@tinycloud/sdk-core 3.0.0-beta.9 → 3.0.0

package/dist/index.js

@@ -311,6 +311,7 @@ var CREDENTIAL_ERROR_CODES = [
   "ISSUER_UNREADY",
   "OFFLINE",
   "POPUP_BLOCKED",
+  "PROOF_REJECTED",
   "REQUEST_EXPIRED",
   "REQUEST_SUBSTITUTED",
   "SIGNATURE_REJECTED",
@@ -324,6 +325,7 @@ var RECOVERABLE = /* @__PURE__ */ new Set([
   "ISSUER_UNREADY",
   "OFFLINE",
   "POPUP_BLOCKED",
+  "PROOF_REJECTED",
   "REQUEST_EXPIRED",
   "SIGNATURE_REJECTED",
   "UNSUPPORTED_PROFILE",
@@ -392,6 +394,7 @@ function holderBindingSigningBytes(binding) {
 
 // src/credentials/descriptor.ts
 var ID = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
+var CLAIM_NAME = /^[a-z0-9][A-Za-z0-9._-]{0,127}$/;
 var STEP_TYPES = /* @__PURE__ */ new Set(["collect_input", "mailbox_otp", "holder_signature"]);
 var ENDPOINTS = {
   request: "request",
@@ -472,7 +475,7 @@ function validateCredentialFlowDescriptor(value) {
   for (const value2 of raw.claims) {
     const claim = object(value2, "claim");
     exact(claim, ["name", "matching", "selectiveDisclosure"], "claim");
-    const name2 = text(claim.name, "claim.name", ID);
+    const name2 = text(claim.name, "claim.name", CLAIM_NAME);
     if (claimNames.has(name2) || claim.matching !== "normalized_exact" || typeof claim.selectiveDisclosure !== "boolean") fail("claim is invalid");
     claimNames.add(name2);
   }
@@ -563,9 +566,14 @@ function isDigest(value) {
   return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
 }
 
+// src/credentials/email-domain.ts
+import { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from "@tinycloud/share-envelope";
+
 // src/credentials/requirement.ts
 var ID2 = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
 var EMAIL_CREDENTIAL_MAX_AGE_SECONDS = 3600;
+var EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS = 300;
+var CLAIM_NAME2 = /^[a-z0-9][A-Za-z0-9._-]{0,127}$/;
 function createEmailCredentialRequirement(input) {
   return validateCredentialRequirement({
     type: "TinyCloudCredentialRequirement",
@@ -576,6 +584,17 @@ function createEmailCredentialRequirement(input) {
     maxAgeSeconds: EMAIL_CREDENTIAL_MAX_AGE_SECONDS
   });
 }
+function createEmailDomainCredentialRequirement(input) {
+  if (!isCanonicalEmailDomain(input.domain)) throw new CredentialError("UNSUPPORTED_PROFILE", "Email domain is not canonical");
+  return validateCredentialRequirement({
+    type: "TinyCloudCredentialRequirement",
+    version: 1,
+    profile: input.profile,
+    credentialType: input.credentialType,
+    claims: { emailDomain: input.domain },
+    maxAgeSeconds: EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS
+  });
+}
 function validateCredentialRequirement(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential requirement is invalid");
   const raw = value;
@@ -589,7 +608,7 @@ function validateCredentialRequirement(value) {
   if (typeof raw.claims !== "object" || raw.claims === null || Array.isArray(raw.claims)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claims are invalid");
   const claims = {};
   for (const [key, value2] of Object.entries(raw.claims).sort(([a], [b]) => a.localeCompare(b))) {
-    if (!ID2.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
+    if (!CLAIM_NAME2.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
     claims[key] = value2;
   }
   if (raw.maxAgeSeconds !== void 0 && (!Number.isSafeInteger(raw.maxAgeSeconds) || raw.maxAgeSeconds < 1)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential freshness is invalid");
@@ -4012,8 +4031,9 @@ async function signCompactUcanAuthorization(input) {
     throw new Error("compact invocation lifetime must be between one and 60 seconds");
   return signCompactUcan(input);
 }
+var MAX_POLICY_ROOT_SECONDS = 31 * 24 * 60 * 60;
 async function signCompactUcanRootAuthorization(input) {
-  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 31 * 24 * 60 * 60)
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > MAX_POLICY_ROOT_SECONDS)
     throw new Error("compact policy root lifetime must be between one second and 31 days");
   return signCompactUcan({ ...input, proofs: [] });
 }
@@ -4048,7 +4068,7 @@ function createCompactPolicyInvocation(input) {
   const signature = ed255193.sign(signingInput, input.privateKey);
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url2(signature)}`);
 }
-function createCompactPolicyDescendant(input) {
+function compactPolicyDescendantClaims(input) {
   const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);
