@tinycloud/cli 1.0.1-beta.5 → 1.1.0-beta.7

package/dist/index.js

@@ -5659,20 +5659,55 @@ import {
   profileStoreMetadataPath,
   readAdditionalDelegations,
   readAuthRequests,
-  upsertProfileRecord,
+  updateProfileStore,
   withProfileLock as withProfileLock2,
   writeJsonAtomic
 } from "@tinycloud/operations/state";
 async function loadAdditionalDelegations(profile) {
   return readAdditionalDelegations(profile);
 }
-async function replayAdditionalDelegations(node, profile) {
+async function replayAdditionalDelegations(node, profile, options) {
+  const {
+    operationSpaceResolver,
+    prepareStoredDelegationReplay,
+    replayStoredDelegation,
+    storedDelegationKind
+  } = await import("@tinycloud/operations/delegation-binding");
+  const activator = node;
+  const migrated = await prepareStoredDelegationReplay(profile, activator, {
+    host: options.host,
+    migrate: options.migrate
+  });
+  const resolveSpace = operationSpaceResolver(node, options.ownerSpace);
   const entries = await loadAdditionalDelegations(profile);
-  for (const entry of entries) {
+  for (const stored of entries) {
+    const kind = storedDelegationKind(stored);
+    if (kind === "compact" || kind === "signed-login") {
+      const installed = await replayStoredDelegation(activator, stored, {
+        host: options.host,
+        migrated,
+        resolveSpace
+      });
+      if (installed === void 0 && process.env.TC_DEBUG_REPLAY === "1") {
+        process.stderr.write("[replay] skipping a stored delegation refused by validation or its request binding\n");
+      }
+      continue;
+    }
+    if (kind === "refused") {
+      if (process.env.TC_DEBUG_REPLAY === "1") {
+        process.stderr.write("[replay] skipping a malformed stored record or one bound to a request it cannot be held to\n");
+      }
+      continue;
+    }
+    const entry = stored;
     const expiry = entry.delegation.expiry instanceof Date ? entry.delegation.expiry : new Date(entry.delegation.expiry);
     if (expiry.getTime() <= Date.now()) continue;
     try {
-      await node.useRuntimeDelegation({ ...entry.delegation, expiry });
+      await node.useRuntimeDelegation({
+        ...entry.delegation,
+        delegationHeader: { Authorization: entry.delegation.delegationHeader.Authorization },
+        expiry
+      });
     } catch (err) {
       if (process.env.TC_DEBUG_REPLAY === "1") {
         process.stderr.write(`[replay] skipping ${entry.delegation.cid}: ${err.message}
@@ -5749,6 +5784,7 @@ async function createSDKInstance(ctx, options) {
       host: ctx.host,
       privateKey: effectivePrivateKey
     });
+    let restoredOwnSession2 = false;
     if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
       await node2.restoreSession({
         delegationHeader: session.delegationHeader,
@@ -5761,16 +5797,22 @@ async function createSDKInstance(ctx, options) {
         siwe: session.siwe,
         signature: session.signature
       });
+      restoredOwnSession2 = true;
     } else {
       await node2.signIn();
     }
-    await replayAdditionalDelegations(node2, ctx.profile);
+    await replayAdditionalDelegations(node2, ctx.profile, {
+      host: ctx.host,
+      ownerSpace: profile.spaceId,
+      migrate: restoredOwnSession2 && options?.privateKey === void 0
+    });
     return node2;
   }
   const node = new TinyCloudNode({
     host: ctx.host,
     privateKey: options?.privateKey
   });
+  let restoredOwnSession = false;
   if (options?.privateKey) {
     await node.signIn();
   } else if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
@@ -5785,8 +5827,13 @@ async function createSDKInstance(ctx, options) {
       siwe: session.siwe,
       signature: session.signature
     });
+    restoredOwnSession = true;
   }
-  await replayAdditionalDelegations(node, ctx.profile);
+  await replayAdditionalDelegations(node, ctx.profile, {
+    host: ctx.host,
+    ownerSpace: profile?.spaceId,
+    migrate: restoredOwnSession
+  });
   return node;
 }
 async function bootstrapDelegatedSession(ctx, delegation) {
@@ -5880,7 +5927,7 @@ async function ensureAuthenticated(ctx, options) {
   }
   const profile = await ProfileManager.getProfile(ctx.profile).catch(() => null);
   if (profile?.authMethod === "local" && profile.privateKey) {
-    return createSDKInstance(ctx, { privateKey: profile.privateKey });
+    return createSDKInstance(ctx);
   }
   const session = await ProfileManager.getSession(ctx.profile);
   if (!session) {
@@ -14899,11 +14946,12 @@ function historyRecordForPublishedShare(result, now = /* @__PURE__ */ new Date()
   };
 }
 var ShareNotifyError = class extends Error {
-  code = "delivery-failed";
-  constructor(message = "share delivery did not complete") {
+  constructor(message = "share delivery did not complete", reason) {
     super(message);
+    this.reason = reason;
     this.name = "ShareNotifyError";
   }
+  code = "delivery-failed";
 };
 function recipientMatchesShareRecord(record, recipient) {
   const matcher = record.recipientMatcher;
@@ -14913,6 +14961,11 @@ function recipientMatchesShareRecord(record, recipient) {
   if (matcher.kind === "emailDomain") return mailbox.domain === matcher.value;
   return false;
 }
+function shareDeliveryWindowExpiresAt(record) {
+  const expiresAt = Math.min(Date.parse(record.expiresAt), Date.parse(record.registeredAt) + 5 * 60 * 1e3);
+  if (!Number.isFinite(expiresAt)) throw new ShareNotifyError("share delivery history has invalid timestamps");
+  return expiresAt;
+}
 async function notifyShare(input) {
   const mailbox = canonicalMailbox(input.recipient);
   if (!input.shareId || mailbox === void 0) throw new ShareNotifyError("recipient is invalid");
@@ -14923,6 +14976,19 @@ async function notifyShare(input) {
   const idempotencyKey = input.idempotencyKey ?? await defaultIdempotencyKey(input.shareId, recipient);
   const attemptsLimit = input.maxAttempts ?? 3;
   if (!Number.isSafeInteger(attemptsLimit) || attemptsLimit < 1 || attemptsLimit > 8) throw new ShareNotifyError("maxAttempts is invalid");
+  if (input.signal?.aborted) throw new ShareNotifyError("share delivery was cancelled");
+  if (input.checkDeliveryWindow && input.record !== void 0 && shareDeliveryWindowExpiresAt(input.record) <= Date.now()) {
+    return {
+      protocol: "tinycloud-share",
+      version: 1,
+      shareId: input.shareId,
+      state: "partial-failure",
+      idempotencyKey,
+      attempts: 1,
+      retryable: false,
+      reason: "delivery-window-expired"
+    };
+  }
   let attempts = 0;
   let lastError;
   while (attempts < attemptsLimit) {
@@ -14930,8 +14996,27 @@ async function notifyShare(input) {
     attempts += 1;
     try {
       const state = await input.adapter.deliver({ shareId: input.shareId, recipient, idempotencyKey, ...input.record === void 0 ? {} : { record: input.record }, ...input.signal === void 0 ? {} : { signal: input.signal } });
-      return { protocol: "tinycloud-share", version: 1, shareId: input.shareId, state, idempotencyKey, attempts };
+      return {
+        protocol: "tinycloud-share",
+        version: 1,
+        shareId: input.shareId,
+        state: state === "delivered" && input.record?.deliveredRecipients?.includes(recipient) ? "already-delivered" : state,
+        idempotencyKey,
+        attempts
+      };
     } catch (error) {
+      if (error instanceof ShareNotifyError && error.reason === "delivery-window-expired") {
+        return {
+          protocol: "tinycloud-share",
+          version: 1,
+          shareId: input.shareId,
+          state: "partial-failure",
+          idempotencyKey,
+          attempts,
+          retryable: false,
+          reason: "delivery-window-expired"
+        };
+      }
       lastError = error;
     }
   }
@@ -15090,7 +15175,11 @@ async function revokeShare(input) {
     });
   }
   const revokedAt = (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
-  if (input.records !== void 0) await input.records.put({ ...input.record, revokedAt });
+  if (input.records?.update !== void 0) {
+    await input.records.update(input.record.shareId, (record) => ({ ...record, revokedAt }));
+  } else if (input.records !== void 0) {
+    await input.records.put({ ...input.record, revokedAt });
+  }
   return { state: "revoked", target, delegationCid, revokedAt };
 }
 function redactRecord(record, revealLink, link2) {
@@ -15159,1550 +15248,1011 @@ function parseNativeShareUrl(value) {
   return token;
 }
 
-// src/lib/duration.ts
-function parseDuration(input) {
-  const match = input.match(/^(\d+)(m|h|d|w)$/);
-  if (match) {
-    const value = parseInt(match[1], 10);
-    const unit = match[2];
-    const multipliers = {
-      m: 60 * 1e3,
-      h: 60 * 60 * 1e3,
-      d: 24 * 60 * 60 * 1e3,
-      w: 7 * 24 * 60 * 60 * 1e3
-    };
-    return value * multipliers[unit];
+// ../share-envelope/dist/index.js
+init_zod();
+var empty3 = new Uint8Array(0);
+function equals5(aa, bb) {
+  if (aa === bb) {
+    return true;
   }
-  const date = new Date(input);
-  if (!isNaN(date.getTime())) {
-    const ms = date.getTime() - Date.now();
-    if (ms <= 0) {
-      throw new Error(`Expiry date "${input}" is in the past`);
+  if (aa.byteLength !== bb.byteLength) {
+    return false;
+  }
+  for (let ii = 0; ii < aa.byteLength; ii++) {
+    if (aa[ii] !== bb[ii]) {
+      return false;
     }
-    return ms;
   }
-  throw new Error(`Invalid duration: "${input}". Use format like "1h", "7d", or an ISO date.`);
-}
-
-// src/commands/share.ts
-init_formatter();
-init_errors();
-
-// src/share/output.ts
-function writeJson2(value) {
-  process.stdout.write(`${JSON.stringify(value, null, 2)}
-`);
-}
-function authorizationRequiredJson(result) {
-  return {
-    state: "authorization-required",
-    method: result.method,
-    next: "complete authorization through the configured authority adapter, then retry with the required proof"
-  };
-}
-function publishHuman(result) {
-  process.stdout.write(`${result.url}
-`);
-}
-function inspectHuman(result) {
-  const metadata = result.metadata;
-  process.stdout.write([
-    `Share ${metadata.shareId}`,
-    `File: ${metadata.display.filename ?? "unnamed"}`,
-    `Target: ${metadata.target.kind === "bearer" ? "bearer (anyone with the complete link can read)" : metadata.target.kind}`,
-    `Expires: ${metadata.expiresAt}`,
-    `Resource: ${metadata.resource.path}`,
-    `Link format: ${result.link.kind}`
-  ].join("\n") + "\n");
-}
-function receiveHuman(path) {
-  process.stdout.write(`${path}
-`);
-}
-function receiveJson(result, path) {
-  writeJson2({ protocol: "tinycloud-share", version: 1, path, metadata: result.metadata });
+  return true;
 }
-
-// src/share/io.ts
-import { constants } from "fs";
-import { lstat as lstat2, mkdir as mkdir2, mkdtemp, open as open2, readFile as readFile2, realpath, stat as stat2, link, rename as rename2, rm as rm3, unlink } from "fs/promises";
-import { randomBytes as randomBytes2 } from "crypto";
-import { basename as basename2, join as join4, resolve, sep } from "path";
-init_errors();
-var MAX_SHARE_STDIN_BYTES = 100 * 1024 * 1024;
-var MAX_SHARE_URL_BYTES = 64 * 1024;
-async function readBoundedStdin(limit = MAX_SHARE_STDIN_BYTES) {
-  if (!Number.isSafeInteger(limit) || limit <= 0) throw new Error("MAX_BYTES_EXCEEDED");
-  const chunks = [];
-  let total = 0;
-  for await (const chunk of process.stdin) {
-    const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
-    total += bytes.byteLength;
-    if (total > limit) throw new Error("MAX_BYTES_EXCEEDED");
-    chunks.push(bytes);
+function coerce5(o) {
+  if (o instanceof Uint8Array && o.constructor.name === "Uint8Array") {
+    return o;
   }
-  return new Uint8Array(Buffer.concat(chunks, total));
-}
-async function readBoundedUrlStdin() {
-  const bytes = await readBoundedStdin(MAX_SHARE_URL_BYTES);
-  const value = new TextDecoder("utf-8", { fatal: true }).decode(bytes).trim();
-  if (value.length === 0 || /\s/.test(value)) throw new Error("INVALID_ARGUMENT");
-  return value;
-}
-function safeFilename(value) {
-  return shareFilename(value);
-}
-function shareFilename(value) {
-  try {
-    return canonicalShareFilename(value);
-  } catch {
-    throw new CLIError(
-      "UNSAFE_FILENAME",
-      hasUnsafeFilenameCodePoint(value) ? "filename contains control or invisible characters" : "filename must be one safe path segment",
-      8
-    );
+  if (o instanceof ArrayBuffer) {
+    return new Uint8Array(o);
   }
+  if (ArrayBuffer.isView(o)) {
+    return new Uint8Array(o.buffer, o.byteOffset, o.byteLength);
+  }
+  throw new Error("Unknown type, must be binary type");
 }
-function shareInputFilename(input, name) {
-  return shareFilename(name ?? (input === "-" ? "stdin.md" : basename2(resolve(input))));
-}
-async function readShareInput(input, name, limit = MAX_SHARE_STDIN_BYTES) {
-  const filename = shareInputFilename(input, name);
-  if (input === "-") return { bytes: await readBoundedStdin(limit), filename };
-  const path = resolve(input);
-  const info = await stat2(path);
-  if (!info.isFile() || info.size > limit) throw new Error("MAX_BYTES_EXCEEDED");
-  const bytes = new Uint8Array(await readFile2(path));
-  if (bytes.byteLength > limit) throw new Error("MAX_BYTES_EXCEEDED");
-  return { bytes, filename };
-}
-async function assertDirectory(path) {
-  const absolute = resolve(path);
-  const segments = absolute.split(sep).filter(Boolean);
-  let current = absolute.startsWith(sep) ? sep : "";
-  for (const segment of segments) {
-    current = current === sep ? join4(current, segment) : join4(current, segment);
-    try {
-      const info = await lstat2(current);
-      if (info.isSymbolicLink()) {
-        const canonical = await realpath(current);
-        if (current !== "/tmp" && current !== "/var") throw new Error("OUTPUT_EXISTS");
-        if (canonical !== `/private${current}`) throw new Error("OUTPUT_EXISTS");
-      } else if (!info.isDirectory()) throw new Error("OUTPUT_EXISTS");
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      await mkdir2(current, { mode: 448 });
-      const created = await lstat2(current);
-      if (created.isSymbolicLink() || !created.isDirectory()) throw new Error("OUTPUT_EXISTS");
+function base3(ALPHABET, name) {
+  if (ALPHABET.length >= 255) {
+    throw new TypeError("Alphabet too long");
+  }
+  var BASE_MAP = new Uint8Array(256);
+  for (var j = 0; j < BASE_MAP.length; j++) {
+    BASE_MAP[j] = 255;
+  }
+  for (var i = 0; i < ALPHABET.length; i++) {
+    var x = ALPHABET.charAt(i);
+    var xc = x.charCodeAt(0);
+    if (BASE_MAP[xc] !== 255) {
+      throw new TypeError(x + " is ambiguous");
     }
+    BASE_MAP[xc] = i;
   }
-}
-async function writeShareOutput(directory, filename, bytes, force) {
-  const outputDirectory = resolve(directory);
-  await assertDirectory(outputDirectory);
-  const safeName = safeFilename(filename);
-  const directoryHandle = await open2(outputDirectory, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0) | (constants.O_NOFOLLOW ?? 0));
-  const stableDirectory = await realpath(outputDirectory);
-  const outputPath = join4(stableDirectory, safeName);
-  const directoryIdentity = await directoryHandle.stat();
-  const assertStableDirectory = async () => {
-    const current = await stat2(stableDirectory);
-    if (current.dev !== directoryIdentity.dev || current.ino !== directoryIdentity.ino) throw new Error("OUTPUT_EXISTS");
-  };
-  await assertStableDirectory();
-  const stagingDirectory = await mkdtemp(join4(stableDirectory, ".tinycloud-share-stage-"));
-  const stagingInfo = await lstat2(stagingDirectory);
-  if (!stagingInfo.isDirectory() || (stagingInfo.mode & 511) !== 448) throw new Error("OUTPUT_EXISTS");
-  const stagingPath = join4(stagingDirectory, `.tinycloud-share-${randomBytes2(16).toString("hex")}.tmp`);
-  let temporaryPath;
-  let handle;
-  try {
-    await assertStableDirectory();
-    try {
-      const existing = await lstat2(outputPath);
-      if (existing.isSymbolicLink()) throw new Error("UNSAFE_FILENAME");
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
+  var BASE = ALPHABET.length;
+  var LEADER = ALPHABET.charAt(0);
+  var FACTOR = Math.log(BASE) / Math.log(256);
+  var iFACTOR = Math.log(256) / Math.log(BASE);
+  function encode32(source) {
+    if (source instanceof Uint8Array)
+      ;
+    else if (ArrayBuffer.isView(source)) {
+      source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+    } else if (Array.isArray(source)) {
+      source = Uint8Array.from(source);
     }
-    temporaryPath = stagingPath;
-    handle = await open2(temporaryPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 384);
-    await handle.writeFile(bytes);
-    await handle.close();
-    handle = void 0;
-    await assertStableDirectory();
-    if (force) {
-      await rename2(temporaryPath, outputPath);
-    } else {
-      await link(temporaryPath, outputPath);
-      await unlink(temporaryPath);
+    if (!(source instanceof Uint8Array)) {
+      throw new TypeError("Expected Uint8Array");
     }
-    await assertStableDirectory();
-  } catch (error) {
-    if (error.code === "EEXIST") throw new Error("OUTPUT_EXISTS");
-    if (error.code === "ELOOP") throw new Error("UNSAFE_FILENAME");
-    throw error;
-  } finally {
-    await handle?.close();
-    try {
-      if (temporaryPath !== void 0) await unlink(temporaryPath);
-    } catch {
+    if (source.length === 0) {
+      return "";
     }
-    await rm3(stagingDirectory, { recursive: true, force: true });
-    await directoryHandle.close();
-  }
-  return join4(outputDirectory, safeName);
-}
-
-// src/share/errors.ts
-var SharePublishAuthorityError = class extends Error {
-  constructor(failure) {
-    super(failure.kind);
-    this.failure = failure;
-    this.name = "SharePublishAuthorityError";
-  }
-};
-
-// src/commands/share.ts
-var SHARE_ORIGIN = "https://share.tinycloud.xyz";
-var shareServices = {};
-function configureShareCommandServices(services) {
-  shareServices = services;
-}
-function parseShareTarget(value) {
-  if (value === "anyone" || value === "bearer") return { kind: "bearer" };
-  if (value.startsWith("did:")) return { kind: "recipientDid", did: value };
-  if (value.startsWith("domain:")) return canonicalMailboxTarget({ kind: "emailDomain", domain: value.slice("domain:".length) });
-  if (value.startsWith("email:")) return canonicalMailboxTarget({ kind: "email", address: value.slice("email:".length) });
-  if (value.includes("@")) return canonicalMailboxTarget({ kind: "email", address: value });
-  throw new CLIError("INVALID_ARGUMENT", "--to must be anyone, a did:, an email address, or domain:example.com", 2);
-}
-function canonicalMailboxTarget(target) {
-  try {
-    return normalizeShareTarget(target);
-  } catch (error) {
-    throw new CLIError("INVALID_ARGUMENT", error instanceof TypeError ? error.message : "share recipient is invalid", 2);
+    var zeroes = 0;
+    var length22 = 0;
+    var pbegin = 0;
+    var pend = source.length;
+    while (pbegin !== pend && source[pbegin] === 0) {
+      pbegin++;
+      zeroes++;
+    }
+    var size = (pend - pbegin) * iFACTOR + 1 >>> 0;
+    var b58 = new Uint8Array(size);
+    while (pbegin !== pend) {
+      var carry = source[pbegin];
+      var i2 = 0;
+      for (var it1 = size - 1; (carry !== 0 || i2 < length22) && it1 !== -1; it1--, i2++) {
+        carry += 256 * b58[it1] >>> 0;
+        b58[it1] = carry % BASE >>> 0;
+        carry = carry / BASE >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length22 = i2;
+      pbegin++;
+    }
+    var it2 = size - length22;
+    while (it2 !== size && b58[it2] === 0) {
+      it2++;
+    }
+    var str = LEADER.repeat(zeroes);
+    for (; it2 < size; ++it2) {
+      str += ALPHABET.charAt(b58[it2]);
+    }
+    return str;
   }
-}
-function shareCliError(error) {
-  if (error instanceof CLIError) return error;
-  if (error instanceof SharePublishAuthorityError) {
-    const failure = error.failure;
-    const profileName = "profileName" in failure ? failure.profileName : void 0;
-    const localKey = "localKey" in failure && failure.localKey === true;
-    const profileHint = profileName === void 0 ? "" : `--profile ${profileName} `;
-    const loginHint = localKey ? `\`tc ${profileHint}auth login --method local\`` : `\`tc ${profileHint}auth login --device --manifest builtin:share-publishing\` (or \`tc ${profileHint}enable share\`)`;
-    if (failure.kind === "caveated-session") {
-      const holder = profileName === void 0 ? "this session" : `profile ${profileName}'s session`;
-      return new CLIError(
-        "PERMISSION_DENIED",
-        `${holder} carries signed restrictions (caveats) on the authority an anyone-with-link share needs, so it cannot create the share link; nothing was shared. Approve Share publishing without restrictions on a new, dedicated profile (any unused name): \`tc init --name publisher --key-only && tc --profile publisher enable share\``,
-        5
-      );
+  function decodeUnsafe(source) {
+    if (typeof source !== "string") {
+      throw new TypeError("Expected String");
     }
-    if (failure.kind === "owner-space-unresolved") {
-      return new CLIError("AUTH_REQUIRED", `a valid signed TinyCloud session is required; run ${loginHint}`, 3);
+    if (source.length === 0) {
+      return new Uint8Array();
     }
-    if (failure.kind === "scope-denied") {
-      const requiredAction = failure.requiredAction === void 0 ? "" : ` (${failure.requiredAction})`;
-      const renew = localKey ? `renew it with ${loginHint} using the required capability` : `verify the session includes the builtin:share-publishing scope; if it does not, request it with ${loginHint}`;
-      return new CLIError("PERMISSION_DENIED", `the session lacks ${failure.capability} authority${requiredAction}; ${renew}`, 5);
+    var psz = 0;
+    if (source[psz] === " ") {
+      return;
     }
-    if (failure.kind === "lifetime-exceeds-session") {
-      const expiresAt = failure.sessionExpiresAt.toISOString();
-      if (failure.reason === "session-too-close") {
-        return new CLIError("AUTH_REQUIRED", `the signed session expires too soon (${expiresAt}); log in again with ${loginHint}`, 3);
+    var zeroes = 0;
+    var length22 = 0;
+    while (source[psz] === LEADER) {
+      zeroes++;
+      psz++;
+    }
+    var size = (source.length - psz) * FACTOR + 1 >>> 0;
+    var b256 = new Uint8Array(size);
+    while (source[psz]) {
+      var carry = BASE_MAP[source.charCodeAt(psz)];
+      if (carry === 255) {
+        return;
       }
-      if (failure.reason === "below-minimum") {
-        return new CLIError("SESSION_LIFETIME_EXCEEDED", "share expiry must be at least 60 seconds from now; use a longer --expires value", 2);
+      var i2 = 0;
+      for (var it3 = size - 1; (carry !== 0 || i2 < length22) && it3 !== -1; it3--, i2++) {
+        carry += BASE * b256[it3] >>> 0;
+        b256[it3] = carry % 256 >>> 0;
+        carry = carry / 256 >>> 0;
       }
-      return new CLIError("SESSION_LIFETIME_EXCEEDED", `requested share lifetime exceeds session expiry ${expiresAt}; use a shorter --expires value or renew the session with ${loginHint}`, 2);
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length22 = i2;
+      psz++;
     }
-    if (failure.kind === "origin-mismatch") {
-      return new CLIError("ORIGIN_MISMATCH", "share origin does not match the configured service", 2);
+    if (source[psz] === " ") {
+      return;
     }
-    if (failure.kind === "invalid-request") {
-      return new CLIError("INVALID_ARGUMENT", failure.reason, 2);
+    var it4 = size - length22;
+    while (it4 !== size && b256[it4] === 0) {
+      it4++;
     }
-    if (failure.kind === "registry-unavailable") {
-      return new CLIError("UNAVAILABLE", "the TinyCloud location registry could not be reached, so nothing was shared; try again shortly", 4);
+    var vch = new Uint8Array(zeroes + (size - it4));
+    var j2 = zeroes;
+    while (it4 !== size) {
+      vch[j2++] = b256[it4++];
     }
-    if (failure.kind === "registry-rejected") {
-      return new CLIError("REGISTRY_REJECTED", "the TinyCloud location registry rejected this session's location record, so nothing was shared; retrying will not help. Log in again, and report the problem if it persists", 6);
+    return vch;
+  }
+  function decode52(string) {
+    var buffer = decodeUnsafe(string);
+    if (buffer) {
+      return buffer;
     }
-    if (failure.kind === "storage-quota-exceeded") {
-      const sizes = failure.usedBytes === void 0 || failure.limitBytes === void 0 ? "" : ` (${formatBytes(failure.usedBytes)} used of ${formatBytes(failure.limitBytes)} limit)`;
-      return new CLIError("STORAGE_QUOTA_EXCEEDED", `storage quota exceeded${sizes}; nothing was shared`, 4);
+    throw new Error(`Non-${name} character`);
+  }
+  return {
+    encode: encode32,
+    decodeUnsafe,
+    decode: decode52
+  };
+}
+var src3 = base3;
+var _brrp__multiformats_scope_baseX3 = src3;
+var base_x_default3 = _brrp__multiformats_scope_baseX3;
+var Encoder3 = class {
+  name;
+  prefix;
+  baseEncode;
+  constructor(name, prefix, baseEncode) {
+    this.name = name;
+    this.prefix = prefix;
+    this.baseEncode = baseEncode;
+  }
+  encode(bytes) {
+    if (bytes instanceof Uint8Array) {
+      return `${this.prefix}${this.baseEncode(bytes)}`;
+    } else {
+      throw Error("Unknown type, must be binary type");
     }
-    if (failure.kind === "upload-failed") {
-      return new CLIError("UPLOAD_FAILED", "share source upload failed; nothing was shared", 4);
+  }
+};
+var Decoder3 = class {
+  name;
+  prefix;
+  baseDecode;
+  prefixCodePoint;
+  constructor(name, prefix, baseDecode) {
+    this.name = name;
+    this.prefix = prefix;
+    const prefixCodePoint = prefix.codePointAt(0);
+    if (prefixCodePoint === void 0) {
+      throw new Error("Invalid prefix character");
     }
+    this.prefixCodePoint = prefixCodePoint;
+    this.baseDecode = baseDecode;
   }
