@tinycloud/sdk-core 3.0.0-beta.9 → 3.0.1-beta.0

package/dist/{credential-admission-CFjUChF8.d.cts → credential-admission-BxpkckU0.d.cts}

@@ -718,17 +718,28 @@ interface CompactPolicyInvocationInput {
 }
 /** Sign a fresh one-parent ordinary invocation; S0 itself is never a bearer. */
 declare function createCompactPolicyInvocation(input: CompactPolicyInvocationInput): CompactUcanAuthorizationV1;
-declare function createCompactPolicyDescendant(input: {
+interface CompactPolicyDescendantInput {
     readonly parentAuthorization: string;
     readonly parentCid: string;
     readonly issuerDid: string;
     readonly audienceDid: string;
     readonly attenuation: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;
-    readonly privateKey: Uint8Array;
+    /** Start of the window; defaults to one second after the parent's start. */
     readonly now?: number;
+    /** Defaults to the longest window the parent allows: one second inside it. */
     readonly expiresAt?: number;
     readonly nonce?: string;
+}
+declare function createCompactPolicyDescendant(input: CompactPolicyDescendantInput & {
+    readonly privateKey: Uint8Array;
 }): CompactUcanAuthorizationV1;
+/**
+ * The same descendant, signed by a caller-owned key that may be
+ * non-extractable. The result is verified against the issuer DID.
+ */
+declare function signCompactPolicyDescendant(input: CompactPolicyDescendantInput & {
+    readonly sign: (bytes: Uint8Array) => Promise<Uint8Array>;
+}): Promise<CompactUcanAuthorizationV1>;
 /** Byte-independent semantic containment shared by S0, descendants and mint requests. */
 declare function compactAttenuationContains(parent: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>, child: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>): boolean;
 declare function parseCompactUcanAuthorization(input: string, expectedCid?: string): CompactUcanAuthorizationV1;
@@ -864,6 +875,8 @@ interface AdmitPolicyCredentialV3Input extends Omit<BuildPolicyCredentialPresent
     readonly accountAuthorizationCid: string;
     /** Recipient-owned `credentials` space covered by the account authorization. */
     readonly credentialSpaceId: string;
+    /** See {@link AdmitPolicyCredentialV4Input.requestedExpiresAt}. */
+    readonly requestedExpiresAt?: string | null;
     readonly fetch?: typeof fetch;
     readonly signal?: AbortSignal;
 }
@@ -885,6 +898,13 @@ interface AdmitPolicyCredentialV4Input extends Omit<BuildPolicyCredentialPresent
     readonly nodeOrigin: string;
     /** Path to the embedded Node policy runtime. Defaults to `/policy/v3`. */
     readonly policyRuntimePath?: string;
+    /**
+     * How long the minted session should last. Defaults to the policy's own
+     * expiry, the longest the Node will grant; it caps the session at the
+     * policy, its roots and any account authorization. `null` asks for the
+     * legacy 60-second session.
+     */
+    readonly requestedExpiresAt?: string | null;
     readonly fetch?: typeof fetch;
     readonly signal?: AbortSignal;
 }
@@ -898,4 +918,4 @@ interface PolicyCredentialAdmissionV4 {
 /** Accountless admission. The request deliberately has no account custody fields. */
 declare function admitPolicyCredentialV4(input: AdmitPolicyCredentialV4Input): Promise<PolicyCredentialAdmissionV4>;
 
-export { type RegisterPolicyV3Receipt as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyCredentialAdmissionV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV4 as F, type PolicyCredentialPresentationV3 as G, type PolicyCredentialPresentationV4 as H, type PolicyCredentialRequirementV1 as I, type JsonObject as J, type PolicyRootStatusV3 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootV3 as O, type PolicyEngineRecord as P, type PolicySessionUcanFactV1 as Q, type PolicySessionUcanV1 as R, type SignedObjectSigner as S, type PolicyStatus as T, type UnsignedPolicyEngineRecord as U, ROOT_REVOCATION_V1_DOMAIN as V, ROOT_REVOCATION_V1_SCHEMA as W, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as X, ROOT_STATUS_RENEWAL_V1_DOMAIN as Y, ROOT_STATUS_V1_DOMAIN as Z, type RegisterPolicyV3Input as _, type Policy as a, signCompactUcanRootAuthorization as a$, type SignCompactUcanAuthorizationInput as a0, type SignCompactUcanRootAuthorizationInput as a1, SignatureMaterialError as a2, type SignatureSuite as a3, SignatureVerificationError as a4, SignedObjectCanonicalizationError as a5, SignedObjectDigestError as a6, type SignedObjectErrorCode as a7, SignedObjectIdError as a8, type SignedObjectKind as a9, canonicalizeUnifiedPolicyCapability as aA, compactAttenuationContains as aB, contentSourceDigestHex as aC, createAndSignPolicy as aD, createAndSignPolicyEngineRecord as aE, createAndSignPolicyStatus as aF, createAndSignSignedObject as aG, createCompactPolicyDescendant as aH, createCompactPolicyInvocation as aI, deriveSignedObjectMaterial as aJ, getPolicyRootStatusV3 as aK, issuedCredentialEnvelopeFromVerified as aL, mintPolicySessionV3 as aM, normalizeUnifiedPolicyCapability as aN, parseCompactUcanAuthorization as aO, parsePolicySessionUcan as aP, policyCidFromCanonicalBytes as