   if (parent.payload.aud !== input.issuerDid) throw new Error("policy descendant issuer is not the parent audience");
   const parentFact = parent.payload.fct[0];
@@ -4056,29 +4076,53 @@ function createCompactPolicyDescendant(input) {
   if (!Number.isInteger(depth) || depth <= 0) throw new Error("policy descendant depth is exhausted");
   if (!compactAttenuationContains(parent.payload.att, input.attenuation))
     throw new Error("policy descendant exceeds the parent attenuation");
+  const now = Math.max(input.now ?? parent.payload.nbf + 1, parent.payload.nbf + 1);
+  const exp = Math.min(input.expiresAt ?? parent.payload.exp - 1, parent.payload.exp - 1);
+  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
+  return {
+    parentCid: parent.cid,
+    fact: { ...parentFact, remainingRedelegationDepth: depth - 1 },
+    notBefore: now,
+    expiresAt: exp,
+    nonce: input.nonce ?? encodeBase64Url2(crypto.getRandomValues(new Uint8Array(16)))
+  };
+}
+function createCompactPolicyDescendant(input) {
+  const claims = compactPolicyDescendantClaims(input);
   const principal = input.issuerDid.split("#", 1)[0];
   const didMaterial = base58btc.decode(principal.slice("did:key:".length));
   const publicKey = ed255193.getPublicKey(input.privateKey);
   if (didMaterial.length !== 34 || !equalBytes(publicKey, didMaterial.slice(2))) throw new Error("policy descendant signer does not bind issuer DID");
-  const now = Math.max(input.now ?? Math.floor(Date.now() / 1e3), parent.payload.nbf + 1);
-  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);
-  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
   const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url2(publicKey) }, typ: "JWT", ucv: "0.10.0" };
   const payload = {
     att: input.attenuation,
     aud: input.audienceDid,
-    exp,
-    fct: [{ ...parentFact, remainingRedelegationDepth: depth - 1 }],
+    exp: claims.expiresAt,
+    fct: [claims.fact],
     iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
-    nbf: now,
-    nnc: input.nonce ?? encodeBase64Url2(crypto.getRandomValues(new Uint8Array(16))),
-    prf: [parent.cid]
+    nbf: claims.notBefore,
+    nnc: claims.nonce,
+    prf: [claims.parentCid]
   };
   const protectedSegment = encodeBase64Url2(new TextEncoder().encode(jcsCanonicalize(header)));
   const payloadSegment = encodeBase64Url2(new TextEncoder().encode(jcsCanonicalize(payload)));
   const signature = ed255193.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`), input.privateKey);
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url2(signature)}`);
 }
+async function signCompactPolicyDescendant(input) {
+  const claims = compactPolicyDescendantClaims(input);
+  return signCompactUcan({
+    issuerDid: input.issuerDid,
+    audienceDid: input.audienceDid,
+    attenuation: input.attenuation,
+    facts: [claims.fact],
+    proofs: [claims.parentCid],
+    notBefore: claims.notBefore,
+    expiresAt: claims.expiresAt,
+    nonce: claims.nonce,
+    sign: input.sign
+  });
+}
 function compactAttenuationContains(parent, child) {
   const selector = (value) => {
     if (value.length !== 1 || !isRecordValue(value[0])) return void 0;
@@ -4148,7 +4192,7 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
     throw new Error("policy session UCAN fact is incomplete");
   if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
     throw new Error("policy session UCAN v4 audit facts are invalid");
-  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > MAX_POLICY_ROOT_SECONDS || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
     throw new Error("policy session UCAN fact is invalid");
   return {
     authorization,
@@ -4572,24 +4616,21 @@ async function admitPolicyCredentialV3(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(
+  const response = await postPolicyDelegation(
+    fetchFn,
     new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
     {
-      method: "POST",
-      redirect: "error",
-      signal: input.signal,
-      headers: { accept: "application/json", "content-type": "application/json" },
-      body: JSON.stringify({
-        policyCid: input.policyCid,
-        challengeId: challenge.challengeId,
-        nonce: challenge.nonce,
-        requirement: validateCredentialRequirement(input.requirement),
-        credential: envelopeFromVerified(input.credential),
-        accountAuthorizationCid,
-        credentialSpaceId,
-        presentation
-      })
-    }
+      policyCid: input.policyCid,
+      challengeId: challenge.challengeId,