-  if (error instanceof ShareNotifyError) {
-    return new CLIError("INVALID_ARGUMENT", error.message, 2);
+  decode(text) {
+    if (typeof text === "string") {
+      if (text.codePointAt(0) !== this.prefixCodePoint) {
+        throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`);
+      }
+      return this.baseDecode(text.slice(this.prefix.length));
+    } else {
+      throw Error("Can only multibase decode strings");
+    }
   }
-  if (error instanceof SharePublishError) {
-    const exit = error.code === "authority-required" ? 3 : error.code === "max-bytes-exceeded" ? 7 : 2;
-    const code3 = error.code === "authority-required" ? "AUTH_REQUIRED" : error.code === "max-bytes-exceeded" ? "MAX_BYTES_EXCEEDED" : "INVALID_ARGUMENT";
-    return new CLIError(code3, error.message, exit);
+  or(decoder) {
+    return or3(this, decoder);
   }
-  if (error instanceof ShareReceiveError) {
-    const verification = /* @__PURE__ */ new Set(["cid-mismatch", "decrypt-failed", "envelope-invalid", "origin-mismatch", "signature-invalid", "capability-invalid", "content-integrity-failed"]);
-    const exit = error.code === "max-bytes-exceeded" ? 7 : verification.has(error.code) ? 5 : error.code === "expired" || error.code === "fetch-failed" ? 4 : error.code === "invalid-link" || error.code === "unsupported-target" ? 2 : 2;
-    const code3 = error.code === "fetch-failed" ? "NOT_FOUND" : error.code.replaceAll("-", "_").toUpperCase();
-    return new CLIError(code3, error.message, exit);
+};
+var ComposedDecoder3 = class {
+  decoders;
+  constructor(decoders) {
+    this.decoders = decoders;
   }
-  const message = error instanceof Error ? error.message : String(error);
-  const nodeCode = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
-  const known = {
-    MAX_BYTES_EXCEEDED: { code: "MAX_BYTES_EXCEEDED", exit: 7 },
-    UNSAFE_FILENAME: { code: "UNSAFE_FILENAME", exit: 8 },
-    OUTPUT_EXISTS: { code: "OUTPUT_EXISTS", exit: 8 },
-    INVALID_ARGUMENT: { code: "INVALID_ARGUMENT", exit: 2 },
-    "share not found": { code: "NOT_FOUND", exit: 4 },
-    AUTH_REQUIRED: { code: "AUTH_REQUIRED", exit: 3 },
-    UNAVAILABLE: { code: "UNAVAILABLE", exit: 4 }
-  };
-  if (nodeCode === "ENOENT") return new CLIError("INVALID_ARGUMENT", "share input was not found", 2);
-  if (nodeCode === "EISDIR") return new CLIError("INVALID_ARGUMENT", "share input must be a Markdown file", 2);
-  if (error instanceof TypeError) return new CLIError("INVALID_ARGUMENT", "share input is invalid", 2);
-  const mapped = typeof nodeCode === "string" && known[nodeCode] !== void 0 ? known[nodeCode] : known[message];
-  return new CLIError(mapped?.code ?? "INVALID_ARGUMENT", mapped ? mapped.code : "share operation failed", mapped?.exit ?? 2);
-}
-function inputUrl(value, stdin) {
-  if (stdin || value === "-") return readBoundedUrlStdin();
-  if (value === void 0 || value.length === 0) throw new CLIError("INVALID_ARGUMENT", "a share URL or - is required", 2);
-  return Promise.resolve(value);
-}
-async function inspectShareInputOnce(value, stdin, expectedOrigin, dependencies = {}) {
-  const link2 = stdin || value === "-" ? await (dependencies.read ?? readBoundedUrlStdin)() : await inputUrl(value, false);
-  try {
-    parseNativeShareUrl(link2);
-  } catch {
-    return (dependencies.inspect ?? inspectShare)(link2, { expectedOrigin });
+  or(decoder) {
+    return or3(this, decoder);
   }
-  throw new CLIError("UNSUPPORTED_LINK", "native bearer links are opaque; receive the link to verify access", 2);
-}
-function jsonOutput(options, command) {
-  return options.json === true || command.optsWithGlobals().json === true;
-}
-function expires(value) {
-  try {
-    return new Date(Date.now() + parseDuration(value));
-  } catch {
-    throw new CLIError("INVALID_ARGUMENT", "invalid expiry duration", 2);
+  decode(input) {
+    const prefix = input[0];
+    const decoder = this.decoders[prefix];
+    if (decoder != null) {
+      return decoder.decode(input);
+    } else {
+      throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`);
+    }
   }
+};
+function or3(left, right) {
+  return new ComposedDecoder3({
+    ...left.decoders ?? { [left.prefix]: left },
+    ...right.decoders ?? { [right.prefix]: right }
+  });
 }
-async function rememberPublishedShare(result) {
-  const record = historyRecordForPublishedShare(result);
-  if (shareServices.records !== void 0) await shareServices.records.put(record);
-  return record;
-}
-function byteLimit(value) {
-  if (value === void 0) return void 0;
-  const parsed = Number(value);
-  if (!Number.isSafeInteger(parsed) || parsed <= 0 || parsed > MAX_SHARE_STDIN_BYTES) throw new CLIError("MAX_BYTES_EXCEEDED", "max-bytes must be between 1 and 100 MiB", 7);
-  return parsed;
-}
-function mediaTypeFor(filename) {
-  const extension = filename.toLowerCase().split(".").at(-1);
-  return extension === "md" || extension === "markdown" ? "text/markdown" : extension === "txt" ? "text/plain" : extension === "html" || extension === "htm" ? "text/html" : extension === "json" ? "application/json" : extension === "css" ? "text/css" : extension === "js" ? "text/javascript" : "application/octet-stream";
+var Codec3 = class {
+  name;
+  prefix;
+  baseEncode;
+  baseDecode;
+  encoder;
+  decoder;
+  constructor(name, prefix, baseEncode, baseDecode) {
+    this.name = name;
+    this.prefix = prefix;
+    this.baseEncode = baseEncode;
+    this.baseDecode = baseDecode;
+    this.encoder = new Encoder3(name, prefix, baseEncode);
+    this.decoder = new Decoder3(name, prefix, baseDecode);
+  }
+  encode(input) {
+    return this.encoder.encode(input);
+  }
+  decode(input) {
+    return this.decoder.decode(input);
+  }
+};
+function from3({ name, prefix, encode: encode32, decode: decode52 }) {
+  return new Codec3(name, prefix, encode32, decode52);
 }
-function requestedActions(values) {
-  const actions = values === void 0 || values.length === 0 ? ["read"] : values;
-  if (actions.some((value) => value !== "read" && value !== "list" && value !== "edit")) throw new CLIError("INVALID_ARGUMENT", "--action must be read, list, or edit", 2);
-  return [...new Set(actions)];
+function baseX3({ name, prefix, alphabet }) {
+  const { encode: encode32, decode: decode52 } = base_x_default3(alphabet, name);
+  return from3({
+    prefix,
+    name,
+    encode: encode32,
+    decode: (text) => coerce5(decode52(text))
+  });
 }
-function assertAggregateInputLimit(inputs, maxBytes) {
-  const limit = maxBytes ?? MAX_SHARE_STDIN_BYTES;
-  let total = 0;
-  for (const input of inputs) {
-    total += input.bytes.byteLength;
-    if (!Number.isSafeInteger(total) || total > limit) throw new CLIError("MAX_BYTES_EXCEEDED", "combined share input exceeds the configured byte limit", 7);
+function decode9(string, alphabetIdx, bitsPerChar, name) {
+  let end = string.length;
+  while (string[end - 1] === "=") {
+    --end;
   }
-}
-function registerShareCommand(program2) {
-  const share = program2.command("share").description("Publish and consume TinyCloud Share links");
-  share.command("publish <files...>").description("Publish one or more bounded files as a Share").option("--name <filename>", "Filename for stdin input").option("--to <target>", "Share target", "anyone").option("--notify", "Request idempotent email delivery for addressed targets").option("--expires <duration>", "Share lifetime").option("--max-bytes <bytes>", "Bound input bytes").option("--media-type <type>", "Media type for a single input").option("--action <actions...>", "Addressed permission: read, list, or edit").option("--prefix", "Publish multiple inputs beneath one addressed prefix").option("--binary", "Allow non-UTF-8 bearer content").option("--json", "Print versioned redacted JSON").option("--viewer-origin <origin>", "Canonical HTTPS viewer origin", SHARE_ORIGIN).action(async (files, options, command) => {
-    try {
-      const json = jsonOutput(options, command);
-      const maxBytes = byteLimit(options.maxBytes);
-      if (files.length === 0 || files.includes("-") && files.length > 1) throw new CLIError("INVALID_ARGUMENT", "stdin must be the only publish input", 2);
-      const name = files.length === 1 ? options.name : void 0;
-      for (const file of files) shareInputFilename(file, name);
-      const inputs = await Promise.all(files.map((file) => readShareInput(file, name, maxBytes)));
-      assertAggregateInputLimit(inputs, maxBytes);
-      const target = parseShareTarget(options.to);
-      const actions = requestedActions(options.action);
-      if (options.prefix && target.kind === "bearer") throw new CLIError("INVALID_ARGUMENT", "--prefix requires an addressed target", 2);
-      if (inputs.length > 1 && target.kind === "bearer") throw new CLIError("UNSUPPORTED_LINK", "multiple files require an addressed target", 2);
-      if (inputs.length > 1 && !options.prefix) throw new CLIError("INVALID_ARGUMENT", "multiple files require --prefix", 2);
-      if (options.notify === true && target.kind !== "email") throw new CLIError("INVALID_ARGUMENT", "--notify requires an exact email target", 2);
-      const result = await publishTargetShare({
-        source: inputs[0].bytes,
-        filename: inputs[0].filename,
-        files: inputs.map((input) => ({ bytes: input.bytes, filename: input.filename, mediaType: mediaTypeFor(input.filename) })),
-        mediaType: options.mediaType ?? mediaTypeFor(inputs[0].filename),
-        allowBinary: options.binary === true,
-        target,
-        resourceKind: options.prefix || inputs.length > 1 ? "prefix" : "exact",
-        actions,
-        expiresAt: expires(options.expires ?? "7d"),
-        expiryWasExplicit: options.expires !== void 0,
-        origin: options.viewerOrigin,
-        ...maxBytes === void 0 ? {} : { maxBytes },
-        notify: options.notify === true,
-        targetAdapter: shareServices.targetAdapter
-      });
-      if ("state" in result) {
-        if (json) {
-          writeJson2({ protocol: "tinycloud-share", version: 1, authorization: authorizationRequiredJson(result) });
-          process.exitCode = 6;
-          return;
-        }
-        throw new CLIError(result.method === "openkey-device" ? "DEVICE_AUTH_REQUIRED" : "CLAIM_REQUIRED", "recipient authorization is required; continue through the configured authority adapter", 6);
-      }
-      const record = await rememberPublishedShare(result);
-      if (options.notify === true && target.kind === "email") {
-        if (shareServices.delivery === void 0) throw new CLIError("AUTH_REQUIRED", "delivery authority is not configured", 3);
-        const recipient = record.recipientMatcher.kind === "exactEmail" ? record.recipientMatcher.value : target.address;
-        const delivery = await notifyShare({ shareId: record.shareId, recipient, record, adapter: shareServices.delivery });
-        if (delivery.state === "partial-failure") process.exitCode = 9;
-      }
-      if (result.metadata.expiryClamped === true) process.stderr.write(`Share expiry clamped to session expiry (${result.metadata.expiresAt}).
-`);
-      if (json) writeJson2({ ...redactPublishedShare(result), expiryClamped: result.metadata.expiryClamped === true });
-      else publishHuman(result);
-    } catch (error) {
-      handleError(shareCliError(error));
+  const out = new Uint8Array(end * bitsPerChar / 8 | 0);
+  let bits = 0;
+  let buffer = 0;
+  let written = 0;
+  for (let i = 0; i < end; ++i) {
+    const value = alphabetIdx[string[i]];
+    if (value === void 0) {
+      throw new SyntaxError(`Non-${name} character`);
     }
-  });
-  share.command("inspect [url]").description("Verify a share link and print safe metadata").option("--stdin", "Read the complete URL from stdin").option("--json", "Print versioned redacted JSON").option("--viewer-origin <origin>", "Require this canonical Share origin", SHARE_ORIGIN).action(async (url, options, command) => {
-    try {
-      const json = jsonOutput(options, command);
-      const result = await inspectShareInputOnce(url, options.stdin === true, options.viewerOrigin);
-      if (json) writeJson2(result);
-      else inspectHuman(result);
-    } catch (error) {
-      handleError(shareCliError(error));
+    buffer = buffer << bitsPerChar | value;
+    bits += bitsPerChar;
+    if (bits >= 8) {
+      bits -= 8;
+      out[written++] = 255 & buffer >> bits;
     }
-  });
-  share.command("receive [url]").description("Verify and receive a share link").option("--stdin", "Read the complete URL from stdin").option("--output <directory>", "Create the file in this directory").option("--stdout", "Write verified plaintext bytes to stdout").option("--force", "Allow replacing an existing non-symlink output").option("--max-bytes <bytes>", "Bound received content bytes").option("--json", "Print versioned redacted JSON").option("--viewer-origin <origin>", "Require this canonical Share origin", SHARE_ORIGIN).action(async (url, options, command) => {
-    try {
-      const json = jsonOutput(options, command);
-      if (options.stdout && json) throw new CLIError("INVALID_ARGUMENT", "--stdout and --json are mutually exclusive", 2);
-      const maxBytes = byteLimit(options.maxBytes);
-      const link2 = await inputUrl(url, options.stdin === true);
-      let nativeLink = false;
-      try {
-        parseNativeShareUrl(link2);
-        nativeLink = true;
-      } catch {
-      }
-      if (nativeLink) {
-        if (shareServices.nativeReader === void 0) throw new CLIError("AUTH_REQUIRED", "native TinyCloud receive is not configured", 3);
-        const native = await shareServices.nativeReader(link2);
-        if (maxBytes !== void 0 && native.bytes.byteLength > maxBytes) throw new CLIError("MAX_BYTES_EXCEEDED", "shared content exceeds max-bytes", 7);
-        if (options.stdout) {
-          process.stdout.write(Buffer.from(native.bytes));
-          return;
-        }
-        const output2 = await writeShareOutput(options.output ?? ".", native.filename, native.bytes, options.force === true);
-        if (json) writeJson2({ protocol: "tinycloud-share", version: 1, path: output2, transport: "native" });
-        else receiveHuman(output2);
-        return;
-      }
-      const result = await receiveShare(link2, {
-        expectedOrigin: options.viewerOrigin,
-        ...maxBytes === void 0 ? {} : { maxContentBlobBytes: maxBytes }
-      });
-      if ("state" in result) {
-        if (json) {
-          writeJson2({ protocol: "tinycloud-share", version: 1, authorization: authorizationRequiredJson(result) });
-          process.exitCode = 6;
-          return;
-        }
-        throw new CLIError(result.method === "openkey-device" ? "DEVICE_AUTH_REQUIRED" : "CLAIM_REQUIRED", "recipient authorization is required; resume through the configured authority adapter", 6);
-      }
-      if (options.stdout) {
-        process.stdout.write(Buffer.from(result.bytes));
-        return;
-      }
-      const output = await writeShareOutput(options.output ?? ".", result.metadata.display.filename ?? "share.md", result.bytes, options.force === true);
-      if (json) receiveJson(result, output);
-      else receiveHuman(output);
-    } catch (error) {
-      handleError(shareCliError(error));
+  }
+  if (bits >= bitsPerChar || (255 & buffer << 8 - bits) !== 0) {
+    throw new SyntaxError("Unexpected end of data");
+  }
+  return out;
+}
+function encode5(data, alphabet, bitsPerChar) {
+  const pad = alphabet[alphabet.length - 1] === "=";
+  const mask = (1 << bitsPerChar) - 1;
+  let out = "";
+  let bits = 0;
+  let buffer = 0;
+  for (let i = 0; i < data.length; ++i) {
+    buffer = buffer << 8 | data[i];
+    bits += 8;
+    while (bits > bitsPerChar) {
+      bits -= bitsPerChar;
+      out += alphabet[mask & buffer >> bits];
     }
-  });
-  share.command("list").description("List encrypted sender history without complete bearer URLs").option("--json", "Print versioned redacted JSON").action(async (options, command) => {
-    try {
-      const json = jsonOutput(options, command);
-      if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
-      const result = await listShares(shareServices.records);
-      if (json) writeJson2({ protocol: "tinycloud-share", version: 1, shares: result });
-      else process.stdout.write(result.map((item) => `${item.shareId}	${item.target}	${item.expiresAt}`).join("\n") + (result.length ? "\n" : ""));
-    } catch (error) {
-      handleError(shareCliError(error));
-    }
-  });
-  share.command("show <id>").description("Show one redacted sender-history record").option("--reveal-link", "Explicitly include the complete link").option("--json", "Print versioned redacted JSON").action(async (id, options, command) => {
-    try {
-      const json = jsonOutput(options, command);
-      if (options.revealLink && json) throw new CLIError("INVALID_ARGUMENT", "--reveal-link cannot be combined with --json", 2);
-      if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
-      const result = await showShare({ storage: shareServices.records, shareId: id, revealLink: options.revealLink === true, link: options.revealLink ? await shareServices.linkFor?.(id) : void 0 });
-      if (json) writeJson2({ protocol: "tinycloud-share", version: 1, share: result });
-      else writeJson2(result);
-    } catch (error) {
-      handleError(shareCliError(error));
-    }
-  });
-  share.command("notify <id>").description("Retry idempotent delivery without recreating the share").requiredOption("--to <address>", "Recipient email").option("--json", "Print versioned JSON").action(async (id, options, command) => {
-    try {
-      const json = jsonOutput(options, command);
-      if (shareServices.delivery === void 0) throw new CLIError("AUTH_REQUIRED", "delivery authority is not configured", 3);
-      if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
-      const record = await shareServices.records.get(id);
-      if (record === void 0) throw new CLIError("NOT_FOUND", "share not found", 4);
-      const result = await notifyShare({ shareId: id, recipient: options.to, record, adapter: shareServices.delivery });
-      if (json) writeJson2(result);
-      else process.stdout.write(`${result.state}
-`);
-      if (result.state === "partial-failure") process.exitCode = 9;
-    } catch (error) {
-      handleError(shareCliError(error));
-    }
-  });
-  share.command("revoke <id>").description("Revoke addressed shares; report bearer retention honestly").option("--ancestor", "Revoke the owner delegation ancestry").option("--json", "Print versioned JSON").action(async (id, options, command) => {
-    try {
-      const json = jsonOutput(options, command);
-      if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
-      const record = shareServices.getRecord ? await shareServices.getRecord(id) : await shareServices.records.get(id);
-      if (record === void 0) throw new CLIError("NOT_FOUND", "share not found", 4);
-      const result = await revokeShare({ record, records: shareServices.records, adapter: shareServices.revocation, scope: options.ancestor ? "ancestor" : "direct" });
-      if (result.state === "unsupported") {
-        throw new CLIError("UNSUPPORTED_TARGET", result.reason, 2);
-      }
-      if (json) writeJson2({ protocol: "tinycloud-share", version: 1, result });
-      else process.stdout.write(`${result.state}
-`);
-    } catch (error) {
-      handleError(shareCliError(error));
+  }
+  if (bits !== 0) {
+    out += alphabet[mask & buffer << bitsPerChar - bits];
+  }
+  if (pad) {
+    while ((out.length * bitsPerChar & 7) !== 0) {
+      out += "=";
+    }
+  }
+  return out;
+}
+function createAlphabetIdx3(alphabet) {
+  const alphabetIdx = {};
+  for (let i = 0; i < alphabet.length; ++i) {
+    alphabetIdx[alphabet[i]] = i;
+  }
+  return alphabetIdx;
+}
+function rfc46483({ name, prefix, bitsPerChar, alphabet }) {
+  const alphabetIdx = createAlphabetIdx3(alphabet);
+  return from3({
+    prefix,
+    name,
+    encode(input) {
+      return encode5(input, alphabet, bitsPerChar);
+    },
+    decode(input) {
+      return decode9(input, alphabetIdx, bitsPerChar, name);
     }
   });
 }
-
-// src/share/adapters.ts
-init_profiles();
-import { readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
-import { join as join6 } from "path";
-import { createHash } from "crypto";
-
-// ../share-envelope/dist/index.js
-init_zod();
-var empty3 = new Uint8Array(0);
-function equals5(aa, bb) {
-  if (aa === bb) {
-    return true;
+var base323 = rfc46483({
+  prefix: "b",
+  name: "base32",
+  alphabet: "abcdefghijklmnopqrstuvwxyz234567",
+  bitsPerChar: 5
+});
+var base32upper3 = rfc46483({
+  prefix: "B",
+  name: "base32upper",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",
+  bitsPerChar: 5
+});
+var base32pad3 = rfc46483({
+  prefix: "c",
+  name: "base32pad",
+  alphabet: "abcdefghijklmnopqrstuvwxyz234567=",
+  bitsPerChar: 5
+});
+var base32padupper3 = rfc46483({
+  prefix: "C",
+  name: "base32padupper",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=",
+  bitsPerChar: 5
+});
+var base32hex3 = rfc46483({
+  prefix: "v",
+  name: "base32hex",
+  alphabet: "0123456789abcdefghijklmnopqrstuv",
+  bitsPerChar: 5
+});
+var base32hexupper3 = rfc46483({
+  prefix: "V",
+  name: "base32hexupper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUV",
+  bitsPerChar: 5
+});
+var base32hexpad3 = rfc46483({
+  prefix: "t",
+  name: "base32hexpad",
+  alphabet: "0123456789abcdefghijklmnopqrstuv=",
+  bitsPerChar: 5
+});
+var base32hexpadupper3 = rfc46483({
+  prefix: "T",
+  name: "base32hexpadupper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUV=",
+  bitsPerChar: 5
+});
+var base32z3 = rfc46483({
+  prefix: "h",
+  name: "base32z",
+  alphabet: "ybndrfg8ejkmcpqxot1uwisza345h769",
+  bitsPerChar: 5
+});
+var base363 = baseX3({
+  prefix: "k",
+  name: "base36",
+  alphabet: "0123456789abcdefghijklmnopqrstuvwxyz"
+});
+var base36upper3 = baseX3({
+  prefix: "K",
+  name: "base36upper",
+  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+});
+var base58btc3 = baseX3({
+  name: "base58btc",
+  prefix: "z",
+  alphabet: "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+});
+var base58flickr3 = baseX3({
+  name: "base58flickr",
+  prefix: "Z",
+  alphabet: "123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ"
+});
+var encode_13 = encode22;
+var MSB3 = 128;
+var REST3 = 127;
+var MSBALL3 = ~REST3;
+var INT3 = Math.pow(2, 31);
+function encode22(num, out, offset) {
+  out = out || [];
+  offset = offset || 0;
+  var oldOffset = offset;
+  while (num >= INT3) {
+    out[offset++] = num & 255 | MSB3;
+    num /= 128;
   }
-  if (aa.byteLength !== bb.byteLength) {
-    return false;
+  while (num & MSBALL3) {
+    out[offset++] = num & 255 | MSB3;
+    num >>>= 7;
   }
-  for (let ii = 0; ii < aa.byteLength; ii++) {
-    if (aa[ii] !== bb[ii]) {
-      return false;
+  out[offset] = num | 0;
+  encode22.bytes = offset - oldOffset + 1;
+  return out;
+}
+var decode22 = read3;
+var MSB$13 = 128;
+var REST$13 = 127;
+function read3(buf, offset) {
+  var res = 0, offset = offset || 0, shift = 0, counter = offset, b, l = buf.length;
+  do {
+    if (counter >= l) {
+      read3.bytes = 0;
+      throw new RangeError("Could not decode varint");
     }
-  }
-  return true;
+    b = buf[counter++];
+    res += shift < 28 ? (b & REST$13) << shift : (b & REST$13) * Math.pow(2, shift);
+    shift += 7;
+  } while (b >= MSB$13);
+  read3.bytes = counter - offset;
+  return res;
 }
-function coerce5(o) {
-  if (o instanceof Uint8Array && o.constructor.name === "Uint8Array") {
-    return o;
-  }
-  if (o instanceof ArrayBuffer) {
-    return new Uint8Array(o);
+var N13 = Math.pow(2, 7);
+var N23 = Math.pow(2, 14);
+var N33 = Math.pow(2, 21);
+var N43 = Math.pow(2, 28);
+var N53 = Math.pow(2, 35);
+var N63 = Math.pow(2, 42);
+var N73 = Math.pow(2, 49);
+var N83 = Math.pow(2, 56);
+var N93 = Math.pow(2, 63);
+var length3 = function(value) {
+  return value < N13 ? 1 : value < N23 ? 2 : value < N33 ? 3 : value < N43 ? 4 : value < N53 ? 5 : value < N63 ? 6 : value < N73 ? 7 : value < N83 ? 8 : value < N93 ? 9 : 10;
+};
+var varint3 = {
+  encode: encode_13,
+  decode: decode22,
+  encodingLength: length3
+};
+var _brrp_varint3 = varint3;
+var varint_default3 = _brrp_varint3;
+function decode32(data, offset = 0) {
+  const code22 = varint_default3.decode(data, offset);
+  return [code22, varint_default3.decode.bytes];
+}
+function encodeTo3(int, target, offset = 0) {
+  varint_default3.encode(int, target, offset);
+  return target;
+}
+function encodingLength3(int) {
+  return varint_default3.encodingLength(int);
+}
+function create3(code22, digest) {
+  const size = digest.byteLength;
+  const sizeOffset = encodingLength3(code22);
+  const digestOffset = sizeOffset + encodingLength3(size);
+  const bytes = new Uint8Array(digestOffset + size);
+  encodeTo3(code22, bytes, 0);
+  encodeTo3(size, bytes, sizeOffset);
+  bytes.set(digest, digestOffset);
+  return new Digest3(code22, size, digest, bytes);
+}
+function decode42(multihash) {
+  const bytes = coerce5(multihash);
+  const [code22, sizeOffset] = decode32(bytes);
+  const [size, digestOffset] = decode32(bytes.subarray(sizeOffset));
+  const digest = bytes.subarray(sizeOffset + digestOffset);
+  if (digest.byteLength !== size) {
+    throw new Error("Incorrect length");
   }
-  if (ArrayBuffer.isView(o)) {
-    return new Uint8Array(o.buffer, o.byteOffset, o.byteLength);
+  return new Digest3(code22, size, digest, bytes);
+}
+function equals22(a, b) {
+  if (a === b) {
+    return true;
+  } else {
+    const data = b;
+    return a.code === data.code && a.size === data.size && data.bytes instanceof Uint8Array && equals5(a.bytes, data.bytes);
   }
-  throw new Error("Unknown type, must be binary type");
 }
-function base3(ALPHABET, name) {
-  if (ALPHABET.length >= 255) {
-    throw new TypeError("Alphabet too long");
+var Digest3 = class {
+  code;
+  size;
+  digest;
+  bytes;
+  /**
+   * Creates a multihash digest.