aQ, policyDigestHex as aR, policyIdForDigestHex as aS, policyV2DigestHex as aT, projectUnifiedPolicyCapabilities as aU, projectUnifiedPolicyCapability as aV, registerPolicyV3 as aW, renewPolicyRootStatusV3 as aX, requestPolicyChallengeV3 as aY, revokePolicyRootV3 as aZ, signCompactUcanAuthorization as a_, type SignedObjectMaterial as aa, SignedObjectProfileError as ab, SignedObjectSchemaError as ac, type SignedObjectSignature as ad, type SignedObjectVerificationResult as ae, type SignedPolicyObject as af, SigningKeyBindingError as ag, type UnifiedContentSource as ah, type UnifiedEncryptionCapability as ai, type UnifiedKvCapability as aj, type UnifiedNativeCapability as ak, type UnifiedPolicyCapability as al, type UnifiedPolicyV1 as am, type UnifiedPolicyV2 as an, type UnifiedResourceSelector as ao, type UnsignedPolicy as ap, type UnsignedPolicyCredentialPresentationV4 as aq, type UnsignedPolicyObject as ar, type UnsignedPolicyStatus as as, type UnsignedUnifiedPolicyV2 as at, UnsupportedSignatureSuiteError as au, admitPolicyCredentialV3 as av, admitPolicyCredentialV4 as aw, buildPolicyCredentialPresentationV3 as ax, buildPolicyCredentialPresentationV4 as ay, canonicalizeSignedObjectUnsigned as az, type AdmitPolicyCredentialV3Input as b, signPolicyCredentialPresentationV4 as b0, signedObjectIdFor as b1, toSignedObjectError as b2, unifiedNativeProjectionHashHex as b3, unifiedPolicyCapabilityContains as b4, unifiedPolicyCapabilityDigestHex as b5, unifiedPolicyCapabilityFromNative as b6, validatePolicyCredentialRequirementV1 as b7, validatePolicyEngineRecordSigned as b8, validatePolicyEngineRecordSignedShape as b9, type CredentialClaimDescriptor as bA, type CredentialEndpointId as bB, type CredentialInputDescriptor as bC, type CredentialProgressEvent as bD, type CredentialStepDescriptor as bE, type CredentialStepType as bF, type CredentialUxState as bG, HOLDER_BINDING_DOMAIN as bH, type IssuerVerificationKey as bI, validatePolicyEngineRecordUnsigned as ba, validatePolicySigned as bb, validatePolicySignedShape as bc, validatePolicyStatusSigned as bd, validatePolicyStatusSignedShape as be, validatePolicyStatusUnsigned as bf, validatePolicyUnsigned as bg, validateUnifiedPolicyV2 as bh, verifyPolicy as bi, verifyPolicyEngineRecord as bj, verifyPolicyRootRevocationV3 as bk, verifyPolicyRootStatusCheckpointV3 as bl, verifyPolicyStatus as bm, verifySignedObject as bn, type CredentialHolderBinding as bo, type CredentialFlowDescriptor as bp, type CredentialRequirement as bq, type StoredCredentialRecord as br, type VerifiedCredential as bs, type CredentialStorageReceipt as bt, type IssuedCredentialEnvelope as bu, type CredentialIssuerMetadata as bv, CREDENTIAL_ACQUISITION_PROTOCOL as bw, CREDENTIAL_CONTRACT_VERSION as bx, CREDENTIAL_FORMAT as by, CREDENTIAL_STEP_REGISTRY_VERSION as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyInvocationInput as f, type CompactUcanAuthorizationV1 as g, EIP191_JCS_SIGNATURE_SUITE as h, LAST_V2_READ_AT as i, POLICY_CAPABILITY_V1_DOMAIN as j, POLICY_CAPABILITY_V1_SCHEMA as k, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as l, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as m, POLICY_ENGINE_RECORD_SCHEMA as n, POLICY_PRESENTATION_V3_DOMAIN as o, POLICY_PRESENTATION_V3_SCHEMA as p, POLICY_PRESENTATION_V4_DOMAIN as q, POLICY_PRESENTATION_V4_SCHEMA as r, POLICY_SCHEMA as s, POLICY_SESSION_UCAN_V1_PROFILE as t, POLICY_STATUS_SCHEMA as u, POLICY_V1_DOMAIN as v, POLICY_V1_SCHEMA as w, POLICY_V2_DOMAIN as x, POLICY_V2_SCHEMA as y, type PolicyChallengeV3 as z };
+export { type RegisterPolicyV3Input as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyChallengeV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV3 as F, type PolicyCredentialAdmissionV4 as G, type PolicyCredentialPresentationV3 as H, type PolicyCredentialPresentationV4 as I, type JsonObject as J, type PolicyCredentialRequirementV1 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootStatusV3 as O, type PolicyEngineRecord as P, type PolicyRootV3 as Q, type PolicySessionUcanFactV1 as R, type SignedObjectSigner as S, type PolicySessionUcanV1 as T, type UnsignedPolicyEngineRecord as U, type PolicyStatus as V, ROOT_REVOCATION_V1_DOMAIN as W, ROOT_REVOCATION_V1_SCHEMA as X, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as Y, ROOT_STATUS_RENEWAL_V1_DOMAIN as Z, ROOT_STATUS_V1_DOMAIN as _, type Policy as a, signCompactPolicyDescendant as a$, type RegisterPolicyV3Receipt as a0, type SignCompactUcanAuthorizationInput as a1, type SignCompactUcanRootAuthorizationInput as a2, SignatureMaterialError as a3, type SignatureSuite as a4, SignatureVerificationError as a5, SignedObjectCanonicalizationError as a6, SignedObjectDigestError as a7, type SignedObjectErrorCode as a8, SignedObjectIdError as a9, canonicalizeSignedObjectUnsigned as aA, canonicalizeUnifiedPolicyCapability as aB, compactAttenuationContains as aC, contentSourceDigestHex as aD, createAndSignPolicy as aE, createAndSignPolicyEngineRecord as aF, createAndSignPolicyStatus as aG, createAndSignSignedObject as aH, createCompactPolicyDescendant as aI, createCompactPolicyInvocation as