+      nonce: challenge.nonce,
+      requirement: validateCredentialRequirement(input.requirement),
+      credential: envelopeFromVerified(input.credential),
+      accountAuthorizationCid,
+      credentialSpaceId,
+      presentation
+    },
+    requestedSessionExpiry(input.requestedExpiresAt, policy),
+    input.signal
   );
   if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
   const value = record(await response.json(), "policy delegation");
@@ -4630,20 +4671,20 @@ async function admitPolicyCredentialV4(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin), {
-    method: "POST",
-    redirect: "error",
-    signal: input.signal,
-    headers: { accept: "application/json", "content-type": "application/json" },
-    body: JSON.stringify({
+  const response = await postPolicyDelegation(
+    fetchFn,
+    new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
+    {
       policyCid: input.policyCid,
       challengeId: challenge.challengeId,
       nonce: challenge.nonce,
       requirement: validateCredentialRequirement(input.requirement),
       credential: envelopeFromVerified(input.credential),
       presentation
-    })
-  });
+    },
+    requestedSessionExpiry(input.requestedExpiresAt, policy),
+    input.signal
+  );
   if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") throw new Error("policy delegation response is invalid");
@@ -4667,6 +4708,27 @@ async function admitPolicyCredentialV4(input) {
   input.signal?.throwIfAborted();
   return Object.freeze({ challenge, presentation, session, delegationImported: true });
 }
+function requestedSessionExpiry(requested, policy) {
+  const value = requested === void 0 ? policy.expiresAt : requested;
+  if (value === null || value === void 0) return void 0;
+  const seconds = Math.floor(Date.parse(value) / 1e3);
+  if (!Number.isFinite(seconds) || seconds <= Math.floor(Date.now() / 1e3) + 60) return void 0;
+  return new Date(seconds * 1e3).toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+async function postPolicyDelegation(fetchFn, url, body, requestedExpiresAt, signal) {
+  const send = (payload) => fetchFn(url, {
+    method: "POST",
+    redirect: "error",
+    signal,
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify(payload)
+  });
+  if (requestedExpiresAt === void 0) return send(body);
+  const response = await send({ ...body, requestedExpiresAt });
+  if (response.status !== 422) return response;
+  await response.body?.cancel().catch(() => void 0);
+  return send(body);
+}
 function policyRuntimeBasePath2(value) {
   const path = value ?? "/policy/v3";
   if (!/^\/policy(?:\/[a-z0-9-]+)*$/.test(path)) {
@@ -6042,6 +6104,7 @@ var DelegationErrorSchema = z4.object({
 });
 var DelegationErrorCodes = {
   AUTH_REQUIRED: "AUTH_REQUIRED",
+  AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
   AUTH_EXPIRED: "AUTH_EXPIRED",
   NOT_INITIALIZED: "NOT_INITIALIZED",
   NOT_FOUND: "NOT_FOUND",
@@ -6406,7 +6469,7 @@ var CreateDelegationWasmResultSchema = z4.object({
 // src/expiry.ts
 var EPHEMERAL_MS = 60 * 60 * 1e3;
 var SIGNED_READ_URL_MS = 5 * 60 * 1e3;
-var SESSION_MS = 7 * 24 * 60 * 60 * 1e3;
+var SESSION_MS = 30 * 24 * 60 * 60 * 1e3;
 var SHARE_MS = 7 * 24 * 60 * 60 * 1e3;
 var APP_MS = 30 * 24 * 60 * 60 * 1e3;
 var MAX_MS = 10 * 365 * 24 * 60 * 60 * 1e3;
@@ -8174,7 +8237,6 @@ import { ed25519 as ed255195 } from "@noble/curves/ed25519";
 import { blake3 as blake33 } from "@noble/hashes/blake3";
 import { sha256 as sha2567 } from "@noble/hashes/sha256";
 var ENVELOPE_SCHEMA = "xyz.tinycloud.share/envelope";
-var INLINE_PREFIX = "tc2:";
 var RAW_CID_CODEC = 85;
 var BLAKE3_256_CODE = 30;
 var DEFAULT_MAX_INLINE_BYTES = 256 * 1024;
@@ -8880,31 +8942,6 @@ function parsePublishedShareLink(link, options2 = {}) {
   const origin2 = normalizeOrigin(url.origin);
   if (options2.trustedOrigins !== void 0 && !options2.trustedOrigins.map(normalizeOrigin).includes(origin2)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
   if (url.username !== "" || url.password !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
-  if (url.pathname === "/viewer") {
-    const secretPayload = url.search === "" && url.hash.startsWith("#tc2=") ? url.hash.slice("#tc2=".length) : void 0;
-    const publicPayload = url.hash === "" && url.searchParams.size === 1 ? url.searchParams.get("tc2") ?? void 0 : void 0;
-    if (secretPayload === void 0 && publicPayload === void 0) throw new ShareEnvelopeError("invalid-link", "published share link is invalid");