+   */
+  constructor(code22, size, digest, bytes) {
+    this.code = code22;
+    this.size = size;
+    this.digest = digest;
+    this.bytes = bytes;
   }
-  var BASE_MAP = new Uint8Array(256);
-  for (var j = 0; j < BASE_MAP.length; j++) {
-    BASE_MAP[j] = 255;
+};
+function format3(link2, base22) {
+  const { bytes, version: version2 } = link2;
+  switch (version2) {
+    case 0:
+      return toStringV03(bytes, baseCache3(link2), base22 ?? base58btc3.encoder);
+    default:
+      return toStringV13(bytes, baseCache3(link2), base22 ?? base323.encoder);
   }
-  for (var i = 0; i < ALPHABET.length; i++) {
-    var x = ALPHABET.charAt(i);
-    var xc = x.charCodeAt(0);
-    if (BASE_MAP[xc] !== 255) {
-      throw new TypeError(x + " is ambiguous");
-    }
-    BASE_MAP[xc] = i;
+}
+var cache3 = /* @__PURE__ */ new WeakMap();
+function baseCache3(cid) {
+  const baseCache22 = cache3.get(cid);
+  if (baseCache22 == null) {
+    const baseCache32 = /* @__PURE__ */ new Map();
+    cache3.set(cid, baseCache32);
+    return baseCache32;
   }
-  var BASE = ALPHABET.length;
-  var LEADER = ALPHABET.charAt(0);
-  var FACTOR = Math.log(BASE) / Math.log(256);
-  var iFACTOR = Math.log(256) / Math.log(BASE);
-  function encode32(source) {
-    if (source instanceof Uint8Array)
-      ;
-    else if (ArrayBuffer.isView(source)) {
-      source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
-    } else if (Array.isArray(source)) {
-      source = Uint8Array.from(source);
-    }
-    if (!(source instanceof Uint8Array)) {
-      throw new TypeError("Expected Uint8Array");
-    }
-    if (source.length === 0) {
-      return "";
-    }
-    var zeroes = 0;
-    var length22 = 0;
-    var pbegin = 0;
-    var pend = source.length;
-    while (pbegin !== pend && source[pbegin] === 0) {
-      pbegin++;
-      zeroes++;
-    }
-    var size = (pend - pbegin) * iFACTOR + 1 >>> 0;
-    var b58 = new Uint8Array(size);
-    while (pbegin !== pend) {
-      var carry = source[pbegin];
-      var i2 = 0;
-      for (var it1 = size - 1; (carry !== 0 || i2 < length22) && it1 !== -1; it1--, i2++) {
-        carry += 256 * b58[it1] >>> 0;
-        b58[it1] = carry % BASE >>> 0;
-        carry = carry / BASE >>> 0;
+  return baseCache22;
+}
+var CID3 = class _CID3 {
+  code;
+  version;
+  multihash;
+  bytes;
+  "/";
+  /**
+   * @param version - Version of the CID
+   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
+   * @param multihash - (Multi)hash of the of the content.
+   */
+  constructor(version2, code22, multihash, bytes) {
+    this.code = code22;
+    this.version = version2;
+    this.multihash = multihash;
+    this.bytes = bytes;
+    this["/"] = bytes;
+  }
+  /**
+   * Signalling `cid.asCID === cid` has been replaced with `cid['/'] === cid.bytes`
+   * please either use `CID.asCID(cid)` or switch to new signalling mechanism
+   *
+   * @deprecated
+   */
+  get asCID() {
+    return this;
+  }
+  // ArrayBufferView
+  get byteOffset() {
+    return this.bytes.byteOffset;
+  }
+  // ArrayBufferView
+  get byteLength() {
+    return this.bytes.byteLength;
+  }
+  toV0() {
+    switch (this.version) {
+      case 0: {
+        return this;
       }
-      if (carry !== 0) {
-        throw new Error("Non-zero carry");
+      case 1: {
+        const { code: code22, multihash } = this;
+        if (code22 !== DAG_PB_CODE3) {
+          throw new Error("Cannot convert a non dag-pb CID to CIDv0");
+        }
+        if (multihash.code !== SHA_256_CODE3) {
+          throw new Error("Cannot convert non sha2-256 multihash CID to CIDv0");
+        }
+        return _CID3.createV0(multihash);
+      }
+      default: {
+        throw Error(`Can not convert CID version ${this.version} to version 0. This is a bug please report`);
       }
-      length22 = i2;
-      pbegin++;
-    }
-    var it2 = size - length22;
-    while (it2 !== size && b58[it2] === 0) {
-      it2++;
-    }
-    var str = LEADER.repeat(zeroes);
-    for (; it2 < size; ++it2) {
-      str += ALPHABET.charAt(b58[it2]);
     }
-    return str;
   }
-  function decodeUnsafe(source) {
-    if (typeof source !== "string") {
-      throw new TypeError("Expected String");
-    }
-    if (source.length === 0) {
-      return new Uint8Array();
-    }
-    var psz = 0;
-    if (source[psz] === " ") {
-      return;
-    }
-    var zeroes = 0;
-    var length22 = 0;
-    while (source[psz] === LEADER) {
-      zeroes++;
-      psz++;
-    }
-    var size = (source.length - psz) * FACTOR + 1 >>> 0;
-    var b256 = new Uint8Array(size);
-    while (source[psz]) {
-      var carry = BASE_MAP[source.charCodeAt(psz)];
-      if (carry === 255) {
-        return;
+  toV1() {
+    switch (this.version) {
+      case 0: {
+        const { code: code22, digest } = this.multihash;
+        const multihash = create3(code22, digest);
+        return _CID3.createV1(this.code, multihash);
       }
-      var i2 = 0;
-      for (var it3 = size - 1; (carry !== 0 || i2 < length22) && it3 !== -1; it3--, i2++) {
-        carry += BASE * b256[it3] >>> 0;
-        b256[it3] = carry % 256 >>> 0;
-        carry = carry / 256 >>> 0;
+      case 1: {
+        return this;
       }
-      if (carry !== 0) {
-        throw new Error("Non-zero carry");
+      default: {
+        throw Error(`Can not convert CID version ${this.version} to version 1. This is a bug please report`);
       }
-      length22 = i2;
-      psz++;
-    }
-    if (source[psz] === " ") {
-      return;
     }
-    var it4 = size - length22;
-    while (it4 !== size && b256[it4] === 0) {
-      it4++;
-    }
-    var vch = new Uint8Array(zeroes + (size - it4));
-    var j2 = zeroes;
-    while (it4 !== size) {
-      vch[j2++] = b256[it4++];
-    }
-    return vch;
-  }
-  function decode52(string) {
-    var buffer = decodeUnsafe(string);
-    if (buffer) {
-      return buffer;
-    }
-    throw new Error(`Non-${name} character`);
-  }
-  return {
-    encode: encode32,
-    decodeUnsafe,
-    decode: decode52
-  };
-}
-var src3 = base3;
-var _brrp__multiformats_scope_baseX3 = src3;
-var base_x_default3 = _brrp__multiformats_scope_baseX3;
-var Encoder3 = class {
-  name;
-  prefix;
-  baseEncode;
-  constructor(name, prefix, baseEncode) {
-    this.name = name;
-    this.prefix = prefix;
-    this.baseEncode = baseEncode;
   }
-  encode(bytes) {
-    if (bytes instanceof Uint8Array) {
-      return `${this.prefix}${this.baseEncode(bytes)}`;
-    } else {
-      throw Error("Unknown type, must be binary type");
-    }
+  equals(other) {
+    return _CID3.equals(this, other);
   }
-};
-var Decoder3 = class {
-  name;
-  prefix;
-  baseDecode;
-  prefixCodePoint;
-  constructor(name, prefix, baseDecode) {
-    this.name = name;
-    this.prefix = prefix;
-    const prefixCodePoint = prefix.codePointAt(0);
-    if (prefixCodePoint === void 0) {
-      throw new Error("Invalid prefix character");
-    }
-    this.prefixCodePoint = prefixCodePoint;
-    this.baseDecode = baseDecode;
+  static equals(self, other) {
+    const unknown = other;
+    return unknown != null && self.code === unknown.code && self.version === unknown.version && equals22(self.multihash, unknown.multihash);
   }
-  decode(text) {
-    if (typeof text === "string") {
-      if (text.codePointAt(0) !== this.prefixCodePoint) {
-        throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`);
-      }
-      return this.baseDecode(text.slice(this.prefix.length));
-    } else {
-      throw Error("Can only multibase decode strings");
-    }
+  toString(base22) {
+    return format3(this, base22);
   }
-  or(decoder) {
-    return or3(this, decoder);
+  toJSON() {
+    return { "/": format3(this) };
   }
-};
-var ComposedDecoder3 = class {
-  decoders;
-  constructor(decoders) {
-    this.decoders = decoders;
+  link() {
+    return this;
   }
-  or(decoder) {
-    return or3(this, decoder);
+  [Symbol.toStringTag] = "CID";
+  // Legacy
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
+    return `CID(${this.toString()})`;
   }
-  decode(input) {
-    const prefix = input[0];
-    const decoder = this.decoders[prefix];
-    if (decoder != null) {
-      return decoder.decode(input);
-    } else {
-      throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`);
+  /**
+   * Takes any input `value` and returns a `CID` instance if it was
+   * a `CID` otherwise returns `null`. If `value` is instanceof `CID`
+   * it will return value back. If `value` is not instance of this CID
+   * class, but is compatible CID it will return new instance of this
+   * `CID` class. Otherwise returns null.
+   *
+   * This allows two different incompatible versions of CID library to
+   * co-exist and interop as long as binary interface is compatible.
+   */
+  static asCID(input) {
+    if (input == null) {
+      return null;
+    }
+    const value = input;
+    if (value instanceof _CID3) {
+      return value;
+    } else if (value["/"] != null && value["/"] === value.bytes || value.asCID === value) {
+      const { version: version2, code: code22, multihash, bytes } = value;
+      return new _CID3(version2, code22, multihash, bytes ?? encodeCID3(version2, code22, multihash.bytes));
+    } else if (value[cidSymbol3] === true) {
+      const { version: version2, multihash, code: code22 } = value;
+      const digest = decode42(multihash);
+      return _CID3.create(version2, code22, digest);
+    } else {
+      return null;
     }
   }
-};
-function or3(left, right) {
-  return new ComposedDecoder3({
-    ...left.decoders ?? { [left.prefix]: left },
-    ...right.decoders ?? { [right.prefix]: right }
-  });
-}
-var Codec3 = class {
-  name;
-  prefix;
-  baseEncode;
-  baseDecode;
-  encoder;
-  decoder;
-  constructor(name, prefix, baseEncode, baseDecode) {
-    this.name = name;
-    this.prefix = prefix;
-    this.baseEncode = baseEncode;
-    this.baseDecode = baseDecode;
-    this.encoder = new Encoder3(name, prefix, baseEncode);
-    this.decoder = new Decoder3(name, prefix, baseDecode);
-  }
-  encode(input) {
-    return this.encoder.encode(input);
+  /**
+   * @param version - Version of the CID
+   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
+   * @param digest - (Multi)hash of the of the content.
+   */
+  static create(version2, code22, digest) {
+    if (typeof code22 !== "number") {
+      throw new Error("String codecs are no longer supported");
+    }
+    if (!(digest.bytes instanceof Uint8Array)) {
+      throw new Error("Invalid digest");
+    }
+    switch (version2) {
+      case 0: {
+        if (code22 !== DAG_PB_CODE3) {
+          throw new Error(`Version 0 CID must use dag-pb (code: ${DAG_PB_CODE3}) block encoding`);
+        } else {
+          return new _CID3(version2, code22, digest, digest.bytes);
+        }
+      }
+      case 1: {
+        const bytes = encodeCID3(version2, code22, digest.bytes);
+        return new _CID3(version2, code22, digest, bytes);
+      }
+      default: {
+        throw new Error("Invalid version");
+      }
+    }
   }
-  decode(input) {
-    return this.decoder.decode(input);
+  /**
+   * Simplified version of `create` for CIDv0.
+   */
+  static createV0(digest) {
+    return _CID3.create(0, DAG_PB_CODE3, digest);
   }
-};
-function from3({ name, prefix, encode: encode32, decode: decode52 }) {
-  return new Codec3(name, prefix, encode32, decode52);
-}
-function baseX3({ name, prefix, alphabet }) {
-  const { encode: encode32, decode: decode52 } = base_x_default3(alphabet, name);
-  return from3({
-    prefix,
-    name,
-    encode: encode32,
-    decode: (text) => coerce5(decode52(text))
-  });
-}
-function decode9(string, alphabetIdx, bitsPerChar, name) {
-  let end = string.length;
-  while (string[end - 1] === "=") {
-    --end;
+  /**
+   * Simplified version of `create` for CIDv1.
+   *
+   * @param code - Content encoding format code.
+   * @param digest - Multihash of the content.
+   */
+  static createV1(code22, digest) {
+    return _CID3.create(1, code22, digest);
   }
-  const out = new Uint8Array(end * bitsPerChar / 8 | 0);
-  let bits = 0;
-  let buffer = 0;
-  let written = 0;
-  for (let i = 0; i < end; ++i) {
-    const value = alphabetIdx[string[i]];
-    if (value === void 0) {
-      throw new SyntaxError(`Non-${name} character`);
-    }
-    buffer = buffer << bitsPerChar | value;
-    bits += bitsPerChar;
-    if (bits >= 8) {
-      bits -= 8;
-      out[written++] = 255 & buffer >> bits;
+  /**
+   * Decoded a CID from its binary representation. The byte array must contain
+   * only the CID with no additional bytes.
+   *
+   * An error will be thrown if the bytes provided do not contain a valid
+   * binary representation of a CID.
+   */
+  static decode(bytes) {
+    const [cid, remainder] = _CID3.decodeFirst(bytes);
+    if (remainder.length !== 0) {
+      throw new Error("Incorrect length");
     }
+    return cid;
   }
-  if (bits >= bitsPerChar || (255 & buffer << 8 - bits) !== 0) {
-    throw new SyntaxError("Unexpected end of data");
+  /**
+   * Decoded a CID from its binary representation at the beginning of a byte
+   * array.
+   *
+   * Returns an array with the first element containing the CID and the second
+   * element containing the remainder of the original byte array. The remainder
+   * will be a zero-length byte array if the provided bytes only contained a
+   * binary CID representation.
+   */
+  static decodeFirst(bytes) {
+    const specs = _CID3.inspectBytes(bytes);
+    const prefixSize = specs.size - specs.multihashSize;
+    const multihashBytes = coerce5(bytes.subarray(prefixSize, prefixSize + specs.multihashSize));
+    if (multihashBytes.byteLength !== specs.multihashSize) {
+      throw new Error("Incorrect length");
+    }
+    const digestBytes = multihashBytes.subarray(specs.multihashSize - specs.digestSize);
+    const digest = new Digest3(specs.multihashCode, specs.digestSize, digestBytes, multihashBytes);
+    const cid = specs.version === 0 ? _CID3.createV0(digest) : _CID3.createV1(specs.codec, digest);
+    return [cid, bytes.subarray(specs.size)];
   }
-  return out;
-}
-function encode5(data, alphabet, bitsPerChar) {
-  const pad = alphabet[alphabet.length - 1] === "=";
-  const mask = (1 << bitsPerChar) - 1;
-  let out = "";
-  let bits = 0;
-  let buffer = 0;
-  for (let i = 0; i < data.length; ++i) {
-    buffer = buffer << 8 | data[i];
-    bits += 8;
-    while (bits > bitsPerChar) {
-      bits -= bitsPerChar;
-      out += alphabet[mask & buffer >> bits];
+  /**
+   * Inspect the initial bytes of a CID to determine its properties.
+   *
+   * Involves decoding up to 4 varints. Typically this will require only 4 to 6
+   * bytes but for larger multicodec code values and larger multihash digest
+   * lengths these varints can be quite large. It is recommended that at least
+   * 10 bytes be made available in the `initialBytes` argument for a complete
+   * inspection.
+   */
+  static inspectBytes(initialBytes) {
+    let offset = 0;
+    const next = () => {
+      const [i, length22] = decode32(initialBytes.subarray(offset));
+      offset += length22;
+      return i;
+    };
+    let version2 = next();
+    let codec = DAG_PB_CODE3;
+    if (version2 === 18) {
+      version2 = 0;
+      offset = 0;
+    } else {
+      codec = next();
+    }
+    if (version2 !== 0 && version2 !== 1) {
+      throw new RangeError(`Invalid CID version ${version2}`);
     }
+    const prefixSize = offset;
+    const multihashCode = next();
+    const digestSize = next();
+    const size = offset + digestSize;
+    const multihashSize = size - prefixSize;
+    return { version: version2, codec, multihashCode, digestSize, multihashSize, size };
   }
-  if (bits !== 0) {
-    out += alphabet[mask & buffer << bitsPerChar - bits];
+  /**
+   * Takes cid in a string representation and creates an instance. If `base`
+   * decoder is not provided will use a default from the configuration. It will
+   * throw an error if encoding of the CID is not compatible with supplied (or
+   * a default decoder).