aJ, deriveSignedObjectMaterial as aK, getPolicyRootStatusV3 as aL, issuedCredentialEnvelopeFromVerified as aM, mintPolicySessionV3 as aN, normalizeUnifiedPolicyCapability as aO, parseCompactUcanAuthorization as aP, parsePolicySessionUcan as aQ, policyCidFromCanonicalBytes as aR, policyDigestHex as aS, policyIdForDigestHex as aT, policyV2DigestHex as aU, projectUnifiedPolicyCapabilities as aV, projectUnifiedPolicyCapability as aW, registerPolicyV3 as aX, renewPolicyRootStatusV3 as aY, requestPolicyChallengeV3 as aZ, revokePolicyRootV3 as a_, type SignedObjectKind as aa, type SignedObjectMaterial as ab, SignedObjectProfileError as ac, SignedObjectSchemaError as ad, type SignedObjectSignature as ae, type SignedObjectVerificationResult as af, type SignedPolicyObject as ag, SigningKeyBindingError as ah, type UnifiedContentSource as ai, type UnifiedEncryptionCapability as aj, type UnifiedKvCapability as ak, type UnifiedNativeCapability as al, type UnifiedPolicyCapability as am, type UnifiedPolicyV1 as an, type UnifiedPolicyV2 as ao, type UnifiedResourceSelector as ap, type UnsignedPolicy as aq, type UnsignedPolicyCredentialPresentationV4 as ar, type UnsignedPolicyObject as as, type UnsignedPolicyStatus as at, type UnsignedUnifiedPolicyV2 as au, UnsupportedSignatureSuiteError as av, admitPolicyCredentialV3 as aw, admitPolicyCredentialV4 as ax, buildPolicyCredentialPresentationV3 as ay, buildPolicyCredentialPresentationV4 as az, type AdmitPolicyCredentialV3Input as b, signCompactUcanAuthorization as b0, signCompactUcanRootAuthorization as b1, signPolicyCredentialPresentationV4 as b2, signedObjectIdFor as b3, toSignedObjectError as b4, unifiedNativeProjectionHashHex as b5, unifiedPolicyCapabilityContains as b6, unifiedPolicyCapabilityDigestHex as b7, unifiedPolicyCapabilityFromNative as b8, validatePolicyCredentialRequirementV1 as b9, CREDENTIAL_FORMAT as bA, CREDENTIAL_STEP_REGISTRY_VERSION as bB, type CredentialClaimDescriptor as bC, type CredentialEndpointId as bD, type CredentialInputDescriptor as bE, type CredentialProgressEvent as bF, type CredentialStepDescriptor as bG, type CredentialStepType as bH, type CredentialUxState as bI, HOLDER_BINDING_DOMAIN as bJ, type IssuerVerificationKey as bK, validatePolicyEngineRecordSigned as ba, validatePolicyEngineRecordSignedShape as bb, validatePolicyEngineRecordUnsigned as bc, validatePolicySigned as bd, validatePolicySignedShape as be, validatePolicyStatusSigned as bf, validatePolicyStatusSignedShape as bg, validatePolicyStatusUnsigned as bh, validatePolicyUnsigned as bi, validateUnifiedPolicyV2 as bj, verifyPolicy as bk, verifyPolicyEngineRecord as bl, verifyPolicyRootRevocationV3 as bm, verifyPolicyRootStatusCheckpointV3 as bn, verifyPolicyStatus as bo, verifySignedObject as bp, type CredentialHolderBinding as bq, type CredentialFlowDescriptor as br, type CredentialRequirement as bs, type StoredCredentialRecord as bt, type VerifiedCredential as bu, type CredentialStorageReceipt as bv, type IssuedCredentialEnvelope as bw, type CredentialIssuerMetadata as bx, CREDENTIAL_ACQUISITION_PROTOCOL as by, CREDENTIAL_CONTRACT_VERSION as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyDescendantInput as f, type CompactPolicyInvocationInput as g, type CompactUcanAuthorizationV1 as h, EIP191_JCS_SIGNATURE_SUITE as i, LAST_V2_READ_AT as j, POLICY_CAPABILITY_V1_DOMAIN as k, POLICY_CAPABILITY_V1_SCHEMA as l, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as m, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as n, POLICY_ENGINE_RECORD_SCHEMA as o, POLICY_PRESENTATION_V3_DOMAIN as p, POLICY_PRESENTATION_V3_SCHEMA as q, POLICY_PRESENTATION_V4_DOMAIN as r, POLICY_PRESENTATION_V4_SCHEMA as s, POLICY_SCHEMA as t, POLICY_SESSION_UCAN_V1_PROFILE as u, POLICY_STATUS_SCHEMA as v, POLICY_V1_DOMAIN as w, POLICY_V1_SCHEMA as x, POLICY_V2_DOMAIN as y, POLICY_V2_SCHEMA as z };

package/dist/{credential-admission-DIEPgQ0o.d.ts → credential-admission-CO9WMtGs.d.ts}

@@ -718,17 +718,28 @@ interface CompactPolicyInvocationInput {
 }
 /** Sign a fresh one-parent ordinary invocation; S0 itself is never a bearer. */
 declare function createCompactPolicyInvocation(input: CompactPolicyInvocationInput): CompactUcanAuthorizationV1;
-declare function createCompactPolicyDescendant(input: {
+interface CompactPolicyDescendantInput {
     readonly parentAuthorization: string;
     readonly parentCid: string;
     readonly issuerDid: string;
     readonly audienceDid: string;
     readonly attenuation: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;
-    readonly privateKey: Uint8Array;
+    /** Start of the window; defaults to one second after the parent's start. */
     readonly now?: number;
+    /** Defaults to the longest window the parent allows: one second inside it. */
     readonly expiresAt?: number;
     readonly nonce?: string;
+}
+declare function createCompactPolicyDescendant(input: CompactPolicyDescendantInput & {
+    readonly privateKey: Uint8Array;
 }): CompactUcanAuthorizationV1;
+/**
+ * The same descendant, signed by a caller-owned key that may be
+ * non-extractable. The result is verified against the issuer DID.