-    if (publicPayload !== void 0 && url.search !== `?tc2=${publicPayload}`) throw new ShareEnvelopeError("invalid-link", "published share link is not canonical");
-    let payload;
-    try {
-      const bytes2 = base64UrlToBytes(secretPayload ?? publicPayload);
-      if (bytes2.length > (options2.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES) * 2) throw new Error("inline payload too large");
-      const text2 = new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
-      const value = JSON.parse(text2);
-      if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("inline payload shape");
-      if (canonicalJson(value) !== text2) throw new Error("inline payload is not canonical JSON");
-      payload = value;
-    } catch (error) {
-      throw new ShareEnvelopeError("invalid-link", error instanceof Error ? error.message : "invalid inline payload");
-    }
-    const payloadKeys = Object.keys(payload);
-    if (payload.v !== 2 || typeof payload.c !== "string" || typeof payload.cid !== "string" || payload.k !== void 0 && typeof payload.k !== "string" || payloadKeys.some((key3) => !["v", "c", "cid", "k"].includes(key3)) || publicPayload !== void 0 && (payloadKeys.length !== 3 || payload.k !== void 0)) throw new ShareEnvelopeError("invalid-link", "inline payload fields are invalid");
-    const sealed = base64UrlToBytes(payload.c);
-    if (!verifyPublishedShareCid(payload.cid, sealed)) throw new ShareEnvelopeError("cid-mismatch", "inline payload CID does not match");
-    const key2 = payload.k === void 0 ? void 0 : base64UrlToBytes(payload.k);
-    if (key2 !== void 0 && key2.length !== 32) throw new ShareEnvelopeError("invalid-link", "inline payload key is invalid");
-    return { origin: origin2, cid: payload.cid, ...key2 === void 0 ? {} : { key: key2 }, sealed };
-  }
   if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
   const match = /^\/s\/([a-z2-7]+)$/.exec(url.pathname);
   if (match === null || !url.hash.startsWith("#k=")) throw new ShareEnvelopeError("invalid-link", "published share link is invalid");
@@ -8927,10 +8964,7 @@ function parseShareUrl(link, options2 = {}) {
   }
   const origin2 = normalizeOrigin(url.origin);
   if (options2.trustedOrigins !== void 0 && !options2.trustedOrigins.map(normalizeOrigin).includes(origin2)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
-  if (url.pathname === "/viewer" && (url.hash.startsWith("#tc2=") || url.searchParams.has("tc2"))) {
-    const published = parsePublishedShareLink(link, options2);
-    return { kind: "inline", origin: origin2, cid: published.cid, key: published.key, url: `${url.origin}${url.pathname}`, protocol: "share-envelope-v2" };
-  }
+  if (url.pathname === "/viewer") throw new ShareEnvelopeError("invalid-link", "retired viewer links are not accepted");
   if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share links must not contain query parameters");
   const match = url.pathname.match(/^\/s\/(i\/)?([^/]+)$/);
   if (!match) throw new ShareEnvelopeError("invalid-link", "share link path is invalid");
@@ -8955,9 +8989,9 @@ function parseShareUrl(link, options2 = {}) {
 function isV2ShareLink(link) {
   try {
     const url = new URL(link);
-    return url.pathname.startsWith("/s/") || url.pathname === "/viewer";
+    return url.search === "" && url.pathname.startsWith("/s/");
   } catch {
-    return link.startsWith(INLINE_PREFIX);
+    return false;
   }
 }
 async function encryptShareBytes(bytes2, key) {
@@ -10457,6 +10491,13 @@ var ShareRecipientClient = class {
 };
 
 // src/delegations/SharingService.ts
+function spaceIdsEqual(left, right) {
+  const normalizeOwnerAddress = (space) => {
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
+  };
+  return normalizeOwnerAddress(left) === normalizeOwnerAddress(right);
+}
 function inferShortServiceFromActionUrns(actions) {
   let short;
   for (const action of actions) {
@@ -10692,11 +10733,11 @@ var SharingService = class {
       }
       return result;
     };
-    const canSatisfyFromRegistry = this.findSuitableKeyForDelegation(
+    const canSatisfyFromRegistry = this.classifyDelegationAuthority(
       fullPath,
       actions,
       requestedExpiry
-    );
+    ) === "ok";
     if (canSatisfyFromRegistry) {
       const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);
       const childDelegationActiveError = this.retiredGraphError();
@@ -10766,49 +10807,58 @@ var SharingService = class {
     return { ok: true, data: shareLink };
   }
   /**
-   * Check if any key in the registry can satisfy the delegation request.