+   */
+  static parse(source, base22) {
+    const [prefix, bytes] = parseCIDtoBytes3(source, base22);
+    const cid = _CID3.decode(bytes);
+    if (cid.version === 0 && source[0] !== "Q") {
+      throw Error("Version 0 CID string must not include multibase prefix");
+    }
+    baseCache3(cid).set(prefix, source);
+    return cid;
   }
-  if (pad) {
-    while ((out.length * bitsPerChar & 7) !== 0) {
-      out += "=";
+};
+function parseCIDtoBytes3(source, base22) {
+  switch (source[0]) {
+    // CIDv0 is parsed differently
+    case "Q": {
+      const decoder = base22 ?? base58btc3;
+      return [
+        base58btc3.prefix,
+        decoder.decode(`${base58btc3.prefix}${source}`)
+      ];
+    }
+    case base58btc3.prefix: {
+      const decoder = base22 ?? base58btc3;
+      return [base58btc3.prefix, decoder.decode(source)];
+    }
+    case base323.prefix: {
+      const decoder = base22 ?? base323;
+      return [base323.prefix, decoder.decode(source)];
+    }
+    case base363.prefix: {
+      const decoder = base22 ?? base363;
+      return [base363.prefix, decoder.decode(source)];
+    }
+    default: {
+      if (base22 == null) {
+        throw Error("To parse non base32, base36 or base58btc encoded CID multibase decoder must be provided");
+      }
+      return [source[0], base22.decode(source)];
     }
   }
-  return out;
 }
-function createAlphabetIdx3(alphabet) {
-  const alphabetIdx = {};
-  for (let i = 0; i < alphabet.length; ++i) {
-    alphabetIdx[alphabet[i]] = i;
+function toStringV03(bytes, cache22, base22) {
+  const { prefix } = base22;
+  if (prefix !== base58btc3.prefix) {
+    throw Error(`Cannot string encode V0 in ${base22.name} encoding`);
+  }
+  const cid = cache22.get(prefix);
+  if (cid == null) {
+    const cid2 = base22.encode(bytes).slice(1);
+    cache22.set(prefix, cid2);
+    return cid2;
+  } else {
+    return cid;
   }
-  return alphabetIdx;
 }
-function rfc46483({ name, prefix, bitsPerChar, alphabet }) {
-  const alphabetIdx = createAlphabetIdx3(alphabet);
-  return from3({
-    prefix,
-    name,
-    encode(input) {
-      return encode5(input, alphabet, bitsPerChar);
-    },
-    decode(input) {
-      return decode9(input, alphabetIdx, bitsPerChar, name);
-    }
-  });
+function toStringV13(bytes, cache22, base22) {
+  const { prefix } = base22;
+  const cid = cache22.get(prefix);
+  if (cid == null) {
+    const cid2 = base22.encode(bytes);
+    cache22.set(prefix, cid2);
+    return cid2;
+  } else {
+    return cid;
+  }
 }
-var base323 = rfc46483({
-  prefix: "b",
-  name: "base32",
-  alphabet: "abcdefghijklmnopqrstuvwxyz234567",
-  bitsPerChar: 5
-});
-var base32upper3 = rfc46483({
-  prefix: "B",
-  name: "base32upper",
-  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",
-  bitsPerChar: 5
-});
-var base32pad3 = rfc46483({
-  prefix: "c",
-  name: "base32pad",
-  alphabet: "abcdefghijklmnopqrstuvwxyz234567=",
-  bitsPerChar: 5
-});
-var base32padupper3 = rfc46483({
-  prefix: "C",
-  name: "base32padupper",
-  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=",
-  bitsPerChar: 5
-});
-var base32hex3 = rfc46483({
-  prefix: "v",
-  name: "base32hex",
-  alphabet: "0123456789abcdefghijklmnopqrstuv",
-  bitsPerChar: 5
-});
-var base32hexupper3 = rfc46483({
-  prefix: "V",
-  name: "base32hexupper",
-  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUV",
-  bitsPerChar: 5
-});
-var base32hexpad3 = rfc46483({
-  prefix: "t",
-  name: "base32hexpad",
-  alphabet: "0123456789abcdefghijklmnopqrstuv=",
-  bitsPerChar: 5
-});
-var base32hexpadupper3 = rfc46483({
-  prefix: "T",
-  name: "base32hexpadupper",
-  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUV=",
-  bitsPerChar: 5
-});
-var base32z3 = rfc46483({
-  prefix: "h",
-  name: "base32z",
-  alphabet: "ybndrfg8ejkmcpqxot1uwisza345h769",
-  bitsPerChar: 5
-});
-var base363 = baseX3({
-  prefix: "k",
-  name: "base36",
-  alphabet: "0123456789abcdefghijklmnopqrstuvwxyz"
+var DAG_PB_CODE3 = 112;
+var SHA_256_CODE3 = 18;
+function encodeCID3(version2, code22, multihash) {
+  const codeOffset = encodingLength3(version2);
+  const hashOffset = codeOffset + encodingLength3(code22);
+  const bytes = new Uint8Array(hashOffset + multihash.byteLength);
+  encodeTo3(version2, bytes, 0);
+  encodeTo3(code22, bytes, codeOffset);
+  bytes.set(multihash, hashOffset);
+  return bytes;
+}
+var cidSymbol3 = /* @__PURE__ */ Symbol.for("@ipld/js-cid/CID");
+var code2 = 85;
+var SHA256_CODE2 = 18;
+function isCanonicalRawCid2(cidString) {
+  let cid;
+  try {
+    cid = CID3.parse(cidString);
+  } catch {
+    return false;
+  }
+  return cid.version === 1 && cid.code === code2 && cid.multihash.code === SHA256_CODE2 && cid.toString() === cidString;
+}
+var base642 = rfc46483({
+  prefix: "m",
+  name: "base64",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
+  bitsPerChar: 6
 });
-var base36upper3 = baseX3({
-  prefix: "K",
-  name: "base36upper",
-  alphabet: "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+var base64pad2 = rfc46483({
+  prefix: "M",
+  name: "base64pad",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
+  bitsPerChar: 6
 });
-var base58btc3 = baseX3({
-  name: "base58btc",
-  prefix: "z",
-  alphabet: "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+var base64url2 = rfc46483({
+  prefix: "u",
+  name: "base64url",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_",
+  bitsPerChar: 6
 });
-var base58flickr3 = baseX3({
-  name: "base58flickr",
-  prefix: "Z",
-  alphabet: "123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ"
+var base64urlpad2 = rfc46483({
+  prefix: "U",
+  name: "base64urlpad",
+  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_=",
+  bitsPerChar: 6
 });
-var encode_13 = encode22;
-var MSB3 = 128;
-var REST3 = 127;
-var MSBALL3 = ~REST3;
-var INT3 = Math.pow(2, 31);
-function encode22(num, out, offset) {
-  out = out || [];
-  offset = offset || 0;
-  var oldOffset = offset;
-  while (num >= INT3) {
-    out[offset++] = num & 255 | MSB3;
-    num /= 128;
-  }
-  while (num & MSBALL3) {
-    out[offset++] = num & 255 | MSB3;
-    num >>>= 7;
+function fromBase64Url2(text) {
+  const bytes = base64url2.baseDecode(text);
+  if (base64url2.baseEncode(bytes) !== text) {
+    throw new TypeError("non-canonical base64url input");
   }
-  out[offset] = num | 0;
-  encode22.bytes = offset - oldOffset + 1;
-  return out;
-}
-var decode22 = read3;
-var MSB$13 = 128;
-var REST$13 = 127;
-function read3(buf, offset) {
-  var res = 0, offset = offset || 0, shift = 0, counter = offset, b, l = buf.length;
-  do {
-    if (counter >= l) {
-      read3.bytes = 0;
-      throw new RangeError("Could not decode varint");
-    }
-    b = buf[counter++];
-    res += shift < 28 ? (b & REST$13) << shift : (b & REST$13) * Math.pow(2, shift);
-    shift += 7;
-  } while (b >= MSB$13);
-  read3.bytes = counter - offset;
-  return res;
-}
-var N13 = Math.pow(2, 7);
-var N23 = Math.pow(2, 14);
-var N33 = Math.pow(2, 21);
-var N43 = Math.pow(2, 28);
-var N53 = Math.pow(2, 35);
-var N63 = Math.pow(2, 42);
-var N73 = Math.pow(2, 49);
-var N83 = Math.pow(2, 56);
-var N93 = Math.pow(2, 63);
-var length3 = function(value) {
-  return value < N13 ? 1 : value < N23 ? 2 : value < N33 ? 3 : value < N43 ? 4 : value < N53 ? 5 : value < N63 ? 6 : value < N73 ? 7 : value < N83 ? 8 : value < N93 ? 9 : 10;
-};
-var varint3 = {
-  encode: encode_13,
-  decode: decode22,
-  encodingLength: length3
-};
-var _brrp_varint3 = varint3;
-var varint_default3 = _brrp_varint3;
-function decode32(data, offset = 0) {
-  const code22 = varint_default3.decode(data, offset);
-  return [code22, varint_default3.decode.bytes];
-}
-function encodeTo3(int, target, offset = 0) {
-  varint_default3.encode(int, target, offset);
-  return target;
+  return bytes;
 }
-function encodingLength3(int) {
-  return varint_default3.encodingLength(int);
+function utf8Bytes2(text) {
+  return new TextEncoder().encode(text);
 }
-function create3(code22, digest) {
-  const size = digest.byteLength;
-  const sizeOffset = encodingLength3(code22);
-  const digestOffset = sizeOffset + encodingLength3(size);
-  const bytes = new Uint8Array(digestOffset + size);
-  encodeTo3(code22, bytes, 0);
-  encodeTo3(size, bytes, sizeOffset);
-  bytes.set(digest, digestOffset);
-  return new Digest3(code22, size, digest, bytes);
+var ED25519_MULTICODEC_PREFIX2 = Uint8Array.of(237, 1);
+function decodeBase64UrlOrNull2(value) {
+  try {
+    return fromBase64Url2(value);
+  } catch {
+    return null;
+  }
 }
-function decode42(multihash) {
-  const bytes = coerce5(multihash);
-  const [code22, sizeOffset] = decode32(bytes);
-  const [size, digestOffset] = decode32(bytes.subarray(sizeOffset));
-  const digest = bytes.subarray(sizeOffset + digestOffset);
-  if (digest.byteLength !== size) {
-    throw new Error("Incorrect length");
+var base64UrlString2 = () => external_exports2.string().refine((value) => decodeBase64UrlOrNull2(value) !== null, {
+  message: "expected strictly-decodable unpadded base64url"
+});
+function isCanonicalHttpsOrigin2(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
   }
-  return new Digest3(code22, size, digest, bytes);
+  return url.protocol === "https:" && url.origin === value;
 }
-function equals22(a, b) {
-  if (a === b) {
-    return true;
-  } else {
-    const data = b;
-    return a.code === data.code && a.size === data.size && data.bytes instanceof Uint8Array && equals5(a.bytes, data.bytes);
-  }
-}
-var Digest3 = class {
-  code;
-  size;
-  digest;
-  bytes;
-  /**
-   * Creates a multihash digest.
-   */
-  constructor(code22, size, digest, bytes) {
-    this.code = code22;
-    this.size = size;
-    this.digest = digest;
-    this.bytes = bytes;
-  }
+var sessionJwkCommonFields2 = {
+  alg: external_exports2.string().min(1).optional(),
+  use: external_exports2.string().min(1).optional(),
+  key_ops: external_exports2.array(external_exports2.string().min(1)).optional(),
+  kid: external_exports2.string().min(1).optional(),
+  ext: external_exports2.boolean().optional()
 };
-function format3(link2, base22) {
-  const { bytes, version: version2 } = link2;
-  switch (version2) {
-    case 0:
-      return toStringV03(bytes, baseCache3(link2), base22 ?? base58btc3.encoder);
-    default:
-      return toStringV13(bytes, baseCache3(link2), base22 ?? base323.encoder);
-  }
+var okpPrivateJwkSchema2 = external_exports2.object({
+  kty: external_exports2.literal("OKP"),
+  crv: external_exports2.string().min(1),
+  x: base64UrlString2(),
+  d: base64UrlString2(),
+  ...sessionJwkCommonFields2
+}).strict();
+var ecPrivateJwkSchema2 = external_exports2.object({
+  kty: external_exports2.literal("EC"),
+  crv: external_exports2.string().min(1),
+  x: base64UrlString2(),
+  y: base64UrlString2(),
+  d: base64UrlString2(),
+  ...sessionJwkCommonFields2
+}).strict();
+var sessionJwkSchema2 = external_exports2.discriminatedUnion("kty", [
+  okpPrivateJwkSchema2,
+  ecPrivateJwkSchema2
+]);
+var policyTargetSchema2 = external_exports2.object({
+  kind: external_exports2.literal("policy"),
+  policyCid: external_exports2.string().min(1),
+  /** Canonical policy bytes, base64url-encoded (bytes are not JSON). */
+  policyBytes: base64UrlString2()
+}).strict();
+var bearerKeyTargetSchema2 = external_exports2.object({
+  kind: external_exports2.literal("bearerKey"),
+  sessionJwk: sessionJwkSchema2
+}).strict();
+var recipientDidTargetSchema2 = external_exports2.object({
+  kind: external_exports2.literal("recipientDid"),
+  did: external_exports2.string().regex(/^did:[a-z0-9]+:.+$/, "expected a DID")
+}).strict();
+var authorizationTargetSchema2 = external_exports2.discriminatedUnion("kind", [
+  policyTargetSchema2,
+  bearerKeyTargetSchema2,
+  recipientDidTargetSchema2
+]);
+function isCanonicalResourcePath2(value) {
+  if (value.length === 0) return false;
+  if (/[\u0000-\u001f\u007f\\]/.test(value)) return false;
+  if (/%2f|%5c|%2e/i.test(value)) return false;
+  return value.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
 }
-var cache3 = /* @__PURE__ */ new WeakMap();
-function baseCache3(cid) {
-  const baseCache22 = cache3.get(cid);
-  if (baseCache22 == null) {
-    const baseCache32 = /* @__PURE__ */ new Map();
-    cache3.set(cid, baseCache32);
-    return baseCache32;
-  }
-  return baseCache22;
+function isCanonicalPathSegment2(value) {
+  return isCanonicalResourcePath2(value) && !value.includes("/");
 }
-var CID3 = class _CID3 {
-  code;
-  version;
-  multihash;
-  bytes;
-  "/";
-  /**
-   * @param version - Version of the CID
-   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
-   * @param multihash - (Multi)hash of the of the content.
-   */
-  constructor(version2, code22, multihash, bytes) {
-    this.code = code22;
-    this.version = version2;
-    this.multihash = multihash;
-    this.bytes = bytes;
-    this["/"] = bytes;
-  }
-  /**
-   * Signalling `cid.asCID === cid` has been replaced with `cid['/'] === cid.bytes`
-   * please either use `CID.asCID(cid)` or switch to new signalling mechanism
-   *
-   * @deprecated
-   */
-  get asCID() {
-    return this;
-  }
-  // ArrayBufferView
-  get byteOffset() {
-    return this.bytes.byteOffset;
-  }
-  // ArrayBufferView
-  get byteLength() {
-    return this.bytes.byteLength;
-  }
-  toV0() {
-    switch (this.version) {
-      case 0: {
-        return this;
-      }
-      case 1: {
-        const { code: code22, multihash } = this;
-        if (code22 !== DAG_PB_CODE3) {
-          throw new Error("Cannot convert a non dag-pb CID to CIDv0");
-        }
-        if (multihash.code !== SHA_256_CODE3) {
-          throw new Error("Cannot convert non sha2-256 multihash CID to CIDv0");
-        }
-        return _CID3.createV0(multihash);
-      }
-      default: {
-        throw Error(`Can not convert CID version ${this.version} to version 0. This is a bug please report`);
-      }
-    }
-  }
-  toV1() {
-    switch (this.version) {
-      case 0: {
-        const { code: code22, digest } = this.multihash;
-        const multihash = create3(code22, digest);
-        return _CID3.createV1(this.code, multihash);
-      }
-      case 1: {
-        return this;
-      }
-      default: {
-        throw Error(`Can not convert CID version ${this.version} to version 1. This is a bug please report`);
-      }
-    }
-  }
-  equals(other) {
-    return _CID3.equals(this, other);
-  }
-  static equals(self, other) {
-    const unknown = other;
-    return unknown != null && self.code === unknown.code && self.version === unknown.version && equals22(self.multihash, unknown.multihash);
-  }
-  toString(base22) {
-    return format3(this, base22);
-  }
-  toJSON() {
-    return { "/": format3(this) };
-  }
-  link() {
-    return this;
-  }
-  [Symbol.toStringTag] = "CID";
-  // Legacy
-  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
-    return `CID(${this.toString()})`;
-  }
-  /**
-   * Takes any input `value` and returns a `CID` instance if it was
-   * a `CID` otherwise returns `null`. If `value` is instanceof `CID`
-   * it will return value back. If `value` is not instance of this CID
-   * class, but is compatible CID it will return new instance of this
-   * `CID` class. Otherwise returns null.
-   *
-   * This allows two different incompatible versions of CID library to
-   * co-exist and interop as long as binary interface is compatible.
-   */
-  static asCID(input) {
-    if (input == null) {
-      return null;
-    }
-    const value = input;
-    if (value instanceof _CID3) {
-      return value;
-    } else if (value["/"] != null && value["/"] === value.bytes || value.asCID === value) {
-      const { version: version2, code: code22, multihash, bytes } = value;
-      return new _CID3(version2, code22, multihash, bytes ?? encodeCID3(version2, code22, multihash.bytes));
-    } else if (value[cidSymbol3] === true) {
-      const { version: version2, multihash, code: code22 } = value;
-      const digest = decode42(multihash);
-      return _CID3.create(version2, code22, digest);
-    } else {
-      return null;
-    }
+var resourceSelectorSchema2 = external_exports2.object({
+  kind: external_exports2.union([external_exports2.literal("exact"), external_exports2.literal("prefix")]),
+  path: external_exports2.string().min(1)
+}).strict().superRefine((selector, ctx) => {
+  const body = selector.kind === "prefix" && selector.path.endsWith("/") ? selector.path.slice(0, -1) : selector.path;
+  if (!isCanonicalResourcePath2(body)) {
+    ctx.addIssue({
+      code: external_exports2.ZodIssueCode.custom,
+      path: ["path"],
+      message: "expected a canonical resource path (non-empty segments, no . or .. segments, no //, no backslash, no %2f/%5c/%2e, no control chars)"
+    });
   }
+});
+var targetSchema2 = external_exports2.object({
+  origin: external_exports2.string().refine(isCanonicalHttpsOrigin2, {
+    message: "expected a canonical https origin (https://host[:port], nothing else)"
+  }),
+  nodeAudience: external_exports2.string().min(1),
+  spaceId: external_exports2.string().refine(isCanonicalPathSegment2, {
+    message: "expected a single canonical path segment (spaceId joins the resource URI; separators/traversal would alias grants)"
+  }),
+  resource: resourceSelectorSchema2
+}).strict();
+var displaySchema2 = external_exports2.object({
+  senderName: external_exports2.string().optional(),
+  filename: external_exports2.string().optional(),
+  recipientHint: external_exports2.string().optional(),
   /**
-   * @param version - Version of the CID
-   * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
-   * @param digest - (Multi)hash of the of the content.
-   */
-  static create(version2, code22, digest) {
-    if (typeof code22 !== "number") {
-      throw new Error("String codecs are no longer supported");
-    }
-    if (!(digest.bytes instanceof Uint8Array)) {
-      throw new Error("Invalid digest");
-    }
-    switch (version2) {
-      case 0: {
-        if (code22 !== DAG_PB_CODE3) {
-          throw new Error(`Version 0 CID must use dag-pb (code: ${DAG_PB_CODE3}) block encoding`);
-        } else {
-          return new _CID3(version2, code22, digest, digest.bytes);
-        }
-      }
-      case 1: {
-        const bytes = encodeCID3(version2, code22, digest.bytes);
-        return new _CID3(version2, code22, digest, bytes);
-      }
-      default: {
-        throw new Error("Invalid version");
-      }
-    }
-  }
-  /**
-   * Simplified version of `create` for CIDv0.
-   */
-  static createV0(digest) {
-    return _CID3.create(0, DAG_PB_CODE3, digest);
-  }
-  /**
-   * Simplified version of `create` for CIDv1.
-   *
-   * @param code - Content encoding format code.
-   * @param digest - Multihash of the content.
-   */
-  static createV1(code22, digest) {
-    return _CID3.create(1, code22, digest);
-  }
-  /**
-   * Decoded a CID from its binary representation. The byte array must contain
-   * only the CID with no additional bytes.
-   *
-   * An error will be thrown if the bytes provided do not contain a valid
-   * binary representation of a CID.
-   */
-  static decode(bytes) {
-    const [cid, remainder] = _CID3.decodeFirst(bytes);
-    if (remainder.length !== 0) {
-      throw new Error("Incorrect length");
-    }
-    return cid;
-  }
-  /**
-   * Decoded a CID from its binary representation at the beginning of a byte
-   * array.
-   *
-   * Returns an array with the first element containing the CID and the second
-   * element containing the remainder of the original byte array. The remainder
-   * will be a zero-length byte array if the provided bytes only contained a
-   * binary CID representation.
-   */
-  static decodeFirst(bytes) {
-    const specs = _CID3.inspectBytes(bytes);
-    const prefixSize = specs.size - specs.multihashSize;
-    const multihashBytes = coerce5(bytes.subarray(prefixSize, prefixSize + specs.multihashSize));
-    if (multihashBytes.byteLength !== specs.multihashSize) {
-      throw new Error("Incorrect length");
-    }
-    const digestBytes = multihashBytes.subarray(specs.multihashSize - specs.digestSize);
-    const digest = new Digest3(specs.multihashCode, specs.digestSize, digestBytes, multihashBytes);
-    const cid = specs.version === 0 ? _CID3.createV0(digest) : _CID3.createV1(specs.codec, digest);
-    return [cid, bytes.subarray(specs.size)];
-  }
-  /**
-   * Inspect the initial bytes of a CID to determine its properties.
-   *
-   * Involves decoding up to 4 varints. Typically this will require only 4 to 6
-   * bytes but for larger multicodec code values and larger multihash digest
-   * lengths these varints can be quite large. It is recommended that at least
-   * 10 bytes be made available in the `initialBytes` argument for a complete
-   * inspection.
-   */
-  static inspectBytes(initialBytes) {
-    let offset = 0;
-    const next = () => {
-      const [i, length22] = decode32(initialBytes.subarray(offset));
-      offset += length22;
-      return i;
-    };
-    let version2 = next();
-    let codec = DAG_PB_CODE3;
-    if (version2 === 18) {
-      version2 = 0;
-      offset = 0;
-    } else {
-      codec = next();
-    }
-    if (version2 !== 0 && version2 !== 1) {
-      throw new RangeError(`Invalid CID version ${version2}`);
-    }
-    const prefixSize = offset;
-    const multihashCode = next();
-    const digestSize = next();
-    const size = offset + digestSize;
-    const multihashSize = size - prefixSize;
-    return { version: version2, codec, multihashCode, digestSize, multihashSize, size };
-  }
-  /**
-   * Takes cid in a string representation and creates an instance. If `base`
-   * decoder is not provided will use a default from the configuration. It will
-   * throw an error if encoding of the CID is not compatible with supplied (or
-   * a default decoder).