+ */
+declare function signCompactPolicyDescendant(input: CompactPolicyDescendantInput & {
+    readonly sign: (bytes: Uint8Array) => Promise<Uint8Array>;
+}): Promise<CompactUcanAuthorizationV1>;
 /** Byte-independent semantic containment shared by S0, descendants and mint requests. */
 declare function compactAttenuationContains(parent: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>, child: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>): boolean;
 declare function parseCompactUcanAuthorization(input: string, expectedCid?: string): CompactUcanAuthorizationV1;
@@ -864,6 +875,8 @@ interface AdmitPolicyCredentialV3Input extends Omit<BuildPolicyCredentialPresent
     readonly accountAuthorizationCid: string;
     /** Recipient-owned `credentials` space covered by the account authorization. */
     readonly credentialSpaceId: string;
+    /** See {@link AdmitPolicyCredentialV4Input.requestedExpiresAt}. */
+    readonly requestedExpiresAt?: string | null;
     readonly fetch?: typeof fetch;
     readonly signal?: AbortSignal;
 }
@@ -885,6 +898,13 @@ interface AdmitPolicyCredentialV4Input extends Omit<BuildPolicyCredentialPresent
     readonly nodeOrigin: string;
     /** Path to the embedded Node policy runtime. Defaults to `/policy/v3`. */
     readonly policyRuntimePath?: string;
+    /**
+     * How long the minted session should last. Defaults to the policy's own
+     * expiry, the longest the Node will grant; it caps the session at the
+     * policy, its roots and any account authorization. `null` asks for the
+     * legacy 60-second session.
+     */
+    readonly requestedExpiresAt?: string | null;
     readonly fetch?: typeof fetch;
     readonly signal?: AbortSignal;
 }
@@ -898,4 +918,4 @@ interface PolicyCredentialAdmissionV4 {
 /** Accountless admission. The request deliberately has no account custody fields. */
 declare function admitPolicyCredentialV4(input: AdmitPolicyCredentialV4Input): Promise<PolicyCredentialAdmissionV4>;
 
-export { type RegisterPolicyV3Receipt as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyCredentialAdmissionV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV4 as F, type PolicyCredentialPresentationV3 as G, type PolicyCredentialPresentationV4 as H, type PolicyCredentialRequirementV1 as I, type JsonObject as J, type PolicyRootStatusV3 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootV3 as O, type PolicyEngineRecord as P, type PolicySessionUcanFactV1 as Q, type PolicySessionUcanV1 as R, type SignedObjectSigner as S, type PolicyStatus as T, type UnsignedPolicyEngineRecord as U, ROOT_REVOCATION_V1_DOMAIN as V, ROOT_REVOCATION_V1_SCHEMA as W, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as X, ROOT_STATUS_RENEWAL_V1_DOMAIN as Y, ROOT_STATUS_V1_DOMAIN as Z, type RegisterPolicyV3Input as _, type Policy as a, signCompactUcanRootAuthorization as a$, type SignCompactUcanAuthorizationInput as a0, type SignCompactUcanRootAuthorizationInput as a1, SignatureMaterialError as a2, type SignatureSuite as a3, SignatureVerificationError as a4, SignedObjectCanonicalizationError as a5, SignedObjectDigestError as a6, type SignedObjectErrorCode as a7, SignedObjectIdError as a8, type SignedObjectKind as a9, canonicalizeUnifiedPolicyCapability as aA, compactAttenuationContains as aB, contentSourceDigestHex as aC, createAndSignPolicy as aD, createAndSignPolicyEngineRecord as aE, createAndSignPolicyStatus as aF, createAndSignSignedObject as aG, createCompactPolicyDescendant as aH, createCompactPolicyInvocation as aI, deriveSignedObjectMaterial as aJ, getPolicyRootStatusV3 as aK, issuedCredentialEnvelopeFromVerified as aL, mintPolicySessionV3 as aM, normalizeUnifiedPolicyCapability as aN, parseCompactUcanAuthorization as aO, parsePolicySessionUcan as aP, policyCidFromCanonicalBytes as aQ, policyDigestHex as aR, policyIdForDigestHex as aS, policyV2DigestHex as aT, projectUnifiedPolicyCapabilities as aU, projectUnifiedPolicyCapability as aV, registerPolicyV3 as aW, renewPolicyRootStatusV3 as aX, requestPolicyChallengeV3 as aY, revokePolicyRootV3 as aZ, signCompactUcanAuthorization as a_, type SignedObjectMaterial as aa, SignedObjectProfileError as ab, SignedObjectSchemaError as ac, type SignedObjectSignature as ad, type SignedObjectVerificationResult as ae, type SignedPolicyObject as af, SigningKeyBindingError as ag, type UnifiedContentSource as ah, type UnifiedEncryptionCapability as ai, type UnifiedKvCapability as aj, type UnifiedNativeCapability as ak, type UnifiedPolicyCapability as al, type UnifiedPolicyV1 as am, type UnifiedPolicyV2 as an, type UnifiedResourceSelector as ao, type UnsignedPolicy as ap, type UnsignedPolicyCredentialPresentationV4 as aq, type UnsignedPolicyObject as ar, type UnsignedPolicyStatus as as, type UnsignedUnifiedPolicyV2 as at, UnsupportedSignatureSuiteError as au, admitPolicyCredentialV3 as av, admitPolicyCredentialV4 as aw, buildPolicyCredentialPresentationV3 as ax, buildPolicyCredentialPresentationV4 as ay, canonicalizeSignedObjectUnsigned as az, type AdmitPolicyCredentialV3Input as b, signPolicyCredentialPresentationV4 as b0, signedObjectIdFor as b1, toSignedObjectError as b2, unifiedNativeProjectionHashHex as b3, unifiedPolicyCapabilityContains as b4, unifiedPolicyCapabilityDigestHex as b5, unifiedPolicyCapabilityFromNative as b6, validatePolicyCredentialRequirementV1 as b7, validatePolicyEngineRecordSigned as b8, validatePolicyEngineRecordSignedShape as b9, type CredentialClaimDescriptor as bA, type CredentialEndpointId as bB, type CredentialInputDescriptor as bC, type CredentialProgressEvent as bD, type CredentialStepDescriptor as bE, type CredentialStepType as bF, type CredentialUxState as bG, HOLDER_BINDING_DOMAIN as bH, type IssuerVerificationKey