-   * A key can satisfy if it has a delegation that:
-   * 1. Covers the required path (exact match or parent path)
-   * 2. Has all required actions
-   * 3. Has sufficient expiry (delegation.expiry >= requestedExpiry)
-   * 4. Allows sub-delegation
+   * Report, without side effects, whether this session's registry authority
+   * can issue the child delegation {@link generate} would create for the same
+   * `path`, `actions` and `expiry` (defaults and `pathPrefix` applied the
+   * same way):
+   *
+   * - `"ok"`: an uncaveated entry covers it.
+   * - `"caveated"`: only caveated entries cover it. SharingService cannot
+   *   carry signed ReCap caveats into a child delegation.
+   * - `"not-covered"`: no entry covers it, or there is no session.
+   *
+   * It does not consult `onRootDelegationNeeded`, so a signer-backed session
+   * may still generate when this is not `"ok"`.
+   */
+  preflightGenerate(params) {
+    if (!this.session || !params.path) return "not-covered";
+    const fullPath = this.pathPrefix ? `${this.pathPrefix}/${params.path}`.replace(/\/+/g, "/") : params.path;
+    return this.classifyDelegationAuthority(
+      fullPath,
+      params.actions ?? DEFAULT_READ_ACTIONS,
+      params.expiry ?? new Date(Date.now() + DEFAULT_EXPIRY_MS)
+    );
+  }
+  /**
+   * Classify the registry's authority for a child delegation. An entry
+   * satisfies it when it is in the session space, valid, lasts at least until
+   * `requestedExpiry`, allows sub-delegation, covers `path` (exact or parent)
+   * and grants every action. Satisfying entries with caveats are unusable.
    * @internal
    */
-  findSuitableKeyForDelegation(path, actions, requestedExpiry) {
-    const allKeys = this.registry.getAllKeys();
-    for (const key of allKeys) {
-      const delegations = this.registry.getDelegationsForKey(key.id);
-      for (const delegation of delegations) {
-        if (delegation.spaceId !== this.session?.spaceId) {
-          continue;
-        }
-        if ((delegation.caveats?.length ?? 0) > 0) {
-          continue;
-        }
-        if (!this.registry.isDelegationValid(delegation)) {
-          continue;
-        }
-        if (delegation.expiry < requestedExpiry) {
-          continue;
-        }
-        if (delegation.allowSubDelegation === false) {
+  classifyDelegationAuthority(path, actions, requestedExpiry) {
+    let coveredOnlyByCaveated = false;
+    for (const key of this.registry.getAllKeys()) {
+      for (const delegation of this.registry.getDelegationsForKey(key.id)) {
+        if (delegation.spaceId === void 0 || !spaceIdsEqual(delegation.spaceId, this.session?.spaceId ?? "")) {
           continue;
         }
-        const delegationPath = delegation.path || "";
-        if (!this.pathMatches(delegationPath, path)) {
+        if (!this.registry.isDelegationValid(delegation)) continue;
+        if (delegation.expiry < requestedExpiry) continue;
+        if (delegation.allowSubDelegation === false) continue;
+        if (!this.pathMatches(delegation.path || "", path)) continue;
+        const delegationActions = delegation.actions || [];
+        if (!actions.every((action) => delegationActions.includes(action) || delegationActions.includes("*"))) {
           continue;
         }
-        const delegationActions = delegation.actions || [];
-        const hasAllActions = actions.every(
-          (action) => delegationActions.includes(action) || delegationActions.includes("*")
-        );
-        if (!hasAllActions) {
+        if ((delegation.caveats?.length ?? 0) > 0) {
+          coveredOnlyByCaveated = true;
           continue;
         }
-        return true;
+        return "ok";
       }
     }
-    return false;
+    return coveredOnlyByCaveated ? "caveated" : "not-covered";
   }
   retiredGraphError() {
     try {
@@ -10907,11 +10957,23 @@ var SharingService = class {
           const errorText = await registerRes.text();