-   */
-  static parse(source, base22) {
-    const [prefix, bytes] = parseCIDtoBytes3(source, base22);
-    const cid = _CID3.decode(bytes);
-    if (cid.version === 0 && source[0] !== "Q") {
-      throw Error("Version 0 CID string must not include multibase prefix");
-    }
-    baseCache3(cid).set(prefix, source);
-    return cid;
-  }
-};
-function parseCIDtoBytes3(source, base22) {
-  switch (source[0]) {
-    // CIDv0 is parsed differently
-    case "Q": {
-      const decoder = base22 ?? base58btc3;
-      return [
-        base58btc3.prefix,
-        decoder.decode(`${base58btc3.prefix}${source}`)
-      ];
-    }
-    case base58btc3.prefix: {
-      const decoder = base22 ?? base58btc3;
-      return [base58btc3.prefix, decoder.decode(source)];
-    }
-    case base323.prefix: {
-      const decoder = base22 ?? base323;
-      return [base323.prefix, decoder.decode(source)];
-    }
-    case base363.prefix: {
-      const decoder = base22 ?? base363;
-      return [base363.prefix, decoder.decode(source)];
-    }
-    default: {
-      if (base22 == null) {
-        throw Error("To parse non base32, base36 or base58btc encoded CID multibase decoder must be provided");
-      }
-      return [source[0], base22.decode(source)];
-    }
-  }
-}
-function toStringV03(bytes, cache22, base22) {
-  const { prefix } = base22;
-  if (prefix !== base58btc3.prefix) {
-    throw Error(`Cannot string encode V0 in ${base22.name} encoding`);
-  }
-  const cid = cache22.get(prefix);
-  if (cid == null) {
-    const cid2 = base22.encode(bytes).slice(1);
-    cache22.set(prefix, cid2);
-    return cid2;
-  } else {
-    return cid;
-  }
-}
-function toStringV13(bytes, cache22, base22) {
-  const { prefix } = base22;
-  const cid = cache22.get(prefix);
-  if (cid == null) {
-    const cid2 = base22.encode(bytes);
-    cache22.set(prefix, cid2);
-    return cid2;
-  } else {
-    return cid;
-  }
-}
-var DAG_PB_CODE3 = 112;
-var SHA_256_CODE3 = 18;
-function encodeCID3(version2, code22, multihash) {
-  const codeOffset = encodingLength3(version2);
-  const hashOffset = codeOffset + encodingLength3(code22);
-  const bytes = new Uint8Array(hashOffset + multihash.byteLength);
-  encodeTo3(version2, bytes, 0);
-  encodeTo3(code22, bytes, codeOffset);
-  bytes.set(multihash, hashOffset);
-  return bytes;
-}
-var cidSymbol3 = /* @__PURE__ */ Symbol.for("@ipld/js-cid/CID");
-var code2 = 85;
-var SHA256_CODE2 = 18;
-function isCanonicalRawCid2(cidString) {
-  let cid;
-  try {
-    cid = CID3.parse(cidString);
-  } catch {
-    return false;
-  }
-  return cid.version === 1 && cid.code === code2 && cid.multihash.code === SHA256_CODE2 && cid.toString() === cidString;
-}
-var base642 = rfc46483({
-  prefix: "m",
-  name: "base64",
-  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
-  bitsPerChar: 6
-});
-var base64pad2 = rfc46483({
-  prefix: "M",
-  name: "base64pad",
-  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
-  bitsPerChar: 6
-});
-var base64url2 = rfc46483({
-  prefix: "u",
-  name: "base64url",
-  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_",
-  bitsPerChar: 6
-});
-var base64urlpad2 = rfc46483({
-  prefix: "U",
-  name: "base64urlpad",
-  alphabet: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_=",
-  bitsPerChar: 6
-});
-function fromBase64Url2(text) {
-  const bytes = base64url2.baseDecode(text);
-  if (base64url2.baseEncode(bytes) !== text) {
-    throw new TypeError("non-canonical base64url input");
-  }
-  return bytes;
-}
-function utf8Bytes2(text) {
-  return new TextEncoder().encode(text);
-}
-var ED25519_MULTICODEC_PREFIX2 = Uint8Array.of(237, 1);
-function decodeBase64UrlOrNull2(value) {
-  try {
-    return fromBase64Url2(value);
-  } catch {
-    return null;
-  }
-}
-var base64UrlString2 = () => external_exports2.string().refine((value) => decodeBase64UrlOrNull2(value) !== null, {
-  message: "expected strictly-decodable unpadded base64url"
-});
-function isCanonicalHttpsOrigin2(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  return url.protocol === "https:" && url.origin === value;
-}
-var sessionJwkCommonFields2 = {
-  alg: external_exports2.string().min(1).optional(),
-  use: external_exports2.string().min(1).optional(),
-  key_ops: external_exports2.array(external_exports2.string().min(1)).optional(),
-  kid: external_exports2.string().min(1).optional(),
-  ext: external_exports2.boolean().optional()
-};
-var okpPrivateJwkSchema2 = external_exports2.object({
-  kty: external_exports2.literal("OKP"),
-  crv: external_exports2.string().min(1),
-  x: base64UrlString2(),
-  d: base64UrlString2(),
-  ...sessionJwkCommonFields2
-}).strict();
-var ecPrivateJwkSchema2 = external_exports2.object({
-  kty: external_exports2.literal("EC"),
-  crv: external_exports2.string().min(1),
-  x: base64UrlString2(),
-  y: base64UrlString2(),
-  d: base64UrlString2(),
-  ...sessionJwkCommonFields2
-}).strict();
-var sessionJwkSchema2 = external_exports2.discriminatedUnion("kty", [
-  okpPrivateJwkSchema2,
-  ecPrivateJwkSchema2
-]);
-var policyTargetSchema2 = external_exports2.object({
-  kind: external_exports2.literal("policy"),
-  policyCid: external_exports2.string().min(1),
-  /** Canonical policy bytes, base64url-encoded (bytes are not JSON). */
-  policyBytes: base64UrlString2()
-}).strict();
-var bearerKeyTargetSchema2 = external_exports2.object({
-  kind: external_exports2.literal("bearerKey"),
-  sessionJwk: sessionJwkSchema2
-}).strict();
-var recipientDidTargetSchema2 = external_exports2.object({
-  kind: external_exports2.literal("recipientDid"),
-  did: external_exports2.string().regex(/^did:[a-z0-9]+:.+$/, "expected a DID")
-}).strict();
-var authorizationTargetSchema2 = external_exports2.discriminatedUnion("kind", [
-  policyTargetSchema2,
-  bearerKeyTargetSchema2,
-  recipientDidTargetSchema2
-]);
-function isCanonicalResourcePath2(value) {
-  if (value.length === 0) return false;
-  if (/[\u0000-\u001f\u007f\\]/.test(value)) return false;
-  if (/%2f|%5c|%2e/i.test(value)) return false;
-  return value.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
-}
-function isCanonicalPathSegment2(value) {
-  return isCanonicalResourcePath2(value) && !value.includes("/");
-}
-var resourceSelectorSchema2 = external_exports2.object({
-  kind: external_exports2.union([external_exports2.literal("exact"), external_exports2.literal("prefix")]),
-  path: external_exports2.string().min(1)
-}).strict().superRefine((selector, ctx) => {
-  const body = selector.kind === "prefix" && selector.path.endsWith("/") ? selector.path.slice(0, -1) : selector.path;
-  if (!isCanonicalResourcePath2(body)) {
-    ctx.addIssue({
-      code: external_exports2.ZodIssueCode.custom,
-      path: ["path"],
-      message: "expected a canonical resource path (non-empty segments, no . or .. segments, no //, no backslash, no %2f/%5c/%2e, no control chars)"
-    });
-  }
-});
-var targetSchema2 = external_exports2.object({
-  origin: external_exports2.string().refine(isCanonicalHttpsOrigin2, {
-    message: "expected a canonical https origin (https://host[:port], nothing else)"
-  }),
-  nodeAudience: external_exports2.string().min(1),
-  spaceId: external_exports2.string().refine(isCanonicalPathSegment2, {
-    message: "expected a single canonical path segment (spaceId joins the resource URI; separators/traversal would alias grants)"
-  }),
-  resource: resourceSelectorSchema2
-}).strict();
-var displaySchema2 = external_exports2.object({
-  senderName: external_exports2.string().optional(),
-  filename: external_exports2.string().optional(),
-  recipientHint: external_exports2.string().optional(),
-  /**
-   * Presentation preference only (viewer spec §1): may narrow, never widen;
-   * capabilities always win.
+   * Presentation preference only (viewer spec §1): may narrow, never widen;
+   * capabilities always win.
    */
   mode: external_exports2.union([external_exports2.literal("document"), external_exports2.literal("source"), external_exports2.literal("folder")]).optional()
 }).strict();
@@ -16736,324 +16286,954 @@ var unsignedShareEnvelopeSchema2 = external_exports2.object({
   /** Bearer-slice sealed-content pointer (see contentPointerSchema). */
   content: contentPointerSchema2.optional()
 }).strict();
-var shareEnvelopeSchema2 = unsignedShareEnvelopeSchema2.extend({ signature: signatureSchema2 }).strict();
-var recipientMatcherSchema2 = external_exports2.discriminatedUnion("kind", [
-  external_exports2.object({ kind: external_exports2.literal("exactEmail"), value: external_exports2.string().min(3).regex(/^[^@\s]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/) }).strict(),
-  external_exports2.object({ kind: external_exports2.literal("emailDomain"), value: external_exports2.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/) }).strict(),
-  external_exports2.object({ kind: external_exports2.literal("recipientDid"), value: external_exports2.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),
-  external_exports2.object({ kind: external_exports2.literal("policyDigest"), value: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/) }).strict(),
-  external_exports2.object({ kind: external_exports2.literal("bearer") }).strict()
+var shareEnvelopeSchema2 = unsignedShareEnvelopeSchema2.extend({ signature: signatureSchema2 }).strict();
+var recipientMatcherSchema2 = external_exports2.discriminatedUnion("kind", [
+  external_exports2.object({ kind: external_exports2.literal("exactEmail"), value: external_exports2.string().min(3).regex(/^[^@\s]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/) }).strict(),
+  external_exports2.object({ kind: external_exports2.literal("emailDomain"), value: external_exports2.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/) }).strict(),
+  external_exports2.object({ kind: external_exports2.literal("recipientDid"), value: external_exports2.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),
+  external_exports2.object({ kind: external_exports2.literal("policyDigest"), value: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/) }).strict(),
+  external_exports2.object({ kind: external_exports2.literal("bearer") }).strict()
+]);
+var shareActionSchema2 = external_exports2.union([external_exports2.literal("read"), external_exports2.literal("list"), external_exports2.literal("edit")]);
+var kvContentSourceSchema2 = external_exports2.object({
+  kind: external_exports2.literal("kv"),
+  space: external_exports2.string().min(1),
+  path: external_exports2.string().min(1),
+  action: external_exports2.literal("tinycloud.kv/get")
+}).strict();
+var sqlContentSourceSchema2 = external_exports2.object({
+  kind: external_exports2.literal("sql"),
+  space: external_exports2.string().min(1),
+  database: external_exports2.string().min(1),
+  path: external_exports2.string().min(1),
+  statement: external_exports2.string().min(1),
+  arguments: external_exports2.record(external_exports2.string(), external_exports2.number().int()),
+  argumentsDigest: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  action: external_exports2.literal("tinycloud.sql/read")
+}).strict();
+var contentSourceSchema2 = external_exports2.discriminatedUnion("kind", [kvContentSourceSchema2, sqlContentSourceSchema2]);
+var v2TargetSchema2 = external_exports2.object({
+  origin: external_exports2.string().refine(isCanonicalHttpsOrigin2, { message: "expected a canonical https origin" }),
+  nodeAudience: external_exports2.string().min(1),
+  spaceId: external_exports2.string().refine(isCanonicalPathSegment2, { message: "expected a canonical space id" })
+}).strict();
+var shareDecryptionSchema2 = external_exports2.object({
+  networkId: external_exports2.string().min(1),
+  action: external_exports2.literal("tinycloud.encryption/decrypt")
+}).strict();
+var ownerAuthoritySchema2 = external_exports2.object({
+  registrationCid: external_exports2.string().min(1),
+  shareCid: external_exports2.string().min(1),
+  envelopeCid: external_exports2.string().min(1),
+  enforcementDelegation: external_exports2.record(external_exports2.string(), external_exports2.unknown()),
+  outerEnvelope: external_exports2.record(external_exports2.string(), external_exports2.unknown()),
+  /** Node-signed registration evidence; required by trusted policy adapters. */
+  registrationReceipt: external_exports2.object({
+    registration: external_exports2.record(external_exports2.string(), external_exports2.unknown()),
+    proof: external_exports2.record(external_exports2.string(), external_exports2.unknown())
+  }).strict().optional()
+}).strict();
+var contentMetadataSchema2 = external_exports2.object({
+  mediaType: external_exports2.string().min(1).max(128).optional(),
+  byteLength: external_exports2.number().int().nonnegative().max(100 * 1024 * 1024).optional(),
+  filename: external_exports2.string().min(1).max(255).optional(),
+  encoding: external_exports2.literal("utf-8").optional(),
+  /** Encrypted presentation discriminator. The fixed entry point is index.html. */
+  artifact: external_exports2.literal("html").optional()
+}).strict();
+var deliveryEmailSchema2 = external_exports2.string().email();
+function isEnvelopeDeliveryEmail2(value) {
+  return deliveryEmailSchema2.safeParse(value).success;
+}
+var unsignedShareEnvelopeV2BaseSchema2 = external_exports2.object({
+  version: external_exports2.literal(2),
+  shareId: external_exports2.string().min(1),
+  recipientMatcher: recipientMatcherSchema2,
+  deliveryEmail: deliveryEmailSchema2.optional(),
+  actions: external_exports2.array(shareActionSchema2).min(1).max(3),
+  resource: resourceSelectorSchema2,
+  target: v2TargetSchema2,
+  delegationCid: external_exports2.string().min(1),
+  authorityMaterialHandle: external_exports2.string().min(1),
+  authorityMaterialDigest: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  decryption: shareDecryptionSchema2.optional(),
+  contentSource: contentSourceSchema2,
+  contentSourceDigest: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  authorizationTarget: authorizationTargetSchema2,
+  display: displaySchema2,
+  expiry: external_exports2.string().datetime(),
+  encrypted: external_exports2.boolean(),
+  content: contentPointerSchema2.optional(),
+  metadata: contentMetadataSchema2,
+  ownerAuthority: ownerAuthoritySchema2.optional()
+}).strict();
+function validateV2Invariants2(value, ctx) {
+  const actions = [...value.actions];
+  if (new Set(actions).size !== actions.length) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["actions"], message: "actions must be unique" });
+  if (actions.some((action, index) => action !== ["read", "list", "edit"].filter((candidate) => actions.includes(candidate))[index])) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["actions"], message: "actions must be canonically ordered" });
+  if (!value.encrypted && value.recipientMatcher.kind !== "policyDigest") ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["recipientMatcher"], message: "safe plaintext must carry only a matcher digest" });
+  if (!value.encrypted && value.authorizationTarget.kind !== "policy") ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["encrypted"], message: "unencrypted content requires a policy target" });
+  if (!value.encrypted && value.content !== void 0) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["content"], message: "policy-only plaintext cannot carry content" });
+  if (value.encrypted && (value.metadata.mediaType === void 0 || value.metadata.filename === void 0 || value.metadata.byteLength === void 0)) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["metadata"], message: "encrypted shares must describe their content" });
+  if (!value.encrypted && Object.keys(value.metadata).length !== 0) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["metadata"], message: "policy-only plaintext cannot describe content" });
+  if (!value.encrypted && value.metadata.encoding !== void 0) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["metadata", "encoding"], message: "policy-only plaintext cannot carry content encoding" });
+  if (value.metadata.artifact === "html" && (!value.encrypted || value.resource.kind !== "prefix" || !value.actions.includes("read") || !value.actions.includes("list"))) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["metadata", "artifact"], message: "html artifacts require an encrypted readable prefix" });
+  if (!value.encrypted && (value.display.senderName !== void 0 || value.display.filename !== void 0 || value.display.recipientHint !== void 0)) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["display"], message: "policy-only plaintext cannot carry display metadata" });
+  if (!value.encrypted && value.deliveryEmail !== void 0) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["deliveryEmail"], message: "policy-only plaintext cannot carry delivery metadata" });
+  if (value.recipientMatcher.kind === "exactEmail" && value.deliveryEmail !== void 0 && value.deliveryEmail !== value.recipientMatcher.value) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["deliveryEmail"], message: "delivery email must match the exact matcher" });
+  if (value.recipientMatcher.kind === "emailDomain" && value.deliveryEmail !== void 0 && value.deliveryEmail.toLowerCase().endsWith(`@${value.recipientMatcher.value}`) === false) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["deliveryEmail"], message: "delivery email must belong to the matcher domain" });
+  if (value.contentSource.kind === "kv" && value.contentSource.action !== "tinycloud.kv/get") ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["contentSource"], message: "source action mismatch" });
+  if (value.contentSource.kind === "sql" && value.contentSource.action !== "tinycloud.sql/read") ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["contentSource"], message: "source action mismatch" });
+}
+var unsignedShareEnvelopeV2Schema2 = unsignedShareEnvelopeV2BaseSchema2.superRefine(validateV2Invariants2);
+var shareEnvelopeV2Schema2 = unsignedShareEnvelopeV2BaseSchema2.extend({ signature: signatureSchema2 }).strict().superRefine(validateV2Invariants2);
+var unifiedResourceSchema2 = external_exports2.string().refine((value) => {
+  const marker = value.indexOf("/kv/");
+  if (marker < 1) return false;
+  const space = value.slice(0, marker);
+  const legacy = space.startsWith("tinycloud://");
+  if (legacy ? /[:/?#%]/.test(space.slice("tinycloud://".length)) : !space.startsWith("tinycloud:") || /[/?#%]/.test(space)) return false;
+  const path = value.slice(marker + 4);
+  return !path.startsWith("/") && !path.endsWith("/") && !path.includes("//") && path.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}, { message: "expected canonical TinyCloud KV resource" });
+var unifiedEncryptionNetworkSchema2 = external_exports2.string().refine((value) => {
+  if (!value.startsWith("urn:tinycloud:encryption:")) return false;
+  const rest = value.slice("urn:tinycloud:encryption:".length);
+  const separator = rest.lastIndexOf(":");
+  const owner = separator < 0 ? "" : rest.slice(0, separator);
+  const network = separator < 0 ? "" : rest.slice(separator + 1);
+  return owner.startsWith("did:") && owner.length > 4 && network.length > 0 && !/[:/%?#\s]/.test(network);
+}, { message: "expected canonical TinyCloud encryption network" });
+var unifiedKvCapabilitySchema2 = external_exports2.object({
+  kind: external_exports2.literal("kv"),
+  resource: unifiedResourceSchema2,
+  selector: external_exports2.union([external_exports2.literal("exact"), external_exports2.literal("prefix")]),
+  actions: external_exports2.array(external_exports2.union([
+    external_exports2.literal("tinycloud.kv/get"),
+    external_exports2.literal("tinycloud.kv/list"),
+    external_exports2.literal("tinycloud.kv/metadata"),
+    external_exports2.literal("tinycloud.kv/put")
+  ])).min(1)
+}).strict();
+var unifiedEncryptionCapabilitySchema2 = external_exports2.object({
+  kind: external_exports2.literal("encryption"),
+  resource: unifiedEncryptionNetworkSchema2,
+  action: external_exports2.literal("tinycloud.encryption/decrypt")
+}).strict();
+var unifiedCapabilitySchema2 = external_exports2.union([unifiedKvCapabilitySchema2, unifiedEncryptionCapabilitySchema2]);
+var unifiedContentSourceSchema2 = external_exports2.object({
+  shareId: external_exports2.string().min(1),
+  kvResource: unifiedResourceSchema2,
+  selector: external_exports2.union([external_exports2.literal("exact"), external_exports2.literal("prefix")]),
+  encryptionNetwork: unifiedEncryptionNetworkSchema2,
+  encryptedSymmetricKeyDigestHex: external_exports2.string().regex(/^[0-9a-f]{64}$/),
+  keyVersion: external_exports2.number().int().positive(),
+  mode: external_exports2.union([external_exports2.literal("mutable"), external_exports2.literal("immutable")]),
+  initialCiphertextDigestHex: external_exports2.string().regex(/^[0-9a-f]{64}$/).optional()
+}).strict();
+var unifiedPolicyV1Schema2 = external_exports2.object({
+  schema: external_exports2.literal("xyz.tinycloud.policy/policy/v1"),
+  policyId: external_exports2.string().regex(/^pol_[a-z2-7]+$/),
+  ownerDid: external_exports2.string().min(1),
+  createdAt: external_exports2.string().datetime({ offset: true }),
+  expiresAt: external_exports2.string().datetime({ offset: true }).optional(),
+  contentSource: unifiedContentSourceSchema2,
+  capabilityCeiling: external_exports2.array(unifiedCapabilitySchema2).min(2),
+  signature: external_exports2.object({ suite: external_exports2.string().min(1), signerDid: external_exports2.string().min(1), value: external_exports2.string().min(1) }).strict()
+}).strict();
+var policyCredentialRequirementV1Schema2 = external_exports2.object({
+  type: external_exports2.literal("TinyCloudPolicyCredentialRequirement"),
+  version: external_exports2.literal(1),
+  requirementDigest: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  descriptorDigest: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  issuerDid: external_exports2.string().min(1),
+  issuerKid: external_exports2.string().min(1),
+  profile: external_exports2.object({ id: external_exports2.string().min(1), version: external_exports2.literal(1) }).strict(),
+  credentialType: external_exports2.object({ id: external_exports2.string().min(1), version: external_exports2.literal(1) }).strict()
+}).strict();
+var unifiedPolicyV2Schema2 = external_exports2.object({
+  schema: external_exports2.literal("xyz.tinycloud.policy/policy/v2"),
+  policyId: external_exports2.string().regex(/^pol_[a-z2-7]+$/),
+  ownerDid: external_exports2.string().min(1),
+  createdAt: external_exports2.string().datetime({ offset: true }),
+  expiresAt: external_exports2.string().datetime({ offset: true }).optional(),
+  contentSource: unifiedContentSourceSchema2,
+  capabilityCeiling: external_exports2.array(unifiedCapabilitySchema2).min(2),
+  credentialRequirement: policyCredentialRequirementV1Schema2,
+  signature: external_exports2.object({ suite: external_exports2.literal("Ed25519"), signerDid: external_exports2.string().min(1), value: external_exports2.string().min(1) }).strict()
+}).strict();
+var unifiedPolicySchema2 = external_exports2.discriminatedUnion("schema", [
+  unifiedPolicyV1Schema2,
+  unifiedPolicyV2Schema2
 ]);
-var shareActionSchema2 = external_exports2.union([external_exports2.literal("read"), external_exports2.literal("list"), external_exports2.literal("edit")]);
-var kvContentSourceSchema2 = external_exports2.object({
-  kind: external_exports2.literal("kv"),
-  space: external_exports2.string().min(1),
-  path: external_exports2.string().min(1),
-  action: external_exports2.literal("tinycloud.kv/get")
+var unifiedRootSchema2 = external_exports2.object({
+  cid: external_exports2.string().min(1),
+  authorization: external_exports2.string().regex(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/),
+  role: external_exports2.union([external_exports2.literal("policy-authority"), external_exports2.literal("policy-enforcement")])
 }).strict();
-var sqlContentSourceSchema2 = external_exports2.object({
-  kind: external_exports2.literal("sql"),
-  space: external_exports2.string().min(1),
-  database: external_exports2.string().min(1),
-  path: external_exports2.string().min(1),
-  statement: external_exports2.string().min(1),
-  arguments: external_exports2.record(external_exports2.string(), external_exports2.number().int()),
-  argumentsDigest: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/),
-  action: external_exports2.literal("tinycloud.sql/read")
+var attestedEnforcerBindingV2Schema2 = external_exports2.object({
+  schema: external_exports2.literal("xyz.tinycloud.policy/attested-enforcer/v2"),
+  enforcerDid: external_exports2.string().regex(/^did:key:z[1-9A-HJ-NP-Za-km-z]+$/),
+  nodeAudience: external_exports2.string().min(1),
+  attestationBindingDigestHex: external_exports2.string().regex(/^[0-9a-f]{64}$/),
+  issuedAt: external_exports2.string().datetime({ offset: true }),
+  expiresAt: external_exports2.string().datetime({ offset: true }),
+  signature: external_exports2.object({ suite: external_exports2.literal("Ed25519"), signerDid: external_exports2.string().min(1), value: base64UrlString2() }).strict()
 }).strict();
-var contentSourceSchema2 = external_exports2.discriminatedUnion("kind", [kvContentSourceSchema2, sqlContentSourceSchema2]);
-var v2TargetSchema2 = external_exports2.object({
+var v3TargetSchema2 = external_exports2.object({
   origin: external_exports2.string().refine(isCanonicalHttpsOrigin2, { message: "expected a canonical https origin" }),