as bI, validatePolicyEngineRecordUnsigned as ba, validatePolicySigned as bb, validatePolicySignedShape as bc, validatePolicyStatusSigned as bd, validatePolicyStatusSignedShape as be, validatePolicyStatusUnsigned as bf, validatePolicyUnsigned as bg, validateUnifiedPolicyV2 as bh, verifyPolicy as bi, verifyPolicyEngineRecord as bj, verifyPolicyRootRevocationV3 as bk, verifyPolicyRootStatusCheckpointV3 as bl, verifyPolicyStatus as bm, verifySignedObject as bn, type CredentialHolderBinding as bo, type CredentialFlowDescriptor as bp, type CredentialRequirement as bq, type StoredCredentialRecord as br, type VerifiedCredential as bs, type CredentialStorageReceipt as bt, type IssuedCredentialEnvelope as bu, type CredentialIssuerMetadata as bv, CREDENTIAL_ACQUISITION_PROTOCOL as bw, CREDENTIAL_CONTRACT_VERSION as bx, CREDENTIAL_FORMAT as by, CREDENTIAL_STEP_REGISTRY_VERSION as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyInvocationInput as f, type CompactUcanAuthorizationV1 as g, EIP191_JCS_SIGNATURE_SUITE as h, LAST_V2_READ_AT as i, POLICY_CAPABILITY_V1_DOMAIN as j, POLICY_CAPABILITY_V1_SCHEMA as k, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as l, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as m, POLICY_ENGINE_RECORD_SCHEMA as n, POLICY_PRESENTATION_V3_DOMAIN as o, POLICY_PRESENTATION_V3_SCHEMA as p, POLICY_PRESENTATION_V4_DOMAIN as q, POLICY_PRESENTATION_V4_SCHEMA as r, POLICY_SCHEMA as s, POLICY_SESSION_UCAN_V1_PROFILE as t, POLICY_STATUS_SCHEMA as u, POLICY_V1_DOMAIN as v, POLICY_V1_SCHEMA as w, POLICY_V2_DOMAIN as x, POLICY_V2_SCHEMA as y, type PolicyChallengeV3 as z };
+export { type RegisterPolicyV3Input as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyChallengeV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV3 as F, type PolicyCredentialAdmissionV4 as G, type PolicyCredentialPresentationV3 as H, type PolicyCredentialPresentationV4 as I, type JsonObject as J, type PolicyCredentialRequirementV1 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootStatusV3 as O, type PolicyEngineRecord as P, type PolicyRootV3 as Q, type PolicySessionUcanFactV1 as R, type SignedObjectSigner as S, type PolicySessionUcanV1 as T, type UnsignedPolicyEngineRecord as U, type PolicyStatus as V, ROOT_REVOCATION_V1_DOMAIN as W, ROOT_REVOCATION_V1_SCHEMA as X, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as Y, ROOT_STATUS_RENEWAL_V1_DOMAIN as Z, ROOT_STATUS_V1_DOMAIN as _, type Policy as a, signCompactPolicyDescendant as a$, type RegisterPolicyV3Receipt as a0, type SignCompactUcanAuthorizationInput as a1, type SignCompactUcanRootAuthorizationInput as a2, SignatureMaterialError as a3, type SignatureSuite as a4, SignatureVerificationError as a5, SignedObjectCanonicalizationError as a6, SignedObjectDigestError as a7, type SignedObjectErrorCode as a8, SignedObjectIdError as a9, canonicalizeSignedObjectUnsigned as aA, canonicalizeUnifiedPolicyCapability as aB, compactAttenuationContains as aC, contentSourceDigestHex as aD, createAndSignPolicy as aE, createAndSignPolicyEngineRecord as aF, createAndSignPolicyStatus as aG, createAndSignSignedObject as aH, createCompactPolicyDescendant as aI, createCompactPolicyInvocation as aJ, deriveSignedObjectMaterial as aK, getPolicyRootStatusV3 as aL, issuedCredentialEnvelopeFromVerified as aM, mintPolicySessionV3 as aN, normalizeUnifiedPolicyCapability as aO, parseCompactUcanAuthorization as aP, parsePolicySessionUcan as aQ, policyCidFromCanonicalBytes as aR, policyDigestHex as aS, policyIdForDigestHex as aT, policyV2DigestHex as aU, projectUnifiedPolicyCapabilities as aV, projectUnifiedPolicyCapability as aW, registerPolicyV3 as aX, renewPolicyRootStatusV3 as aY, requestPolicyChallengeV3 as aZ, revokePolicyRootV3 as a_, type SignedObjectKind as aa, type SignedObjectMaterial as ab, SignedObjectProfileError as ac, SignedObjectSchemaError as ad, type SignedObjectSignature as ae, type SignedObjectVerificationResult as af, type SignedPolicyObject as ag, SigningKeyBindingError as ah, type UnifiedContentSource as ai, type UnifiedEncryptionCapability as aj, type UnifiedKvCapability as ak, type UnifiedNativeCapability as al, type UnifiedPolicyCapability as am, type UnifiedPolicyV1 as an, type UnifiedPolicyV2 as ao, type UnifiedResourceSelector as ap, type UnsignedPolicy as aq, type UnsignedPolicyCredentialPresentationV4 as ar, type UnsignedPolicyObject as as, type UnsignedPolicyStatus as at, type UnsignedUnifiedPolicyV2 as au, UnsupportedSignatureSuiteError as av, admitPolicyCredentialV3 as aw, admitPolicyCredentialV4 as ax, buildPolicyCredentialPresentationV3 as ay, buildPolicyCredentialPresentationV4 as az, type AdmitPolicyCredentialV3Input as b, signCompactUcanAuthorization as b0, signCompactUcanRootAuthorization as b1, signPolicyCredentialPresentationV4 as b2, signedObjectIdFor as b3, toSignedObjectError as b4, unifiedNativeProjectionHashHex as b5, unifiedPolicyCapabilityContains as b6, unifiedPolicyCapabilityDigestHex as b7, unifiedPolicyCapabilityFromNative as b8, validatePolicyCredentialRequirementV1 as b9, CREDENTIAL_FORMAT as bA, CREDENTIAL_STEP_REGISTRY_VERSION as bB, type CredentialClaimDescriptor as bC, type CredentialEndpointId as bD, type CredentialInputDescriptor as bE, type CredentialProgressEvent as bF, type CredentialStepDescriptor as bG, type CredentialStepType as bH, type CredentialUxState as bI, HOLDER_BINDING_DOMAIN as bJ, type IssuerVerificationKey as bK, validatePolicyEngineRecordSigned as ba, validatePolicyEngineRecordSignedShape as bb, validatePolicyEngineRecordUnsigned as bc, validatePolicySigned as bd, validatePolicySignedShape as be, validatePolicyStatusSigned as bf, validatePolicyStatusSignedShape as bg, validatePolicyStatusUnsigned as bh, validatePolicyUnsigned