           const registrationTextActiveError = this.retiredGraphError();
           if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };
+          const message = `Failed to register delegation with server: ${registerRes.status} ${errorText}`;
+          if (registerRes.status === 401 || registerRes.status === 403) {
+            return {
+              ok: false,
+              error: createError2(
+                DelegationErrorCodes.AUTH_UNAUTHORIZED,
+                message,
+                void 0,
+                { status: registerRes.status }
+              )
+            };
+          }
           return {
             ok: false,
             error: createError2(
               DelegationErrorCodes.CREATION_FAILED,
-              `Failed to register delegation with server: ${registerRes.status} ${errorText}`
+              message
             )
           };
         }
@@ -17653,6 +17715,13 @@ var LocationRecordValidationError = class extends Error {
     this.name = "LocationRecordValidationError";
   }
 };
+var LocationRegistryHttpError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "LocationRegistryHttpError";
+  }
+};
 var CloudLocationResolutionError = class extends Error {
   constructor(subject, attempts) {
     super(`Unable to resolve TinyCloud location for ${subject}`);
@@ -17746,7 +17815,7 @@ async function fetchLocationRecord(registryUrl, subject, fetchFn = globalThis.fe
     return null;
   }
   if (!response.ok) {
-    throw new Error(`location registry returned HTTP ${response.status}`);
+    throw new LocationRegistryHttpError(`location registry returned HTTP ${response.status}`, response.status);
   }
   const text2 = await boundedResponseText(response, "location registry", 64 * 1024);
   let body;
@@ -17791,7 +17860,7 @@ async function publishLocationRecord(options2) {
     }
   );
   if (!response.ok) {
-    throw new Error(`location registry publish returned HTTP ${response.status}`);
+    throw new LocationRegistryHttpError(`location registry publish returned HTTP ${response.status}`, response.status);
   }
   const text2 = await boundedResponseText(response, "location registry", 64 * 1024);
   let body;
@@ -18474,6 +18543,7 @@ export {
   ED25519_JCS_SIGNATURE_SUITE,
   EIP191_JCS_SIGNATURE_SUITE,
   EMAIL_CREDENTIAL_MAX_AGE_SECONDS,
+  EMAIL_DOMAIN_CREDENTIAL_MAX_AGE_SECONDS,
   ENCRYPTION,
   ENCRYPTION_MANIFEST_SPACE,
   ENCRYPTION_NETWORK_URN_PREFIX,
@@ -18499,6 +18569,7 @@ export {
   LOCAL_LINK_PROBE_TIMEOUT_MS,
   LOCAL_LOOPBACK_PROBE_TIMEOUT_MS,
   LocationRecordValidationError,
+  LocationRegistryHttpError,
   MAX_CONTENT_BYTES,
   MAX_LEGACY_ENVELOPE_EXPIRES_AT,
   MAX_SEALED_SHARE_CONTENT_BYTES,
@@ -18618,8 +18689,10 @@ export {
   buildPolicyCredentialPresentationV4,
   buildSpaceUri,
   canonicalDigest,
+  canonicalEmailDomain,
   canonicalHashHex,
   canonicalLocationPayload,
+  canonicalMailbox,
   canonicalOwnerSharePolicy,
   canonicalSignedResponse,
   canonicalizeAddress,
@@ -18647,6 +18720,7 @@ export {
   createCapabilityKeyRegistry,
   createDelegatedShareKey,
   createEmailCredentialRequirement,
+  createEmailDomainCredentialRequirement,
   createHolderBinding,
   createInMemoryLocalNodeIdentityStore,
   createLocalStorageLocalNodeIdentityStore,
@@ -18719,6 +18793,7 @@ export {
   importPortableDelegation,
   installTinyCloudDebugGlobals,
   intersectShareCapabilities,
+  isCanonicalEmailDomain,
   isCapabilitySubset,
   isDigest,
   isEvmAddress,
@@ -18729,6 +18804,7 @@ export {
   jcsCanonicalize,
   loadManifest,
   locationPayloadForRecord,
+  mailboxBelongsToDomain,
   makePkhSpaceId,
   makePublicSpaceId,
   manifestAbilitiesUnion,
@@ -18787,6 +18863,7 @@ export {
   serviceError5 as serviceError,
   sha256Base64Url,
   shareCapabilityAllows,
+  signCompactPolicyDescendant,
   signCompactUcanAuthorization,
   signCompactUcanRootAuthorization,
   signLocationRecord,