   nodeAudience: external_exports2.string().min(1),
   spaceId: external_exports2.string().refine(isCanonicalPathSegment2, { message: "expected a canonical space id" })
 }).strict();
-var shareDecryptionSchema2 = external_exports2.object({
-  networkId: external_exports2.string().min(1),
-  action: external_exports2.literal("tinycloud.encryption/decrypt")
-}).strict();
-var ownerAuthoritySchema2 = external_exports2.object({
-  registrationCid: external_exports2.string().min(1),
-  shareCid: external_exports2.string().min(1),
-  envelopeCid: external_exports2.string().min(1),
-  enforcementDelegation: external_exports2.record(external_exports2.string(), external_exports2.unknown()),
-  outerEnvelope: external_exports2.record(external_exports2.string(), external_exports2.unknown()),
-  /** Node-signed registration evidence; required by trusted policy adapters. */
-  registrationReceipt: external_exports2.object({
-    registration: external_exports2.record(external_exports2.string(), external_exports2.unknown()),
-    proof: external_exports2.record(external_exports2.string(), external_exports2.unknown())
-  }).strict().optional()
-}).strict();
-var contentMetadataSchema2 = external_exports2.object({
-  mediaType: external_exports2.string().min(1).max(128).optional(),
-  byteLength: external_exports2.number().int().nonnegative().max(100 * 1024 * 1024).optional(),
-  filename: external_exports2.string().min(1).max(255).optional(),
-  encoding: external_exports2.literal("utf-8").optional(),
-  /** Encrypted presentation discriminator. The fixed entry point is index.html. */
-  artifact: external_exports2.literal("html").optional()
+var unsignedShareEnvelopeV3BaseSchema2 = external_exports2.object({
+  version: external_exports2.literal(3),
+  shareId: external_exports2.string().min(1),
+  recipientMatcher: recipientMatcherSchema2,
+  deliveryEmail: deliveryEmailSchema2.optional(),
+  actions: external_exports2.array(shareActionSchema2).min(1).max(3),
+  resource: resourceSelectorSchema2,
+  target: v3TargetSchema2,
+  policy: unifiedPolicySchema2,
+  policyCid: external_exports2.string().min(1),
+  policyRoot: unifiedRootSchema2,
+  enforcementRoot: unifiedRootSchema2,
+  attestedEnforcerBinding: attestedEnforcerBindingV2Schema2,
+  contentSource: unifiedContentSourceSchema2,
+  contentSourceDigestHex: external_exports2.string().regex(/^[0-9a-f]{64}$/),
+  encryptionNetwork: unifiedEncryptionNetworkSchema2,
+  expiry: external_exports2.string().datetime({ offset: true }),
+  display: displaySchema2,
+  encrypted: external_exports2.literal(true),
+  metadata: contentMetadataSchema2
 }).strict();
-var deliveryEmailSchema2 = external_exports2.string().email();
-function isEnvelopeDeliveryEmail2(value) {
-  return deliveryEmailSchema2.safeParse(value).success;
+function validateV3Invariants2(value, ctx) {
+  const actions = [...value.actions];
+  if (new Set(actions).size !== actions.length || actions.some((action, index) => action !== ["read", "list", "edit"].filter((candidate) => actions.includes(candidate))[index])) {
+    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["actions"], message: "actions must be unique and canonically ordered" });
+  }
+  if (value.policyRoot.role !== "policy-authority" || value.enforcementRoot.role !== "policy-enforcement") {
+    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["policyRoot", "role"], message: "root roles are fixed" });
+  }
+  if (value.policyCid.length === 0 || value.policyCid === value.policyRoot.cid || value.policyCid === value.enforcementRoot.cid) {
+    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["policyCid"], message: "policy CID must be distinct from both roots" });
+  }
+  if (value.contentSource.encryptionNetwork !== value.encryptionNetwork) {
+    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["encryptionNetwork"], message: "encryption network is not bound to the source" });
+  }
+  if (value.attestedEnforcerBinding.nodeAudience !== value.target.nodeAudience || value.attestedEnforcerBinding.signature.signerDid !== value.attestedEnforcerBinding.nodeAudience || Date.parse(value.attestedEnforcerBinding.expiresAt) < Date.parse(value.expiry)) {
+    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["attestedEnforcerBinding"], message: "enforcer binding does not cover the target and share lifetime" });
+  }
+  if (value.policy.contentSource.shareId !== value.contentSource.shareId || value.policy.contentSource.kvResource !== value.contentSource.kvResource || value.policy.contentSource.selector !== value.contentSource.selector || value.policy.contentSource.encryptionNetwork !== value.encryptionNetwork || value.policy.contentSource.encryptedSymmetricKeyDigestHex !== value.contentSource.encryptedSymmetricKeyDigestHex || value.policy.contentSource.keyVersion !== value.contentSource.keyVersion || value.policy.contentSource.mode !== value.contentSource.mode || value.policy.contentSource.initialCiphertextDigestHex !== value.contentSource.initialCiphertextDigestHex) {
+    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["contentSource"], message: "content source is not bound to policy" });
+  }
+  if (value.policy.signature.suite !== "Ed25519" || value.policy.signature.signerDid !== value.policy.ownerDid) {
+    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["policy", "signature"], message: "policy must be signed by its owner" });
+  }
+  const kvCapabilities = value.policy.capabilityCeiling.filter((capability) => capability.kind === "kv");
+  const decryptCapabilities = value.policy.capabilityCeiling.filter((capability) => capability.kind === "encryption" && capability.resource === value.encryptionNetwork && capability.action === "tinycloud.encryption/decrypt");
+  if (value.policy.capabilityCeiling.length !== 2 || kvCapabilities.length !== 1 || decryptCapabilities.length !== 1 || kvCapabilities[0]?.resource !== value.contentSource.kvResource || kvCapabilities[0]?.selector !== value.contentSource.selector) {
+    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["policy", "capabilityCeiling"], message: "policy ceiling must contain exact decrypt network" });
+  }
+}
+var unsignedShareEnvelopeV3Schema2 = unsignedShareEnvelopeV3BaseSchema2.superRefine(validateV3Invariants2);
+var shareEnvelopeV3Schema2 = unsignedShareEnvelopeV3BaseSchema2.extend({ signature: signatureSchema2 }).strict().superRefine(validateV3Invariants2);
+var ENVELOPE_AAD_LABEL2 = "tinycloud-share-envelope-v1";
+var AAD2 = utf8Bytes2(ENVELOPE_AAD_LABEL2);
+function isPlainRecord2(value) {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function assertNoLoneSurrogates2(text) {
+  for (let i = 0; i < text.length; i++) {
+    const unit = text.charCodeAt(i);
+    if (unit >= 56320 && unit <= 57343) {
+      throw new TypeError(
+        `cannot canonicalize string with unpaired low surrogate at index ${i}`
+      );
+    }
+    if (unit >= 55296 && unit <= 56319) {
+      const next = text.charCodeAt(i + 1);
+      if (!(next >= 56320 && next <= 57343)) {
+        throw new TypeError(
+          `cannot canonicalize string with unpaired high surrogate at index ${i}`
+        );
+      }
+      i++;
+    }
+  }
+}
+function serializeString2(text) {
+  assertNoLoneSurrogates2(text);
+  return JSON.stringify(text);
+}
+function serialize2(value) {
+  if (value === null) return "null";
+  switch (typeof value) {
+    case "boolean":
+      return JSON.stringify(value);
+    case "string":
+      return serializeString2(value);
+    case "number":
+      if (!Number.isFinite(value)) {
+        throw new TypeError(`cannot canonicalize non-finite number: ${value}`);
+      }
+      return JSON.stringify(value);
+    case "object":
+      break;
+    default:
+      throw new TypeError(`cannot canonicalize value of type ${typeof value}`);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => serialize2(item)).join(",")}]`;
+  }
+  if (!isPlainRecord2(value)) {
+    throw new TypeError("cannot canonicalize non-plain object");
+  }
+  const keys = Object.keys(value).sort();
+  const members = [];
+  for (const key of keys) {
+    const member = value[key];
+    if (member === void 0) continue;
+    members.push(`${serializeString2(key)}:${serialize2(member)}`);
+  }
+  return `{${members.join(",")}}`;
+}
+function canonicalize2(value) {
+  return serialize2(value);
+}
+var LABEL2 = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function isCanonicalEmailDomain2(value) {
+  if (value.length === 0 || value.length > 253) return false;
+  const labels = value.split(".");
+  return labels.length >= 2 && labels.every((label) => LABEL2.test(label)) && !/^[0-9]+$/.test(labels.at(-1));
+}
+function canonicalMailbox2(value) {
+  const email = value.trim().toLowerCase();
+  const at = email.indexOf("@");
+  if (at <= 0 || at !== email.lastIndexOf("@")) return void 0;
+  const local = email.slice(0, at);
+  const domain = email.slice(at + 1);
+  if (local.length > 64 || !/^[a-z0-9#$&'*+/=?^_`{|}~-]+(?:\.[a-z0-9#$&'*+/=?^_`{|}~-]+)*$/.test(local) || !isCanonicalEmailDomain2(domain)) return void 0;
+  return Object.freeze({ email, domain });
+}
+var MAX_INLINE_BYTES2 = 256 * 1024;
+
+// src/commands/share.ts
+import { ProfileLockTimeoutError as ProfileLockTimeoutError2 } from "@tinycloud/operations/state";
+
+// src/lib/duration.ts
+function parseDuration(input) {
+  const match = input.match(/^(\d+)(m|h|d|w)$/);
+  if (match) {
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+    const multipliers = {
+      m: 60 * 1e3,
+      h: 60 * 60 * 1e3,
+      d: 24 * 60 * 60 * 1e3,
+      w: 7 * 24 * 60 * 60 * 1e3
+    };
+    return value * multipliers[unit];
+  }
+  const date = new Date(input);
+  if (!isNaN(date.getTime())) {
+    const ms = date.getTime() - Date.now();
+    if (ms <= 0) {
+      throw new Error(`Expiry date "${input}" is in the past`);
+    }
+    return ms;
+  }
+  throw new Error(`Invalid duration: "${input}". Use format like "1h", "7d", or an ISO date.`);
+}
+
+// src/commands/share.ts
+init_formatter();
+init_errors();
+
+// src/share/output.ts
+function writeJson2(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function authorizationRequiredJson(result) {
+  return {
+    state: "authorization-required",
+    method: result.method,
+    next: "complete authorization through the configured authority adapter, then retry with the required proof"
+  };
+}
+function publishHuman(result) {
+  process.stdout.write(`${result.url}
+`);
+}
+function inspectHuman(result) {
+  const metadata = result.metadata;
+  process.stdout.write([
+    `Share ${metadata.shareId}`,
+    `File: ${metadata.display.filename ?? "unnamed"}`,
+    `Target: ${metadata.target.kind === "bearer" ? "bearer (anyone with the complete link can read)" : metadata.target.kind}`,
+    `Expires: ${metadata.expiresAt}`,
+    `Resource: ${metadata.resource.path}`,
+    `Link format: ${result.link.kind}`
+  ].join("\n") + "\n");
+}
+function receiveHuman(path) {
+  process.stdout.write(`${path}
+`);
 }
-var unsignedShareEnvelopeV2BaseSchema2 = external_exports2.object({
-  version: external_exports2.literal(2),
-  shareId: external_exports2.string().min(1),
-  recipientMatcher: recipientMatcherSchema2,
-  deliveryEmail: deliveryEmailSchema2.optional(),
-  actions: external_exports2.array(shareActionSchema2).min(1).max(3),
-  resource: resourceSelectorSchema2,
-  target: v2TargetSchema2,
-  delegationCid: external_exports2.string().min(1),
-  authorityMaterialHandle: external_exports2.string().min(1),
-  authorityMaterialDigest: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/),
-  decryption: shareDecryptionSchema2.optional(),
-  contentSource: contentSourceSchema2,
-  contentSourceDigest: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/),
-  authorizationTarget: authorizationTargetSchema2,
-  display: displaySchema2,
-  expiry: external_exports2.string().datetime(),
-  encrypted: external_exports2.boolean(),
-  content: contentPointerSchema2.optional(),
-  metadata: contentMetadataSchema2,
-  ownerAuthority: ownerAuthoritySchema2.optional()
-}).strict();
-function validateV2Invariants2(value, ctx) {
-  const actions = [...value.actions];
-  if (new Set(actions).size !== actions.length) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["actions"], message: "actions must be unique" });
-  if (actions.some((action, index) => action !== ["read", "list", "edit"].filter((candidate) => actions.includes(candidate))[index])) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["actions"], message: "actions must be canonically ordered" });
-  if (!value.encrypted && value.recipientMatcher.kind !== "policyDigest") ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["recipientMatcher"], message: "safe plaintext must carry only a matcher digest" });
-  if (!value.encrypted && value.authorizationTarget.kind !== "policy") ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["encrypted"], message: "unencrypted content requires a policy target" });
-  if (!value.encrypted && value.content !== void 0) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["content"], message: "policy-only plaintext cannot carry content" });
-  if (value.encrypted && (value.metadata.mediaType === void 0 || value.metadata.filename === void 0 || value.metadata.byteLength === void 0)) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["metadata"], message: "encrypted shares must describe their content" });
-  if (!value.encrypted && Object.keys(value.metadata).length !== 0) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["metadata"], message: "policy-only plaintext cannot describe content" });
-  if (!value.encrypted && value.metadata.encoding !== void 0) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["metadata", "encoding"], message: "policy-only plaintext cannot carry content encoding" });
-  if (value.metadata.artifact === "html" && (!value.encrypted || value.resource.kind !== "prefix" || !value.actions.includes("read") || !value.actions.includes("list"))) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["metadata", "artifact"], message: "html artifacts require an encrypted readable prefix" });
-  if (!value.encrypted && (value.display.senderName !== void 0 || value.display.filename !== void 0 || value.display.recipientHint !== void 0)) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["display"], message: "policy-only plaintext cannot carry display metadata" });
-  if (!value.encrypted && value.deliveryEmail !== void 0) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["deliveryEmail"], message: "policy-only plaintext cannot carry delivery metadata" });
-  if (value.recipientMatcher.kind === "exactEmail" && value.deliveryEmail !== void 0 && value.deliveryEmail !== value.recipientMatcher.value) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["deliveryEmail"], message: "delivery email must match the exact matcher" });
-  if (value.recipientMatcher.kind === "emailDomain" && value.deliveryEmail !== void 0 && value.deliveryEmail.toLowerCase().endsWith(`@${value.recipientMatcher.value}`) === false) ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["deliveryEmail"], message: "delivery email must belong to the matcher domain" });
-  if (value.contentSource.kind === "kv" && value.contentSource.action !== "tinycloud.kv/get") ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["contentSource"], message: "source action mismatch" });
-  if (value.contentSource.kind === "sql" && value.contentSource.action !== "tinycloud.sql/read") ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["contentSource"], message: "source action mismatch" });
+function receiveJson(result, path) {
+  writeJson2({ protocol: "tinycloud-share", version: 1, path, metadata: result.metadata });
 }
-var unsignedShareEnvelopeV2Schema2 = unsignedShareEnvelopeV2BaseSchema2.superRefine(validateV2Invariants2);
-var shareEnvelopeV2Schema2 = unsignedShareEnvelopeV2BaseSchema2.extend({ signature: signatureSchema2 }).strict().superRefine(validateV2Invariants2);
-var unifiedResourceSchema2 = external_exports2.string().refine((value) => {
-  const marker = value.indexOf("/kv/");
-  if (marker < 1) return false;
-  const space = value.slice(0, marker);
-  const legacy = space.startsWith("tinycloud://");
-  if (legacy ? /[:/?#%]/.test(space.slice("tinycloud://".length)) : !space.startsWith("tinycloud:") || /[/?#%]/.test(space)) return false;
-  const path = value.slice(marker + 4);
-  return !path.startsWith("/") && !path.endsWith("/") && !path.includes("//") && path.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
-}, { message: "expected canonical TinyCloud KV resource" });
-var unifiedEncryptionNetworkSchema2 = external_exports2.string().refine((value) => {
-  if (!value.startsWith("urn:tinycloud:encryption:")) return false;
-  const rest = value.slice("urn:tinycloud:encryption:".length);
-  const separator = rest.lastIndexOf(":");
-  const owner = separator < 0 ? "" : rest.slice(0, separator);
-  const network = separator < 0 ? "" : rest.slice(separator + 1);
-  return owner.startsWith("did:") && owner.length > 4 && network.length > 0 && !/[:/%?#\s]/.test(network);
-}, { message: "expected canonical TinyCloud encryption network" });
-var unifiedKvCapabilitySchema2 = external_exports2.object({
-  kind: external_exports2.literal("kv"),
-  resource: unifiedResourceSchema2,
-  selector: external_exports2.union([external_exports2.literal("exact"), external_exports2.literal("prefix")]),
-  actions: external_exports2.array(external_exports2.union([
-    external_exports2.literal("tinycloud.kv/get"),
-    external_exports2.literal("tinycloud.kv/list"),
-    external_exports2.literal("tinycloud.kv/metadata"),
-    external_exports2.literal("tinycloud.kv/put")
-  ])).min(1)
-}).strict();
-var unifiedEncryptionCapabilitySchema2 = external_exports2.object({
-  kind: external_exports2.literal("encryption"),
-  resource: unifiedEncryptionNetworkSchema2,
-  action: external_exports2.literal("tinycloud.encryption/decrypt")
-}).strict();
-var unifiedCapabilitySchema2 = external_exports2.union([unifiedKvCapabilitySchema2, unifiedEncryptionCapabilitySchema2]);
-var unifiedContentSourceSchema2 = external_exports2.object({
-  shareId: external_exports2.string().min(1),
-  kvResource: unifiedResourceSchema2,
-  selector: external_exports2.union([external_exports2.literal("exact"), external_exports2.literal("prefix")]),
-  encryptionNetwork: unifiedEncryptionNetworkSchema2,
-  encryptedSymmetricKeyDigestHex: external_exports2.string().regex(/^[0-9a-f]{64}$/),
-  keyVersion: external_exports2.number().int().positive(),
-  mode: external_exports2.union([external_exports2.literal("mutable"), external_exports2.literal("immutable")]),
-  initialCiphertextDigestHex: external_exports2.string().regex(/^[0-9a-f]{64}$/).optional()
-}).strict();
-var unifiedPolicyV1Schema2 = external_exports2.object({
-  schema: external_exports2.literal("xyz.tinycloud.policy/policy/v1"),
-  policyId: external_exports2.string().regex(/^pol_[a-z2-7]+$/),
-  ownerDid: external_exports2.string().min(1),
-  createdAt: external_exports2.string().datetime({ offset: true }),
-  expiresAt: external_exports2.string().datetime({ offset: true }).optional(),
-  contentSource: unifiedContentSourceSchema2,
-  capabilityCeiling: external_exports2.array(unifiedCapabilitySchema2).min(2),
-  signature: external_exports2.object({ suite: external_exports2.string().min(1), signerDid: external_exports2.string().min(1), value: external_exports2.string().min(1) }).strict()
-}).strict();
-var policyCredentialRequirementV1Schema2 = external_exports2.object({
-  type: external_exports2.literal("TinyCloudPolicyCredentialRequirement"),
-  version: external_exports2.literal(1),
-  requirementDigest: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/),
-  descriptorDigest: external_exports2.string().regex(/^[A-Za-z0-9_-]{43}$/),
-  issuerDid: external_exports2.string().min(1),
-  issuerKid: external_exports2.string().min(1),
-  profile: external_exports2.object({ id: external_exports2.string().min(1), version: external_exports2.literal(1) }).strict(),
-  credentialType: external_exports2.object({ id: external_exports2.string().min(1), version: external_exports2.literal(1) }).strict()
-}).strict();
-var unifiedPolicyV2Schema2 = external_exports2.object({
-  schema: external_exports2.literal("xyz.tinycloud.policy/policy/v2"),
-  policyId: external_exports2.string().regex(/^pol_[a-z2-7]+$/),
-  ownerDid: external_exports2.string().min(1),
-  createdAt: external_exports2.string().datetime({ offset: true }),
-  expiresAt: external_exports2.string().datetime({ offset: true }).optional(),
-  contentSource: unifiedContentSourceSchema2,
-  capabilityCeiling: external_exports2.array(unifiedCapabilitySchema2).min(2),
-  credentialRequirement: policyCredentialRequirementV1Schema2,
-  signature: external_exports2.object({ suite: external_exports2.literal("Ed25519"), signerDid: external_exports2.string().min(1), value: external_exports2.string().min(1) }).strict()
-}).strict();
-var unifiedPolicySchema2 = external_exports2.discriminatedUnion("schema", [
-  unifiedPolicyV1Schema2,
-  unifiedPolicyV2Schema2
-]);
-var unifiedRootSchema2 = external_exports2.object({
-  cid: external_exports2.string().min(1),
-  authorization: external_exports2.string().regex(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/),
-  role: external_exports2.union([external_exports2.literal("policy-authority"), external_exports2.literal("policy-enforcement")])
-}).strict();
-var attestedEnforcerBindingV2Schema2 = external_exports2.object({
-  schema: external_exports2.literal("xyz.tinycloud.policy/attested-enforcer/v2"),
-  enforcerDid: external_exports2.string().regex(/^did:key:z[1-9A-HJ-NP-Za-km-z]+$/),
-  nodeAudience: external_exports2.string().min(1),
-  attestationBindingDigestHex: external_exports2.string().regex(/^[0-9a-f]{64}$/),
-  issuedAt: external_exports2.string().datetime({ offset: true }),
-  expiresAt: external_exports2.string().datetime({ offset: true }),
-  signature: external_exports2.object({ suite: external_exports2.literal("Ed25519"), signerDid: external_exports2.string().min(1), value: base64UrlString2() }).strict()
-}).strict();
-var v3TargetSchema2 = external_exports2.object({
-  origin: external_exports2.string().refine(isCanonicalHttpsOrigin2, { message: "expected a canonical https origin" }),
-  nodeAudience: external_exports2.string().min(1),
-  spaceId: external_exports2.string().refine(isCanonicalPathSegment2, { message: "expected a canonical space id" })
-}).strict();
-var unsignedShareEnvelopeV3BaseSchema2 = external_exports2.object({
-  version: external_exports2.literal(3),
-  shareId: external_exports2.string().min(1),
-  recipientMatcher: recipientMatcherSchema2,
-  deliveryEmail: deliveryEmailSchema2.optional(),
-  actions: external_exports2.array(shareActionSchema2).min(1).max(3),
-  resource: resourceSelectorSchema2,
-  target: v3TargetSchema2,
-  policy: unifiedPolicySchema2,
-  policyCid: external_exports2.string().min(1),
-  policyRoot: unifiedRootSchema2,
-  enforcementRoot: unifiedRootSchema2,
-  attestedEnforcerBinding: attestedEnforcerBindingV2Schema2,
-  contentSource: unifiedContentSourceSchema2,
-  contentSourceDigestHex: external_exports2.string().regex(/^[0-9a-f]{64}$/),
-  encryptionNetwork: unifiedEncryptionNetworkSchema2,
-  expiry: external_exports2.string().datetime({ offset: true }),
-  display: displaySchema2,
-  encrypted: external_exports2.literal(true),
-  metadata: contentMetadataSchema2
-}).strict();
-function validateV3Invariants2(value, ctx) {
-  const actions = [...value.actions];
-  if (new Set(actions).size !== actions.length || actions.some((action, index) => action !== ["read", "list", "edit"].filter((candidate) => actions.includes(candidate))[index])) {
-    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["actions"], message: "actions must be unique and canonically ordered" });
+
+// src/share/io.ts
+import { constants } from "fs";
+import { lstat as lstat2, mkdir as mkdir2, mkdtemp, open as open2, readFile as readFile2, realpath, stat as stat2, link, rename as rename2, rm as rm3, unlink } from "fs/promises";
+import { randomBytes as randomBytes2 } from "crypto";
+import { basename as basename2, join as join4, resolve, sep } from "path";
+init_errors();
+var MAX_SHARE_STDIN_BYTES = 100 * 1024 * 1024;
+var MAX_SHARE_URL_BYTES = 64 * 1024;
+async function readBoundedStdin(limit = MAX_SHARE_STDIN_BYTES) {
+  if (!Number.isSafeInteger(limit) || limit <= 0) throw new Error("MAX_BYTES_EXCEEDED");
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of process.stdin) {
+    const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+    total += bytes.byteLength;
+    if (total > limit) throw new Error("MAX_BYTES_EXCEEDED");
+    chunks.push(bytes);
+  }
+  return new Uint8Array(Buffer.concat(chunks, total));
+}
+async function readBoundedUrlStdin() {
+  const bytes = await readBoundedStdin(MAX_SHARE_URL_BYTES);
+  const value = new TextDecoder("utf-8", { fatal: true }).decode(bytes).trim();
+  if (value.length === 0 || /\s/.test(value)) throw new Error("INVALID_ARGUMENT");
+  return value;
+}
+function safeFilename(value) {
+  return shareFilename(value);
+}
+function shareFilename(value) {
+  try {
+    return canonicalShareFilename(value);
+  } catch {
+    throw new CLIError(
+      "UNSAFE_FILENAME",
+      hasUnsafeFilenameCodePoint(value) ? "filename contains control or invisible characters" : "filename must be one safe path segment",
+      8
+    );