as bi, validateUnifiedPolicyV2 as bj, verifyPolicy as bk, verifyPolicyEngineRecord as bl, verifyPolicyRootRevocationV3 as bm, verifyPolicyRootStatusCheckpointV3 as bn, verifyPolicyStatus as bo, verifySignedObject as bp, type CredentialHolderBinding as bq, type CredentialFlowDescriptor as br, type CredentialRequirement as bs, type StoredCredentialRecord as bt, type VerifiedCredential as bu, type CredentialStorageReceipt as bv, type IssuedCredentialEnvelope as bw, type CredentialIssuerMetadata as bx, CREDENTIAL_ACQUISITION_PROTOCOL as by, CREDENTIAL_CONTRACT_VERSION as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyDescendantInput as f, type CompactPolicyInvocationInput as g, type CompactUcanAuthorizationV1 as h, EIP191_JCS_SIGNATURE_SUITE as i, LAST_V2_READ_AT as j, POLICY_CAPABILITY_V1_DOMAIN as k, POLICY_CAPABILITY_V1_SCHEMA as l, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as m, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as n, POLICY_ENGINE_RECORD_SCHEMA as o, POLICY_PRESENTATION_V3_DOMAIN as p, POLICY_PRESENTATION_V3_SCHEMA as q, POLICY_PRESENTATION_V4_DOMAIN as r, POLICY_PRESENTATION_V4_SCHEMA as s, POLICY_SCHEMA as t, POLICY_SESSION_UCAN_V1_PROFILE as u, POLICY_STATUS_SCHEMA as v, POLICY_V1_DOMAIN as w, POLICY_V1_SCHEMA as x, POLICY_V2_DOMAIN as y, POLICY_V2_SCHEMA as z };

package/dist/delegations/index.cjs

@@ -170,6 +170,7 @@ var DelegationErrorSchema = import_zod.z.object({
 });
 var DelegationErrorCodes = {
   AUTH_REQUIRED: "AUTH_REQUIRED",
+  AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
   AUTH_EXPIRED: "AUTH_EXPIRED",
   NOT_INITIALIZED: "NOT_INITIALIZED",
   NOT_FOUND: "NOT_FOUND",
@@ -534,7 +535,7 @@ var CreateDelegationWasmResultSchema = import_zod.z.object({
 // src/expiry.ts
 var EPHEMERAL_MS = 60 * 60 * 1e3;
 var SIGNED_READ_URL_MS = 5 * 60 * 1e3;
-var SESSION_MS = 7 * 24 * 60 * 60 * 1e3;
+var SESSION_MS = 30 * 24 * 60 * 60 * 1e3;
 var SHARE_MS = 7 * 24 * 60 * 60 * 1e3;
 var APP_MS = 30 * 24 * 60 * 60 * 1e3;
 var MAX_MS = 10 * 365 * 24 * 60 * 60 * 1e3;
@@ -2689,7 +2690,6 @@ var import_ed25519 = require("@noble/curves/ed25519");
 var import_blake3 = require("@noble/hashes/blake3");
 var import_sha256 = require("@noble/hashes/sha256");
 var ENVELOPE_SCHEMA = "xyz.tinycloud.share/envelope";
-var INLINE_PREFIX = "tc2:";
 var RAW_CID_CODEC = 85;
 var BLAKE3_256_CODE = 30;
 var DEFAULT_MAX_INLINE_BYTES = 256 * 1024;
@@ -3395,31 +3395,6 @@ function parsePublishedShareLink(link, options = {}) {
   const origin = normalizeOrigin(url.origin);
   if (options.trustedOrigins !== void 0 && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
   if (url.username !== "" || url.password !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
-  if (url.pathname === "/viewer") {
-    const secretPayload = url.search === "" && url.hash.startsWith("#tc2=") ? url.hash.slice("#tc2=".length) : void 0;
-    const publicPayload = url.hash === "" && url.searchParams.size === 1 ? url.searchParams.get("tc2") ?? void 0 : void 0;
-    if (secretPayload === void 0 && publicPayload === void 0) throw new ShareEnvelopeError("invalid-link", "published share link is invalid");
-    if (publicPayload !== void 0 && url.search !== `?tc2=${publicPayload}`) throw new ShareEnvelopeError("invalid-link", "published share link is not canonical");
-    let payload;
-    try {
-      const bytes2 = base64UrlToBytes(secretPayload ?? publicPayload);
-      if (bytes2.length > (options.maxInlineBytes ?? DEFAULT_MAX_INLINE_BYTES) * 2) throw new Error("inline payload too large");
-      const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
-      const value = JSON.parse(text);
-      if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("inline payload shape");
-      if (canonicalJson(value) !== text) throw new Error("inline payload is not canonical JSON");
-      payload = value;
-    } catch (error) {
-      throw new ShareEnvelopeError("invalid-link", error instanceof Error ? error.message : "invalid inline payload");
-    }
-    const payloadKeys = Object.keys(payload);
-    if (payload.v !== 2 || typeof payload.c !== "string" || typeof payload.cid !== "string" || payload.k !== void 0 && typeof payload.k !== "string" || payloadKeys.some((key3) => !["v", "c", "cid", "k"].includes(key3)) || publicPayload !== void 0 && (payloadKeys.length !== 3 || payload.k !== void 0)) throw new ShareEnvelopeError("invalid-link", "inline payload fields are invalid");
-    const sealed = base64UrlToBytes(payload.c);
-    if (!verifyPublishedShareCid(payload.cid, sealed)) throw new ShareEnvelopeError("cid-mismatch", "inline payload CID does not match");
-    const key2 = payload.k === void 0 ? void 0 : base64UrlToBytes(payload.k);
-    if (key2 !== void 0 && key2.length !== 32) throw new ShareEnvelopeError("invalid-link", "inline payload key is invalid");
-    return { origin, cid: payload.cid, ...key2 === void 0 ? {} : { key: key2 }, sealed };
-  }
   if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share link is not canonical");
   const match = /^\/s\/([a-z2-7]+)$/.exec(url.pathname);
   if (match === null || !url.hash.startsWith("#k=")) throw new ShareEnvelopeError("invalid-link", "published share link is invalid");
@@ -3442,10 +3417,7 @@ function parseShareUrl(link, options = {}) {
   }
   const origin = normalizeOrigin(url.origin);
   if (options.trustedOrigins !== void 0 && !options.trustedOrigins.map(normalizeOrigin).includes(origin)) throw new ShareEnvelopeError("origin-mismatch", "share link origin is not trusted");
-  if (url.pathname === "/viewer" && (url.hash.startsWith("#tc2=") || url.searchParams.has("tc2"))) {
-    const published = parsePublishedShareLink(link, options);
