declare const LOCAL_LOOPBACK_PROBE_TIMEOUT_MS = 250;
 declare const LOCAL_LINK_PROBE_TIMEOUT_MS = 750;
 /** Hostname suffix identifying a local-link tunnel candidate. */
 declare const LOCAL_LINK_HOST_SUFFIX = ".local.tinycloud.link";
+/** Total network budget for an owner registry record plus live Node identity. */
+declare const OWNER_NODE_BINDING_TIMEOUT_MS = 5000;
 interface LocationCandidate {
     source: LocationSource;
     multiaddrs: string[];
@@ -3372,6 +3416,11 @@ type LocationRecordSigner = {
 declare class LocationRecordValidationError extends Error {
     constructor(message: string);
 }
+/** The location registry answered with a non-success HTTP status. */
+declare class LocationRegistryHttpError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
 declare class CloudLocationResolutionError extends Error {
     readonly attempts: LocationResolutionAttempt[];
     constructor(subject: string, attempts: LocationResolutionAttempt[]);
@@ -3382,7 +3431,16 @@ declare function signLocationRecord(payload: LocationRecordPayload, signer: Loca
 declare function validateLocationRecordPayload(input: unknown): LocationRecordPayload;
 declare function validateLocationRecord(input: unknown): LocationRecord;
 declare function verifyLocationRecord(input: LocationRecord): Promise<boolean>;
-declare function fetchLocationRecord(registryUrl: string, subject: string, fetchFn?: typeof fetch): Promise<LocationRecord | null>;
+declare function fetchLocationRecord(registryUrl: string, subject: string, fetchFn?: typeof fetch, signal?: AbortSignal): Promise<LocationRecord | null>;
+/**
+ * Publish the active owner node as a subject-signed discovery record.
+ *
+ * Existing signed multiaddrs are preserved and the exact active origin is
+ * added once. A matching live record is returned without another signature.
+ * This makes registry publication idempotent for application sign-in/share
+ * flows while keeping the registry a cache, never an authority.
+ */
+declare function publishLocationRecord(options: PublishLocationRecordOptions): Promise<LocationRecord>;
 declare function resolveCloudLocation(subject: string, options?: ResolveCloudLocationOptions): Promise<ResolvedCloudLocation>;
 declare function resolveTinyCloudHosts(subject: string, options?: ResolveTinyCloudHostsOptions): Promise<ResolvedTinyCloudHosts>;
 /**
@@ -3403,6 +3461,15 @@ declare function resolveTinyCloudHosts(subject: string, options?: ResolveTinyClo
  */
 declare function discoverLocalTinyCloudNode(options?: DiscoverLocalTinyCloudNodeOptions): Promise<DiscoveredLocalTinyCloudNode | null>;
 declare function multiaddrToHttpUrl(input: string): string;
+/**
+ * Proves that an addressed-share target is the owner's published TinyCloud.
+ *
+ * The share envelope alone can only prove that its keys agree with each
+ * other. This adds the external discovery anchor: the owner must have signed
+ * a registry record naming the exact target origin, and that origin must
+ * answer `/info` with the exact node DID attested in the share.
+ */
+declare function verifyOwnerNodeBinding(options: VerifyOwnerNodeBindingOptions): Promise<VerifiedOwnerNodeBinding>;
 declare function httpUrlToMultiaddr(input: string): string;
 declare function verifyDidKeyEd25519Signature(did: string, payload: Uint8Array, signature: Uint8Array): boolean;
 
@@ -3435,4 +3502,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyStorageReceipt };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountApplicationRegisterOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, CREDENTIAL_ERROR_CODES, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CanonicalTinyCloudIdentity, type CapabilityPresentationEnvelopeV1, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, CredentialError, type CredentialErrorCode, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialRequirement, CredentialStorageReceipt, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, EMAIL_CREDENTIAL_MAX_AGE_SECONDS, EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type ImmutableSiweFields, IssuedCredentialEnvelope, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, LocationRegistryHttpError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, OPENKEY_ACTION_ID_SEPARATOR, OWNER_NODE_BINDING_TIMEOUT_MS, type OpenKeyCallbackStrategy, type OpenKeyManageKeyCallbackStrategy, OpenKeyManageKeyError, type OpenKeyManageKeyErrorCode, type OpenKeyManageKeyFetch, type OpenKeyManageKeySigningRequestBody, type OpenKeyManageKeySigningResponseBody, type OpenKeyManageKeySigningStrategyOptions, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type PublishLocationRecordOptions, type RecapAttenuation, type RegisterBatchSuccess, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, StoredCredentialRecord, type SubsetCheckResult, TINYCLOUD_CANONICAL_IDENTITY_CLAIM, TINYCLOUD_MANAGE_KEY_SCOPE, TinyCloud, type TinyCloudAuthorizationRequestV1, type TinyCloudAuthorizationResultV1, type TinyCloudConfig, type TinyCloudEffectiveGrantV1, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VerifiedCredential, type VerifiedOwnerNodeBinding, type VerifyOwnerNodeBindingOptions, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalDigest, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createEmailCredentialRequirement, createEmailDomainCredentialRequirement, createHolderBinding, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createOpenKeyManageKeySigningStrategy, createSpaceService, createStorageReceipt, createStoredCredentialRecord, credentialEndpointPath, credentialError, credentialIndexKey, credentialMatchesRequirement, credentialRecordKey, credentialRequirementDigest, decodeBase64Url, defaultSignStrategy, defaultSpaceCreationHandler, descriptorSatisfiesRequirement, didCacheKey, didEquals, diffImmutableSiweFields, discoverLocalTinyCloudNode, encodeBase64Url, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, extractImmutableSiweFields, extractRecapAttenuations, fetchLocationRecord, fetchPeerId, hasTinyCloudManageKeyScope, holderBindingCanonicalBytes, holderBindingSigningBytes, httpUrlToMultiaddr, isCapabilitySubset, isDigest, isEvmAddress, isPlausibleOpenKeyActionId, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseCanonicalRecapResource, parseCanonicalTinyCloudIdentity, parseCanonicalTinyCloudIdentityClaims, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, publishLocationRecord, recapCaveatsEqual, requestTinyCloudManageKeyScope, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, sha256Base64Url, signLocationRecord, submitHostDelegation, unauthorizedRecapCapabilities, validateAuthorizationResultV1, validateClientSession, validateCredentialFlowDescriptor, validateCredentialHolderBinding, validateCredentialRequirement, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyEip191MessageSignature, verifyIssuedCredential, verifyLocationRecord, verifyOwnerNodeBinding, verifyStorageReceipt };