+  }
+}
+function shareInputFilename(input, name) {
+  return shareFilename(name ?? (input === "-" ? "stdin.md" : basename2(resolve(input))));
+}
+async function readShareInput(input, name, limit = MAX_SHARE_STDIN_BYTES) {
+  const filename = shareInputFilename(input, name);
+  if (input === "-") return { bytes: await readBoundedStdin(limit), filename };
+  const path = resolve(input);
+  const info = await stat2(path);
+  if (!info.isFile() || info.size > limit) throw new Error("MAX_BYTES_EXCEEDED");
+  const bytes = new Uint8Array(await readFile2(path));
+  if (bytes.byteLength > limit) throw new Error("MAX_BYTES_EXCEEDED");
+  return { bytes, filename };
+}
+async function assertDirectory(path) {
+  const absolute = resolve(path);
+  const segments = absolute.split(sep).filter(Boolean);
+  let current = absolute.startsWith(sep) ? sep : "";
+  for (const segment of segments) {
+    current = current === sep ? join4(current, segment) : join4(current, segment);
+    try {
+      const info = await lstat2(current);
+      if (info.isSymbolicLink()) {
+        const canonical = await realpath(current);
+        if (current !== "/tmp" && current !== "/var") throw new Error("OUTPUT_EXISTS");
+        if (canonical !== `/private${current}`) throw new Error("OUTPUT_EXISTS");
+      } else if (!info.isDirectory()) throw new Error("OUTPUT_EXISTS");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      await mkdir2(current, { mode: 448 });
+      const created = await lstat2(current);
+      if (created.isSymbolicLink() || !created.isDirectory()) throw new Error("OUTPUT_EXISTS");
+    }
+  }
+}
+async function writeShareOutput(directory, filename, bytes, force) {
+  const outputDirectory = resolve(directory);
+  await assertDirectory(outputDirectory);
+  const safeName = safeFilename(filename);
+  const directoryHandle = await open2(outputDirectory, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0) | (constants.O_NOFOLLOW ?? 0));
+  const stableDirectory = await realpath(outputDirectory);
+  const outputPath = join4(stableDirectory, safeName);
+  const directoryIdentity = await directoryHandle.stat();
+  const assertStableDirectory = async () => {
+    const current = await stat2(stableDirectory);
+    if (current.dev !== directoryIdentity.dev || current.ino !== directoryIdentity.ino) throw new Error("OUTPUT_EXISTS");
+  };
+  await assertStableDirectory();
+  const stagingDirectory = await mkdtemp(join4(stableDirectory, ".tinycloud-share-stage-"));
+  const stagingInfo = await lstat2(stagingDirectory);
+  if (!stagingInfo.isDirectory() || (stagingInfo.mode & 511) !== 448) throw new Error("OUTPUT_EXISTS");
+  const stagingPath = join4(stagingDirectory, `.tinycloud-share-${randomBytes2(16).toString("hex")}.tmp`);
+  let temporaryPath;
+  let handle;
+  try {
+    await assertStableDirectory();
+    try {
+      const existing = await lstat2(outputPath);
+      if (existing.isSymbolicLink()) throw new Error("UNSAFE_FILENAME");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    temporaryPath = stagingPath;
+    handle = await open2(temporaryPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 384);
+    await handle.writeFile(bytes);
+    await handle.close();
+    handle = void 0;
+    await assertStableDirectory();
+    if (force) {
+      await rename2(temporaryPath, outputPath);
+    } else {
+      await link(temporaryPath, outputPath);
+      await unlink(temporaryPath);
+    }
+    await assertStableDirectory();
+  } catch (error) {
+    if (error.code === "EEXIST") throw new Error("OUTPUT_EXISTS");
+    if (error.code === "ELOOP") throw new Error("UNSAFE_FILENAME");
+    throw error;
+  } finally {
+    await handle?.close();
+    try {
+      if (temporaryPath !== void 0) await unlink(temporaryPath);
+    } catch {
+    }
+    await rm3(stagingDirectory, { recursive: true, force: true });
+    await directoryHandle.close();
   }
-  if (value.policyRoot.role !== "policy-authority" || value.enforcementRoot.role !== "policy-enforcement") {
-    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["policyRoot", "role"], message: "root roles are fixed" });
+  return join4(outputDirectory, safeName);
+}
+
+// src/share/errors.ts
+var SharePublishAuthorityError = class extends Error {
+  constructor(failure) {
+    super(failure.kind);
+    this.failure = failure;
+    this.name = "SharePublishAuthorityError";
   }
-  if (value.policyCid.length === 0 || value.policyCid === value.policyRoot.cid || value.policyCid === value.enforcementRoot.cid) {
-    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["policyCid"], message: "policy CID must be distinct from both roots" });
+};
+var ShareHistoryRetryError = class extends Error {
+  constructor(profile) {
+    super("sender history changed during the operation");
+    this.profile = profile;
+    this.name = "ShareHistoryRetryError";
   }
-  if (value.contentSource.encryptionNetwork !== value.encryptionNetwork) {
-    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["encryptionNetwork"], message: "encryption network is not bound to the source" });
+  code = "SHARE_HISTORY_RETRY";
+};
+
+// src/commands/share.ts
+var SHARE_ORIGIN = "https://share.tinycloud.xyz";
+var NOTIFY_WINDOW_MESSAGE = "Share notification authorization expired (at share expiry or 5 minutes after publication); publish a new share and invite the recipient then.\n";
+var shareServices = {};
+function configureShareCommandServices(services) {
+  shareServices = services;
+}
+function parseShareTarget(value) {
+  if (value === "anyone" || value === "bearer") return { kind: "bearer" };
+  if (value.startsWith("did:")) return { kind: "recipientDid", did: value };
+  if (value.startsWith("domain:")) return canonicalMailboxTarget({ kind: "emailDomain", domain: value.slice("domain:".length) });
+  if (value.startsWith("email:")) return canonicalMailboxTarget({ kind: "email", address: value.slice("email:".length) });
+  if (value.includes("@")) return canonicalMailboxTarget({ kind: "email", address: value });
+  throw new CLIError("INVALID_ARGUMENT", "--to must be anyone, a did:, an email address, or domain:example.com", 2);
+}
+function canonicalMailboxTarget(target) {
+  try {
+    return normalizeShareTarget(target);
+  } catch (error) {
+    throw new CLIError("INVALID_ARGUMENT", error instanceof TypeError ? error.message : "share recipient is invalid", 2);
   }
-  if (value.attestedEnforcerBinding.nodeAudience !== value.target.nodeAudience || value.attestedEnforcerBinding.signature.signerDid !== value.attestedEnforcerBinding.nodeAudience || Date.parse(value.attestedEnforcerBinding.expiresAt) < Date.parse(value.expiry)) {
-    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["attestedEnforcerBinding"], message: "enforcer binding does not cover the target and share lifetime" });
+}
+function shareCliError(error, operation = "publish") {
+  if (error instanceof CLIError) return error;
+  if (error instanceof ProfileLockTimeoutError2) return wrapError(error);
+  if (error instanceof ShareHistoryRetryError) {
+    return new CLIError(
+      "SHARE_HISTORY_RETRY",
+      `sender history for profile ${JSON.stringify(error.profile)} changed or disappeared during this command`,
+      1,
+      { hint: `Retry this command with --profile ${JSON.stringify(error.profile)}. If this was a revoke, check its node state first: revocation may already have succeeded.` }
+    );
   }
-  if (value.policy.contentSource.shareId !== value.contentSource.shareId || value.policy.contentSource.kvResource !== value.contentSource.kvResource || value.policy.contentSource.selector !== value.contentSource.selector || value.policy.contentSource.encryptionNetwork !== value.encryptionNetwork || value.policy.contentSource.encryptedSymmetricKeyDigestHex !== value.contentSource.encryptedSymmetricKeyDigestHex || value.policy.contentSource.keyVersion !== value.contentSource.keyVersion || value.policy.contentSource.mode !== value.contentSource.mode || value.policy.contentSource.initialCiphertextDigestHex !== value.contentSource.initialCiphertextDigestHex) {
-    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["contentSource"], message: "content source is not bound to policy" });
+  if (error instanceof SharePublishAuthorityError) {
+    const failure = error.failure;
+    const profileName = "profileName" in failure ? failure.profileName : void 0;
+    const localKey = "localKey" in failure && failure.localKey === true;
+    const profileHint = profileName === void 0 ? "" : `--profile ${profileName} `;
+    const loginHint = localKey ? `\`tc ${profileHint}auth login --method local\`` : `\`tc ${profileHint}auth login --device --manifest builtin:share-publishing\` (or \`tc ${profileHint}enable share\`)`;
+    if (failure.kind === "caveated-session") {
+      const holder = profileName === void 0 ? "this session" : `profile ${profileName}'s session`;
+      return new CLIError(
+        "PERMISSION_DENIED",
+        `${holder} carries signed restrictions (caveats) on the authority an anyone-with-link share needs, so it cannot create the share link; nothing was shared. Approve Share publishing without restrictions on a new, dedicated profile (any unused name): \`tc init --name publisher --key-only && tc --profile publisher enable share\``,
+        5
+      );
+    }
+    if (failure.kind === "owner-space-unresolved") {
+      return new CLIError("AUTH_REQUIRED", `a valid signed TinyCloud session is required; run ${loginHint}`, 3);
+    }
+    if (failure.kind === "scope-denied") {
+      const requiredAction = failure.requiredAction === void 0 ? "" : ` (${failure.requiredAction})`;
+      const renew = localKey ? `renew it with ${loginHint} using the required capability` : `verify the session includes the builtin:share-publishing scope; if it does not, request it with ${loginHint}`;
+      return new CLIError("PERMISSION_DENIED", `the session lacks ${failure.capability} authority${requiredAction}; ${renew}`, 5);
+    }
+    if (failure.kind === "lifetime-exceeds-session") {
+      const expiresAt = failure.sessionExpiresAt.toISOString();
+      if (failure.reason === "session-too-close") {
+        return new CLIError("AUTH_REQUIRED", `the signed session expires too soon (${expiresAt}); log in again with ${loginHint}`, 3);
+      }
+      if (failure.reason === "below-minimum") {
+        return new CLIError("SESSION_LIFETIME_EXCEEDED", "share expiry must be at least 60 seconds from now; use a longer --expires value", 2);
+      }
+      return new CLIError("SESSION_LIFETIME_EXCEEDED", `requested share lifetime exceeds session expiry ${expiresAt}; use a shorter --expires value or renew the session with ${loginHint}`, 2);
+    }
+    if (failure.kind === "origin-mismatch") {
+      return new CLIError("ORIGIN_MISMATCH", "share origin does not match the configured service", 2);
+    }
+    if (failure.kind === "invalid-request") {
+      return new CLIError("INVALID_ARGUMENT", failure.reason, 2);
+    }
+    if (failure.kind === "registry-unavailable") {
+      return new CLIError("UNAVAILABLE", "the TinyCloud location registry could not be reached, so nothing was shared; try again shortly", 4);
+    }
+    if (failure.kind === "node-info-unavailable") {
+      const outcome = operation === "publish" ? "nothing was shared and no invitation was sent" : "no invitation was sent";
+      return new CLIError("UNAVAILABLE", `could not verify TinyCloud node 1.17.3 domain delivery support; ${outcome}. Check the node and retry`, 4);
+    }
+    if (failure.kind === "registry-rejected") {
+      return new CLIError("REGISTRY_REJECTED", "the TinyCloud location registry rejected this session's location record, so nothing was shared; retrying will not help. Log in again, and report the problem if it persists", 6);
+    }
+    if (failure.kind === "storage-quota-exceeded") {
+      const sizes = failure.usedBytes === void 0 || failure.limitBytes === void 0 ? "" : ` (${formatBytes(failure.usedBytes)} used of ${formatBytes(failure.limitBytes)} limit)`;
+      return new CLIError("STORAGE_QUOTA_EXCEEDED", `storage quota exceeded${sizes}; nothing was shared`, 4);
+    }
+    if (failure.kind === "upload-failed") {
+      return new CLIError("UPLOAD_FAILED", "share source upload failed; nothing was shared", 4);
+    }
   }
-  if (value.policy.signature.suite !== "Ed25519" || value.policy.signature.signerDid !== value.policy.ownerDid) {
-    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["policy", "signature"], message: "policy must be signed by its owner" });
+  if (error instanceof ShareNotifyError) {
+    return new CLIError("INVALID_ARGUMENT", error.message, 2);
   }
-  const kvCapabilities = value.policy.capabilityCeiling.filter((capability) => capability.kind === "kv");
-  const decryptCapabilities = value.policy.capabilityCeiling.filter((capability) => capability.kind === "encryption" && capability.resource === value.encryptionNetwork && capability.action === "tinycloud.encryption/decrypt");
-  if (value.policy.capabilityCeiling.length !== 2 || kvCapabilities.length !== 1 || decryptCapabilities.length !== 1 || kvCapabilities[0]?.resource !== value.contentSource.kvResource || kvCapabilities[0]?.selector !== value.contentSource.selector) {
-    ctx.addIssue({ code: external_exports2.ZodIssueCode.custom, path: ["policy", "capabilityCeiling"], message: "policy ceiling must contain exact decrypt network" });
+  if (error instanceof SharePublishError) {
+    const exit = error.code === "authority-required" ? 3 : error.code === "max-bytes-exceeded" ? 7 : 2;
+    const code3 = error.code === "authority-required" ? "AUTH_REQUIRED" : error.code === "max-bytes-exceeded" ? "MAX_BYTES_EXCEEDED" : "INVALID_ARGUMENT";
+    return new CLIError(code3, error.message, exit);
+  }
+  if (error instanceof ShareReceiveError) {
+    const verification = /* @__PURE__ */ new Set(["cid-mismatch", "decrypt-failed", "envelope-invalid", "origin-mismatch", "signature-invalid", "capability-invalid", "content-integrity-failed"]);
+    const exit = error.code === "max-bytes-exceeded" ? 7 : verification.has(error.code) ? 5 : error.code === "expired" || error.code === "fetch-failed" ? 4 : error.code === "invalid-link" || error.code === "unsupported-target" ? 2 : 2;
+    const code3 = error.code === "fetch-failed" ? "NOT_FOUND" : error.code.replaceAll("-", "_").toUpperCase();
+    return new CLIError(code3, error.message, exit);
   }
+  const message = error instanceof Error ? error.message : String(error);
+  const nodeCode = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+  const known = {
+    MAX_BYTES_EXCEEDED: { code: "MAX_BYTES_EXCEEDED", exit: 7 },
+    UNSAFE_FILENAME: { code: "UNSAFE_FILENAME", exit: 8 },
+    OUTPUT_EXISTS: { code: "OUTPUT_EXISTS", exit: 8 },
+    INVALID_ARGUMENT: { code: "INVALID_ARGUMENT", exit: 2 },
+    "share not found": { code: "NOT_FOUND", exit: 4 },
+    AUTH_REQUIRED: { code: "AUTH_REQUIRED", exit: 3 },
+    UNAVAILABLE: { code: "UNAVAILABLE", exit: 4 }
+  };
+  if (nodeCode === "ENOENT") return new CLIError("INVALID_ARGUMENT", "share input was not found", 2);
+  if (nodeCode === "EISDIR") return new CLIError("INVALID_ARGUMENT", "share input must be a Markdown file", 2);
+  if (error instanceof TypeError) return new CLIError("INVALID_ARGUMENT", "share input is invalid", 2);
+  const mapped = typeof nodeCode === "string" && known[nodeCode] !== void 0 ? known[nodeCode] : known[message];
+  return new CLIError(mapped?.code ?? "INVALID_ARGUMENT", mapped ? mapped.code : "share operation failed", mapped?.exit ?? 2);
 }
-var unsignedShareEnvelopeV3Schema2 = unsignedShareEnvelopeV3BaseSchema2.superRefine(validateV3Invariants2);
-var shareEnvelopeV3Schema2 = unsignedShareEnvelopeV3BaseSchema2.extend({ signature: signatureSchema2 }).strict().superRefine(validateV3Invariants2);
-var ENVELOPE_AAD_LABEL2 = "tinycloud-share-envelope-v1";
-var AAD2 = utf8Bytes2(ENVELOPE_AAD_LABEL2);
-function isPlainRecord2(value) {
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
+function inputUrl(value, stdin) {
+  if (stdin || value === "-") return readBoundedUrlStdin();
+  if (value === void 0 || value.length === 0) throw new CLIError("INVALID_ARGUMENT", "a share URL or - is required", 2);
+  return Promise.resolve(value);
 }
-function assertNoLoneSurrogates2(text) {
-  for (let i = 0; i < text.length; i++) {
-    const unit = text.charCodeAt(i);
-    if (unit >= 56320 && unit <= 57343) {
-      throw new TypeError(
-        `cannot canonicalize string with unpaired low surrogate at index ${i}`
-      );
+async function inspectShareInputOnce(value, stdin, expectedOrigin, dependencies = {}) {
+  const link2 = stdin || value === "-" ? await (dependencies.read ?? readBoundedUrlStdin)() : await inputUrl(value, false);
+  try {
+    parseNativeShareUrl(link2);
+  } catch {
+    return (dependencies.inspect ?? inspectShare)(link2, { expectedOrigin });
+  }
+  throw new CLIError("UNSUPPORTED_LINK", "native bearer links are opaque; receive the link to verify access", 2);
+}
+function jsonOutput(options, command) {
+  return options.json === true || command.optsWithGlobals().json === true;
+}
+function expires(value) {
+  try {
+    return new Date(Date.now() + parseDuration(value));
+  } catch {
+    throw new CLIError("INVALID_ARGUMENT", "invalid expiry duration", 2);
+  }
+}
+async function rememberPublishedShare(result) {
+  const record = historyRecordForPublishedShare(result);
+  if (shareServices.records === void 0) return { record, recorded: false };
+  try {
+    await shareServices.records.put(record);
+    return { record, recorded: true };
+  } catch {
+    process.stderr.write("Warning: share was published but not recorded in sender history; future share list, share notify, and share revoke by ID will not find it.\n");
+    return { record, recorded: false };
+  }
+}
+async function notifyRecordedShare(record, recipient, adapter, storage) {
+  const result = await notifyShare({ shareId: record.shareId, recipient, record, adapter, checkDeliveryWindow: true });
+  if (result.state !== "partial-failure" && storage !== void 0) {
+    const mailbox = canonicalMailbox2(recipient).email;
+    if (!record.deliveredRecipients?.includes(mailbox)) {
+      try {
+        if (storage.update === void 0) throw new Error("atomic sender history update is unavailable");
+        const updated = await storage.update(record.shareId, (current) => ({
+          ...current,
+          deliveredRecipients: current.deliveredRecipients?.includes(mailbox) ? current.deliveredRecipients : [...current.deliveredRecipients ?? [], mailbox]
+        }));
+        if (updated === void 0) throw new Error("sender history record was removed");
+      } catch {
+        process.stderr.write("Warning: delivery succeeded, but could not record its confirmation in sender history.\n");
+      }
+    }
+  }
+  return result;
+}
+function byteLimit(value) {
+  if (value === void 0) return void 0;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0 || parsed > MAX_SHARE_STDIN_BYTES) throw new CLIError("MAX_BYTES_EXCEEDED", "max-bytes must be between 1 and 100 MiB", 7);
+  return parsed;
+}
+function mediaTypeFor(filename) {
+  const extension = filename.toLowerCase().split(".").at(-1);
+  return extension === "md" || extension === "markdown" ? "text/markdown" : extension === "txt" ? "text/plain" : extension === "html" || extension === "htm" ? "text/html" : extension === "json" ? "application/json" : extension === "css" ? "text/css" : extension === "js" ? "text/javascript" : "application/octet-stream";
+}
+function requestedActions(values) {
+  const actions = values === void 0 || values.length === 0 ? ["read"] : values;
+  if (actions.some((value) => value !== "read" && value !== "list" && value !== "edit")) throw new CLIError("INVALID_ARGUMENT", "--action must be read, list, or edit", 2);
+  return [...new Set(actions)];
+}
+function assertAggregateInputLimit(inputs, maxBytes) {
+  const limit = maxBytes ?? MAX_SHARE_STDIN_BYTES;
+  let total = 0;
+  for (const input of inputs) {
+    total += input.bytes.byteLength;
+    if (!Number.isSafeInteger(total) || total > limit) throw new CLIError("MAX_BYTES_EXCEEDED", "combined share input exceeds the configured byte limit", 7);
+  }
+}
+function registerShareCommand(program2) {
+  const share = program2.command("share").description("Publish and consume TinyCloud Share links");
+  share.command("publish <files...>").description("Publish one or more bounded files as a Share").option("--name <filename>", "Filename for stdin input").option("--to <target>", "Share target", "anyone").option("--notify", "Email an exact-email recipient, or a domain mailbox on node 1.17.3+").option("--notify-to <address>", "Mailbox to invite for --to domain:<name> --notify (node 1.17.3+)").option("--expires <duration>", "Share lifetime").option("--max-bytes <bytes>", "Bound input bytes").option("--media-type <type>", "Media type for a single input").option("--action <actions...>", "Addressed permission: read, list, or edit").option("--prefix", "Publish multiple inputs beneath one addressed prefix").option("--binary", "Allow non-UTF-8 bearer content").option("--json", "Print versioned redacted JSON").option("--viewer-origin <origin>", "Canonical HTTPS viewer origin", SHARE_ORIGIN).action(async (files, options, command) => {
+    try {
+      const json = jsonOutput(options, command);
+      const maxBytes = byteLimit(options.maxBytes);
+      if (files.length === 0 || files.includes("-") && files.length > 1) throw new CLIError("INVALID_ARGUMENT", "stdin must be the only publish input", 2);
+      const name = files.length === 1 ? options.name : void 0;
+      for (const file of files) shareInputFilename(file, name);
+      const inputs = await Promise.all(files.map((file) => readShareInput(file, name, maxBytes)));
+      assertAggregateInputLimit(inputs, maxBytes);
+      const target = parseShareTarget(options.to);
+      const actions = requestedActions(options.action);
+      if (options.prefix && target.kind === "bearer") throw new CLIError("INVALID_ARGUMENT", "--prefix requires an addressed target", 2);
+      if (inputs.length > 1 && target.kind === "bearer") throw new CLIError("UNSUPPORTED_LINK", "multiple files require an addressed target", 2);
+      if (inputs.length > 1 && !options.prefix) throw new CLIError("INVALID_ARGUMENT", "multiple files require --prefix", 2);
+      if (options.notify === true && !actions.includes("read")) throw new CLIError("INVALID_ARGUMENT", "--notify requires the read action; nothing was shared", 2);
+      if (options.notifyTo !== void 0 && (options.notify !== true || target.kind !== "emailDomain")) {
+        throw new CLIError("INVALID_ARGUMENT", "--notify-to requires --to domain:<name> --notify", 2);
+      }
+      let notifyRecipient;
+      if (options.notify === true && target.kind === "email") notifyRecipient = target.address;
+      else if (options.notify === true && target.kind === "emailDomain") {
+        const mailbox = options.notifyTo === void 0 ? void 0 : canonicalMailbox2(options.notifyTo);
+        if (mailbox === void 0 || mailbox.domain !== target.domain) {
+          throw new CLIError("INVALID_ARGUMENT", "--to domain:<name> --notify requires --notify-to <email> at that exact domain (node 1.17.3+)", 2);
+        }
+        notifyRecipient = mailbox.email;
+      } else if (options.notify === true) {
+        throw new CLIError("INVALID_ARGUMENT", "--notify requires an email target, or a domain target with --notify-to on node 1.17.3+", 2);
+      }
+      const result = await publishTargetShare({
+        source: inputs[0].bytes,
+        filename: inputs[0].filename,
+        files: inputs.map((input) => ({ bytes: input.bytes, filename: input.filename, mediaType: mediaTypeFor(input.filename) })),
+        mediaType: options.mediaType ?? mediaTypeFor(inputs[0].filename),
+        allowBinary: options.binary === true,
+        target,
+        resourceKind: options.prefix || inputs.length > 1 ? "prefix" : "exact",
+        actions,
+        expiresAt: expires(options.expires ?? "7d"),
+        expiryWasExplicit: options.expires !== void 0,
+        origin: options.viewerOrigin,
+        ...maxBytes === void 0 ? {} : { maxBytes },
+        notify: options.notify === true,
+        targetAdapter: shareServices.targetAdapter
+      });
+      if ("state" in result) {
+        if (json) {
+          writeJson2({ protocol: "tinycloud-share", version: 1, authorization: authorizationRequiredJson(result) });
+          process.exitCode = 6;
+          return;
+        }
+        throw new CLIError(result.method === "openkey-device" ? "DEVICE_AUTH_REQUIRED" : "CLAIM_REQUIRED", "recipient authorization is required; continue through the configured authority adapter", 6);
+      }
+      const { record, recorded } = await rememberPublishedShare(result);
+      let notification;
+      if (notifyRecipient !== void 0) {
+        if (shareServices.delivery === void 0) throw new CLIError("AUTH_REQUIRED", "delivery authority is not configured", 3);
+        notification = await notifyRecordedShare(record, notifyRecipient, shareServices.delivery, recorded ? shareServices.records : void 0);
+        if (notification.state === "partial-failure") process.exitCode = 9;
+        if (notification.reason === "delivery-window-expired") process.stderr.write(NOTIFY_WINDOW_MESSAGE);
+      }
+      if (result.metadata.expiryClamped === true) process.stderr.write(`Share expiry clamped to session expiry (${result.metadata.expiresAt}).