-    return { kind: "inline", origin, cid: published.cid, key: published.key, url: `${url.origin}${url.pathname}`, protocol: "share-envelope-v2" };
-  }
+  if (url.pathname === "/viewer") throw new ShareEnvelopeError("invalid-link", "retired viewer links are not accepted");
   if (url.search !== "") throw new ShareEnvelopeError("invalid-link", "share links must not contain query parameters");
   const match = url.pathname.match(/^\/s\/(i\/)?([^/]+)$/);
   if (!match) throw new ShareEnvelopeError("invalid-link", "share link path is invalid");
@@ -3470,9 +3442,9 @@ function parseShareUrl(link, options = {}) {
 function isV2ShareLink(link) {
   try {
     const url = new URL(link);
-    return url.pathname.startsWith("/s/") || url.pathname === "/viewer";
+    return url.search === "" && url.pathname.startsWith("/s/");
   } catch {
-    return link.startsWith(INLINE_PREFIX);
+    return false;
   }
 }
 async function encryptShareBytes(bytes2, key) {
@@ -4033,6 +4005,7 @@ var CompactPayloadSchema = import_zod4.z.object({
   nnc: import_zod4.z.string().min(1),
   prf: import_zod4.z.array(import_zod4.z.string().min(1))
 }).strict();
+var MAX_POLICY_ROOT_SECONDS = 31 * 24 * 60 * 60;
 function createCompactPolicyInvocation(input) {
   const session = parsePolicySessionUcan(input.sessionAuthorization);
   if (session.cid !== input.sessionCid || session.aud !== input.recipientDid)
@@ -4064,7 +4037,7 @@ function createCompactPolicyInvocation(input) {
   const signature = import_ed255192.ed25519.sign(signingInput, input.privateKey);
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
 }
-function createCompactPolicyDescendant(input) {
+function compactPolicyDescendantClaims(input) {
   const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);
   if (parent.payload.aud !== input.issuerDid) throw new Error("policy descendant issuer is not the parent audience");
   const parentFact = parent.payload.fct[0];
@@ -4072,23 +4045,33 @@ function createCompactPolicyDescendant(input) {
   if (!Number.isInteger(depth) || depth <= 0) throw new Error("policy descendant depth is exhausted");
   if (!compactAttenuationContains(parent.payload.att, input.attenuation))
     throw new Error("policy descendant exceeds the parent attenuation");
+  const now = Math.max(input.now ?? parent.payload.nbf + 1, parent.payload.nbf + 1);
+  const exp = Math.min(input.expiresAt ?? parent.payload.exp - 1, parent.payload.exp - 1);
+  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
+  return {
+    parentCid: parent.cid,
+    fact: { ...parentFact, remainingRedelegationDepth: depth - 1 },
+    notBefore: now,
+    expiresAt: exp,
+    nonce: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16)))
+  };
+}
+function createCompactPolicyDescendant(input) {
+  const claims = compactPolicyDescendantClaims(input);
   const principal = input.issuerDid.split("#", 1)[0];
   const didMaterial = base58btc.decode(principal.slice("did:key:".length));
   const publicKey = import_ed255192.ed25519.getPublicKey(input.privateKey);
   if (didMaterial.length !== 34 || !equalBytes2(publicKey, didMaterial.slice(2))) throw new Error("policy descendant signer does not bind issuer DID");
-  const now = Math.max(input.now ?? Math.floor(Date.now() / 1e3), parent.payload.nbf + 1);
-  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);
-  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
   const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
   const payload = {
     att: input.attenuation,
     aud: input.audienceDid,
-    exp,
-    fct: [{ ...parentFact, remainingRedelegationDepth: depth - 1 }],
+    exp: claims.expiresAt,
+    fct: [claims.fact],
     iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
-    nbf: now,
-    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
-    prf: [parent.cid]
+    nbf: claims.notBefore,
+    nnc: claims.nonce,
+    prf: [claims.parentCid]
   };
   const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
   const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
@@ -4164,7 +4147,7 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
     throw new Error("policy session UCAN fact is incomplete");
   if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
     throw new Error("policy session UCAN v4 audit facts are invalid");
-  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > MAX_POLICY_ROOT_SECONDS || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
     throw new Error("policy session UCAN fact is invalid");
   return {
     authorization,
@@ -5385,6 +5368,13 @@ var ShareRecipientClient = class {
 };
 
 // src/delegations/SharingService.ts
+function spaceIdsEqual(left, right) {
+  const normalizeOwnerAddress = (space) => {
+    const match = /^(tinycloud:pkh:eip155:\d+:)(0x[0-9a-fA-F]{40})(:.+)$/.exec(space);
+    return match === null ? space : `${match[1]}${match[2].toLowerCase()}${match[3]}`;
+  };
+  return normalizeOwnerAddress(left) === normalizeOwnerAddress(right);
+}
 function inferShortServiceFromActionUrns(actions) {
   let short;
   for (const action of actions) {
@@ -5620,11 +5610,11 @@ var SharingService = class {
       }
       return result;
     };
-    const canSatisfyFromRegistry = this.findSuitableKeyForDelegation(
+    const canSatisfyFromRegistry = this.classifyDelegationAuthority(
       fullPath,
       actions,
       requestedExpiry
-    );
+    ) === "ok";
     if (canSatisfyFromRegistry) {
       const delegationResult = await this.createSessionDelegation(plainDID, fullPath, actions, expiry);
       const childDelegationActiveError = this.retiredGraphError();
@@ -5694,49 +5684,58 @@ var SharingService = class {
     return { ok: true, data: shareLink };
   }
   /**
-   * Check if any key in the registry can satisfy the delegation request.
-   * A key can satisfy if it has a delegation that:
-   * 1. Covers the required path (exact match or parent path)
-   * 2. Has all required actions
-   * 3. Has sufficient expiry (delegation.expiry >= requestedExpiry)
-   * 4. Allows sub-delegation
+   * Report, without side effects, whether this session's registry authority
+   * can issue the child delegation {@link generate} would create for the same
+   * `path`, `actions` and `expiry` (defaults and `pathPrefix` applied the
+   * same way):
+   *
+   * - `"ok"`: an uncaveated entry covers it.
+   * - `"caveated"`: only caveated entries cover it. SharingService cannot
+   *   carry signed ReCap caveats into a child delegation.
+   * - `"not-covered"`: no entry covers it, or there is no session.
+   *
+   * It does not consult `onRootDelegationNeeded`, so a signer-backed session
+   * may still generate when this is not `"ok"`.
+   */
+  preflightGenerate(params) {
+    if (!this.session || !params.path) return "not-covered";
+    const fullPath = this.pathPrefix ? `${this.pathPrefix}/${params.path}`.replace(/\/+/g, "/") : params.path;
+    return this.classifyDelegationAuthority(
+      fullPath,
+      params.actions ?? DEFAULT_READ_ACTIONS,
+      params.expiry ?? new Date(Date.now() + DEFAULT_EXPIRY_MS)
+    );
+  }
+  /**
+   * Classify the registry's authority for a child delegation. An entry
+   * satisfies it when it is in the session space, valid, lasts at least until
+   * `requestedExpiry`, allows sub-delegation, covers `path` (exact or parent)
+   * and grants every action. Satisfying entries with caveats are unusable.
    * @internal
    */
-  findSuitableKeyForDelegation(path, actions, requestedExpiry) {
-    const allKeys = this.registry.getAllKeys();
-    for (const key of allKeys) {
-      const delegations = this.registry.getDelegationsForKey(key.id);
-      for (const delegation of delegations) {
-        if (delegation.spaceId !== this.session?.spaceId) {
-          continue;
-        }
-        if ((delegation.caveats?.length ?? 0) > 0) {
-          continue;
-        }
-        if (!this.registry.isDelegationValid(delegation)) {
+  classifyDelegationAuthority(path, actions, requestedExpiry) {
+    let coveredOnlyByCaveated = false;
+    for (const key of this.registry.getAllKeys()) {
+      for (const delegation of this.registry.getDelegationsForKey(key.id)) {
+        if (delegation.spaceId === void 0 || !spaceIdsEqual(delegation.spaceId, this.session?.spaceId ?? "")) {
           continue;
         }
-        if (delegation.expiry < requestedExpiry) {
-          continue;
-        }
-        if (delegation.allowSubDelegation === false) {
-          continue;
-        }
-        const delegationPath = delegation.path || "";
-        if (!this.pathMatches(delegationPath, path)) {
+        if (!this.registry.isDelegationValid(delegation)) continue;
+        if (delegation.expiry < requestedExpiry) continue;
+        if (delegation.allowSubDelegation === false) continue;
+        if (!this.pathMatches(delegation.path || "", path)) continue;
+        const delegationActions = delegation.actions || [];
+        if (!actions.every((action) => delegationActions.includes(action) || delegationActions.includes("*"))) {
           continue;
         }
-        const delegationActions = delegation.actions || [];
-        const hasAllActions = actions.every(
-          (action) => delegationActions.includes(action) || delegationActions.includes("*")
-        );
-        if (!hasAllActions) {
+        if ((delegation.caveats?.length ?? 0) > 0) {
+          coveredOnlyByCaveated = true;
           continue;
         }
-        return true;
+        return "ok";
       }
     }
-    return false;
+    return coveredOnlyByCaveated ? "caveated" : "not-covered";
   }
   retiredGraphError() {
     try {
@@ -5835,11 +5834,23 @@ var SharingService = class {
           const errorText = await registerRes.text();
           const registrationTextActiveError = this.retiredGraphError();
           if (registrationTextActiveError) return { ok: false, error: registrationTextActiveError };
+          const message = `Failed to register delegation with server: ${registerRes.status} ${errorText}`;
+          if (registerRes.status === 401 || registerRes.status === 403) {
+            return {
+              ok: false,
+              error: createError2(
+                DelegationErrorCodes.AUTH_UNAUTHORIZED,
+                message,
+                void 0,
+                { status: registerRes.status }
+              )
+            };
+          }
           return {
             ok: false,
             error: createError2(
               DelegationErrorCodes.CREATION_FAILED,
-              `Failed to register delegation with server: ${registerRes.status} ${errorText}`
+              message
             )
           };
         }