+`);
+      if (json) writeJson2({ ...redactPublishedShare(result), expiryClamped: result.metadata.expiryClamped === true, ...notification === void 0 ? {} : { notification } });
+      else publishHuman(result);
+    } catch (error) {
+      handleError(shareCliError(error));
     }
-    if (unit >= 55296 && unit <= 56319) {
-      const next = text.charCodeAt(i + 1);
-      if (!(next >= 56320 && next <= 57343)) {
-        throw new TypeError(
-          `cannot canonicalize string with unpaired high surrogate at index ${i}`
-        );
+  });
+  share.command("inspect [url]").description("Verify a share link and print safe metadata").option("--stdin", "Read the complete URL from stdin").option("--json", "Print versioned redacted JSON").option("--viewer-origin <origin>", "Require this canonical Share origin", SHARE_ORIGIN).action(async (url, options, command) => {
+    try {
+      const json = jsonOutput(options, command);
+      const result = await inspectShareInputOnce(url, options.stdin === true, options.viewerOrigin);
+      if (json) writeJson2(result);
+      else inspectHuman(result);
+    } catch (error) {
+      handleError(shareCliError(error));
+    }
+  });
+  share.command("receive [url]").description("Verify and receive a share link").option("--stdin", "Read the complete URL from stdin").option("--output <directory>", "Create the file in this directory").option("--stdout", "Write verified plaintext bytes to stdout").option("--force", "Allow replacing an existing non-symlink output").option("--max-bytes <bytes>", "Bound received content bytes").option("--json", "Print versioned redacted JSON").option("--viewer-origin <origin>", "Require this canonical Share origin", SHARE_ORIGIN).action(async (url, options, command) => {
+    try {
+      const json = jsonOutput(options, command);
+      if (options.stdout && json) throw new CLIError("INVALID_ARGUMENT", "--stdout and --json are mutually exclusive", 2);
+      const maxBytes = byteLimit(options.maxBytes);
+      const link2 = await inputUrl(url, options.stdin === true);
+      let nativeLink = false;
+      try {
+        parseNativeShareUrl(link2);
+        nativeLink = true;
+      } catch {
       }
-      i++;
+      if (nativeLink) {
+        if (shareServices.nativeReader === void 0) throw new CLIError("AUTH_REQUIRED", "native TinyCloud receive is not configured", 3);
+        const native = await shareServices.nativeReader(link2);
+        if (maxBytes !== void 0 && native.bytes.byteLength > maxBytes) throw new CLIError("MAX_BYTES_EXCEEDED", "shared content exceeds max-bytes", 7);
+        if (options.stdout) {
+          process.stdout.write(Buffer.from(native.bytes));
+          return;
+        }
+        const output2 = await writeShareOutput(options.output ?? ".", native.filename, native.bytes, options.force === true);
+        if (json) writeJson2({ protocol: "tinycloud-share", version: 1, path: output2, transport: "native" });
+        else receiveHuman(output2);
+        return;
+      }
+      const result = await receiveShare(link2, {
+        expectedOrigin: options.viewerOrigin,
+        ...maxBytes === void 0 ? {} : { maxContentBlobBytes: maxBytes }
+      });
+      if ("state" in result) {
+        if (json) {
+          writeJson2({ protocol: "tinycloud-share", version: 1, authorization: authorizationRequiredJson(result) });
+          process.exitCode = 6;
+          return;
+        }
+        throw new CLIError(result.method === "openkey-device" ? "DEVICE_AUTH_REQUIRED" : "CLAIM_REQUIRED", "recipient authorization is required; resume through the configured authority adapter", 6);
+      }
+      if (options.stdout) {
+        process.stdout.write(Buffer.from(result.bytes));
+        return;
+      }
+      const output = await writeShareOutput(options.output ?? ".", result.metadata.display.filename ?? "share.md", result.bytes, options.force === true);
+      if (json) receiveJson(result, output);
+      else receiveHuman(output);
+    } catch (error) {
+      handleError(shareCliError(error));
     }
-  }
-}
-function serializeString2(text) {
-  assertNoLoneSurrogates2(text);
-  return JSON.stringify(text);
-}
-function serialize2(value) {
-  if (value === null) return "null";
-  switch (typeof value) {
-    case "boolean":
-      return JSON.stringify(value);
-    case "string":
-      return serializeString2(value);
-    case "number":
-      if (!Number.isFinite(value)) {
-        throw new TypeError(`cannot canonicalize non-finite number: ${value}`);
+  });
+  share.command("list").description("List encrypted sender history without complete bearer URLs").option("--json", "Print versioned redacted JSON").action(async (options, command) => {
+    try {
+      const json = jsonOutput(options, command);
+      if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
+      const result = await listShares(shareServices.records);
+      if (json) writeJson2({ protocol: "tinycloud-share", version: 1, shares: result });
+      else process.stdout.write(result.map((item) => `${item.shareId}	${item.target}	${item.expiresAt}`).join("\n") + (result.length ? "\n" : ""));
+    } catch (error) {
+      handleError(shareCliError(error));
+    }
+  });
+  share.command("show <id>").description("Show one redacted sender-history record").option("--reveal-link", "Explicitly include the complete link").option("--json", "Print versioned redacted JSON").action(async (id, options, command) => {
+    try {
+      const json = jsonOutput(options, command);
+      if (options.revealLink && json) throw new CLIError("INVALID_ARGUMENT", "--reveal-link cannot be combined with --json", 2);
+      if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
+      const result = await showShare({ storage: shareServices.records, shareId: id, revealLink: options.revealLink === true, link: options.revealLink ? await shareServices.linkFor?.(id) : void 0 });
+      if (json) writeJson2({ protocol: "tinycloud-share", version: 1, share: result });
+      else writeJson2(result);
+    } catch (error) {
+      handleError(shareCliError(error));
+    }
+  });
+  share.command("notify <id>").description("Retry idempotent delivery within 5 minutes of publication; after that publish a new share").requiredOption("--to <address>", "Recipient email").option("--json", "Print versioned JSON").action(async (id, options, command) => {
+    try {
+      const json = jsonOutput(options, command);
+      if (shareServices.delivery === void 0) throw new CLIError("AUTH_REQUIRED", "delivery authority is not configured", 3);
+      if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
+      const record = await shareServices.records.get(id);
+      if (record === void 0) throw new CLIError("NOT_FOUND", "share not found", 4);
+      if (!record.actions.includes("tinycloud.kv/get")) {
+        throw new CLIError("INVALID_ARGUMENT", "share notify requires a stored share with the read action; no invitation was sent", 2);
       }
-      return JSON.stringify(value);
-    case "object":
-      break;
-    default:
-      throw new TypeError(`cannot canonicalize value of type ${typeof value}`);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map((item) => serialize2(item)).join(",")}]`;
-  }
-  if (!isPlainRecord2(value)) {
-    throw new TypeError("cannot canonicalize non-plain object");
-  }
-  const keys = Object.keys(value).sort();
-  const members = [];
-  for (const key of keys) {
-    const member = value[key];
-    if (member === void 0) continue;
-    members.push(`${serializeString2(key)}:${serialize2(member)}`);
-  }
-  return `{${members.join(",")}}`;
-}
-function canonicalize2(value) {
-  return serialize2(value);
+      const mailbox = canonicalMailbox2(options.to);
+      if (mailbox === void 0) throw new ShareNotifyError("recipient is invalid");
+      if (!recipientMatchesShareRecord(record, mailbox.email)) throw new ShareNotifyError("recipient does not match the stored share target");
+      if (record.recipientMatcher.kind === "emailDomain" && shareDeliveryWindowExpiresAt(record) > Date.now()) {
+        if (shareServices.assertDomainDelivery === void 0) throw new CLIError("UNAVAILABLE", "could not verify TinyCloud node 1.17.3 domain delivery support; no invitation was sent", 4);
+        await shareServices.assertDomainDelivery();
+      }
+      const result = await notifyRecordedShare(record, options.to, shareServices.delivery, shareServices.records);
+      if (json) writeJson2(result);
+      else process.stdout.write(`${result.state}
+`);
+      if (result.reason === "delivery-window-expired") process.stderr.write(NOTIFY_WINDOW_MESSAGE);
+      if (result.state === "partial-failure") process.exitCode = 9;
+    } catch (error) {
+      handleError(shareCliError(error, "notify"));
+    }
+  });
+  share.command("revoke <id>").description("Revoke addressed shares; report bearer retention honestly").option("--ancestor", "Revoke the owner delegation ancestry").option("--json", "Print versioned JSON").action(async (id, options, command) => {
+    try {
+      const json = jsonOutput(options, command);
+      if (shareServices.records === void 0) throw new CLIError("AUTH_REQUIRED", "sender history storage is not configured", 3);
+      const record = shareServices.getRecord ? await shareServices.getRecord(id) : await shareServices.records.get(id);
+      if (record === void 0) throw new CLIError("NOT_FOUND", "share not found", 4);
+      const result = await revokeShare({ record, records: shareServices.records, adapter: shareServices.revocation, scope: options.ancestor ? "ancestor" : "direct" });
+      if (result.state === "unsupported") {
+        throw new CLIError("UNSUPPORTED_TARGET", result.reason, 2);
+      }
+      if (json) writeJson2({ protocol: "tinycloud-share", version: 1, result });
+      else process.stdout.write(`${result.state}
+`);
+    } catch (error) {
+      handleError(shareCliError(error));
+    }
+  });
 }
-var MAX_INLINE_BYTES2 = 256 * 1024;
 
 // src/share/adapters.ts
+init_profiles();
+init_constants();
+import { readFile as readFile4 } from "fs/promises";
+import { join as join6 } from "path";
+import { createHash } from "crypto";
+import { writeJsonAtomic as writeJsonAtomic2 } from "@tinycloud/operations/state";
 import { LocationRecordValidationError, LocationRegistryHttpError, revokePolicyRootV3 } from "@tinycloud/sdk-core";
 import { extractSiweExpiration, InvalidRestoredSessionError } from "@tinycloud/node-sdk";
 function requiredKvAction(meta) {
@@ -17073,6 +17253,28 @@ function throwKvUploadFailure(error) {
   throw new SharePublishAuthorityError({ kind: "upload-failed" });
 }
 var DEFAULT_SHARE_ORIGIN = "https://share.tinycloud.xyz";
+var MIN_DOMAIN_DELIVERY_VERSION = "1.17.3";
+function supportsDomainDelivery(version2) {
+  if (typeof version2 !== "string") return false;
+  const normalized = version2.trim();
+  if (normalized.length > 128) return false;
+  const match = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(normalized);
+  if (match === null) return false;
+  if (match[4] !== void 0 && /(?:^|\.)0[0-9]+(?:\.|$)/.test(match[4])) return false;
+  const major = Number(match[1]);
+  const minor = Number(match[2]);
+  const patch = Number(match[3]);
+  if (!Number.isSafeInteger(major) || !Number.isSafeInteger(minor) || !Number.isSafeInteger(patch)) return false;
+  if (major !== 1) return major > 1;
+  if (minor !== 17) return minor > 17;
+  if (patch !== 3) return patch > 3;
+  return match[4] === void 0;
+}
+function displayedNodeVersion(version2) {
+  if (typeof version2 !== "string") return "(unrecognized)";
+  const trimmed = version2.trim();
+  return /^[A-Za-z0-9.+_-]{1,64}$/.test(trimmed) ? trimmed : "(unrecognized)";
+}
 var URI_SAFE_FILENAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 function safeStorageFilename(filename) {
   if (URI_SAFE_FILENAME.test(filename) && !filename.includes("..")) return filename;
@@ -17083,6 +17285,12 @@ function safeStorageFilename(filename) {
 }
 function createEncryptedSessionHistory() {
   const records = /* @__PURE__ */ new Map();
+  let operation = Promise.resolve();
+  const serial = (action) => {
+    const next = operation.then(action, action);
+    operation = next.then(() => void 0, () => void 0);
+    return next;
+  };
   let keyPromise;
   const key = async () => keyPromise ??= crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
   const encode6 = async (record) => {
@@ -17097,35 +17305,45 @@ function createEncryptedSessionHistory() {
   const decode10 = async (value) => JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await crypto.subtle.decrypt({ name: "AES-GCM", iv: value.slice(0, 12) }, await key(), value.slice(12))));
   return {
     async put(record) {
-      records.set(record.shareId, await encode6(record));
+      return serial(async () => {
+        records.set(record.shareId, await encode6(record));
+      });
+    },
+    async update(shareId, change) {
+      return serial(async () => {
+        const value = records.get(shareId);
+        if (value === void 0) return void 0;
+        const updated = await change(await decode10(value));
+        records.set(shareId, await encode6(updated));
+        return updated;
+      });
     },
     async list() {
-      return Promise.all([...records.values()].map(decode10));
+      return serial(() => Promise.all([...records.values()].map(decode10)));
     },
     async get(shareId) {
-      const value = records.get(shareId);
-      return value === void 0 ? void 0 : decode10(value);
+      return serial(async () => {
+        const value = records.get(shareId);
+        return value === void 0 ? void 0 : decode10(value);
+      });
     },
     async delete(shareId) {
-      records.delete(shareId);
+      return serial(async () => {
+        records.delete(shareId);
+      });
     }
   };
 }
 function createEncryptedProfileHistory(profileName, sessionSigner) {
   const HISTORY_VERSION = 2;
-  let profileSecretPromise;
+  const identityChanged = new Error("share history profile or key changed");
+  const saltChanged = new Error("share history salt changed");
   let operation = Promise.resolve();
-  const profileSecret = async () => profileSecretPromise ??= (async () => {
-    const profile = await profileName();
-    const config = await ProfileManager.getProfile(profile);
-    if (typeof config.privateKey === "string" && config.privateKey.length > 0) return new TextEncoder().encode(config.privateKey);
-    if (sessionSigner === void 0) {
-      throw new Error("share history requires an initialized profile");
-    }
-    return sessionSigner(new TextEncoder().encode("xyz.tinycloud.share/history-key/v1"));
-  })();
-  const path = async () => join6(await ProfileManager.getCacheDir(await profileName()), "share-history-v2.json");
-  const legacyPath = async () => join6(await ProfileManager.getCacheDir(await profileName()), "share-history-v1.bin");
+  const observedProfiles = /* @__PURE__ */ new Set();
+  let preparedKeys;
+  let preparedKey;
+  const path = async (profile) => join6(await ProfileManager.getCacheDir(profile), "share-history-v2.json");
+  const legacyPath = async (profile) => join6(await ProfileManager.getCacheDir(profile), "share-history-v1.bin");
   const b64 = (value) => Buffer.from(value).toString("base64url");
   const unb64 = (value) => {
     if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share history is unavailable");
@@ -17133,81 +17351,165 @@ function createEncryptedProfileHistory(profileName, sessionSigner) {
     if (b64(bytes) !== value) throw new Error("share history is unavailable");
     return bytes;
   };
-  const derive = async (salt, legacy = false) => {
-    const secret = await profileSecret();
-    if (legacy) {
-      const digest = await crypto.subtle.digest("SHA-256", secret);
-      return crypto.subtle.importKey("raw", digest, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+  const isStoredRecord = (value) => typeof value === "object" && value !== null && "shareId" in value && typeof value.shareId === "string";
+  const identity = async (profile) => {
+    const config = await ProfileManager.getProfile(profile);
+    const localKey = typeof config.privateKey === "string" && config.privateKey.length > 0;
+    const [key, session] = localKey ? [null, null] : await Promise.all([ProfileManager.getKey(profile), ProfileManager.getSession(profile)]);
+    const sessionJwk = session !== null && "jwk" in session ? session.jwk : void 0;
+    const signerJwk = sessionJwk !== null && typeof sessionJwk === "object" && "d" in sessionJwk && typeof sessionJwk.d === "string" && sessionJwk.d.length > 0 ? sessionJwk : key;
+    const method = session !== null && "verificationMethod" in session ? session.verificationMethod ?? config.did : config.did;
+    const fingerprint = createHash("sha256").update(JSON.stringify(localKey ? ["local", config.privateKey] : ["openkey", sessionJwk, signerJwk, method])).digest("hex");
+    return { config, fingerprint };
+  };
+  const prepareKeys = async (profile, snapshot) => {
+    if (preparedKeys?.profile === profile && preparedKeys.identity === snapshot.fingerprint) return preparedKeys;
+    let secret;
+    if (typeof snapshot.config.privateKey === "string" && snapshot.config.privateKey.length > 0) {
+      secret = new TextEncoder().encode(snapshot.config.privateKey);
+    } else {
+      if (sessionSigner === void 0) throw new Error("share history requires an initialized profile");
+      secret = await sessionSigner(new TextEncoder().encode("xyz.tinycloud.share/history-key/v1"), profile);
     }
+    if ((await identity(profile)).fingerprint !== snapshot.fingerprint) throw identityChanged;
     const material = await crypto.subtle.importKey("raw", secret, "PBKDF2", false, ["deriveKey"]);
-    return crypto.subtle.deriveKey({ name: "PBKDF2", salt, iterations: 1e5, hash: "SHA-256" }, material, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+    const digest = await crypto.subtle.digest("SHA-256", secret);
+    const legacyKey = await crypto.subtle.importKey("raw", digest, { name: "AES-GCM" }, false, ["decrypt"]);
+    return preparedKeys = { profile, identity: snapshot.fingerprint, material, legacyKey };
   };
-  const read4 = async () => {
+  const preparedSalt = async (profile) => {
     try {
-      const encoded = new Uint8Array(await readFile4(await path()));
-      const envelope = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(encoded));
+      const envelope = JSON.parse(await readFile4(await path(profile), "utf8"));
       if (envelope.version !== HISTORY_VERSION) throw new Error("share history is unavailable");
       const salt = unb64(envelope.kdfSalt);
+      if (salt.length < 16) throw new Error("share history is unavailable");
+      return salt;
+    } catch (error) {
+      if (error.code === "ENOENT") return crypto.getRandomValues(new Uint8Array(16));
+      throw new Error("share history is unavailable");
+    }
+  };
+  const read4 = async (profile, ready) => {
+    try {
+      const envelope = JSON.parse(await readFile4(await path(profile), "utf8"));
+      if (envelope.version !== HISTORY_VERSION) throw new Error("share history is unavailable");
+      if (envelope.kdfSalt !== b64(ready.salt)) throw saltChanged;
       const iv = unb64(envelope.iv);
       const ciphertext = unb64(envelope.ciphertext);
-      if (salt.length < 16 || iv.length !== 12 || ciphertext.length <= 16) throw new Error("share history is unavailable");
-      const bytes = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, await derive(salt), ciphertext);
+      if (iv.length !== 12 || ciphertext.length <= 16) throw new Error("share history is unavailable");
+      const bytes = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, ready.key, ciphertext);
       const values = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-      return { values: Array.isArray(values) ? values.filter((value) => typeof value === "object" && value !== null && typeof value.shareId === "string") : [], salt };
+      return Array.isArray(values) ? values.filter(isStoredRecord) : [];
     } catch (error) {
+      if (error === saltChanged) throw error;
       if (error.code !== "ENOENT") throw new Error("share history is unavailable");
       try {
-        const legacy = new Uint8Array(await readFile4(await legacyPath()));
-        if (legacy.length <= 12) return { values: [], salt: crypto.getRandomValues(new Uint8Array(16)) };
-        const bytes = await crypto.subtle.decrypt({ name: "AES-GCM", iv: legacy.slice(0, 12) }, await derive(new Uint8Array(0), true), legacy.slice(12));
+        const legacy = new Uint8Array(await readFile4(await legacyPath(profile)));
+        if (legacy.length <= 12) return [];
+        const bytes = await crypto.subtle.decrypt({ name: "AES-GCM", iv: legacy.slice(0, 12) }, ready.legacyKey, legacy.slice(12));
         const values = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-        return { values: Array.isArray(values) ? values.filter((value) => typeof value === "object" && value !== null && typeof value.shareId === "string") : [], salt: crypto.getRandomValues(new Uint8Array(16)) };
+        return Array.isArray(values) ? values.filter(isStoredRecord) : [];
       } catch (legacyError) {
-        if (legacyError.code === "ENOENT") return { values: [], salt: crypto.getRandomValues(new Uint8Array(16)) };
+        if (legacyError.code === "ENOENT") return [];
         throw new Error("share history is unavailable");
       }
     }
   };
-  const write = async (values, salt) => {
+  const write = async (profile, values, ready) => {
     const iv = crypto.getRandomValues(new Uint8Array(12));
     const bytes = new TextEncoder().encode(JSON.stringify(values));
-    const encrypted = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await derive(salt), bytes));
-    const output = new TextEncoder().encode(JSON.stringify({ version: HISTORY_VERSION, kdfSalt: b64(salt), iv: b64(iv), ciphertext: b64(encrypted) }));
-    await writeFile2(await path(), output, { mode: 384 });
+    const encrypted = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, ready.key, bytes));
+    await writeJsonAtomic2(await path(profile), { version: HISTORY_VERSION, kdfSalt: b64(ready.salt), iv: b64(iv), ciphertext: b64(encrypted) });
   };
-  const serial = (operationFn) => {
-    const next = operation.then(operationFn, operationFn);
+  const serial = (action) => {
+    const next = operation.then(action, action);
     operation = next.then(() => void 0, () => void 0);
     return next;
   };
+  const locked = (action, writing = false) => serial(async () => {
+    const profile = await profileName();
+    let warned = false;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        const snapshot = await identity(profile);
+        observedProfiles.add(profile);
+        const keys = await prepareKeys(profile, snapshot);
+        const salt = await preparedSalt(profile);
+        const saltId = b64(salt);
+        const key = preparedKey?.profile === profile && preparedKey.identity === snapshot.fingerprint && preparedKey.salt === saltId ? preparedKey.key : await crypto.subtle.deriveKey(
+          { name: "PBKDF2", salt, iterations: 1e5, hash: "SHA-256" },
+          keys.material,
+          { name: "AES-GCM", length: 256 },
+          false,
+          ["encrypt", "decrypt"]
+        );
+        preparedKey = { profile, identity: snapshot.fingerprint, salt: saltId, key };
+        const warning = writing ? setTimeout(() => {
+          if (!warned) {
+            warned = true;
+            process.stderr.write(`Waiting for profile lock for ${JSON.stringify(profile)} before updating sender history.
+`);
+          }
+        }, 2e3) : void 0;
+        warning?.unref();
+        try {
+          return await ProfileManager.withLock(profile, async () => {
+            clearTimeout(warning);
+            if ((await identity(profile)).fingerprint !== snapshot.fingerprint) throw identityChanged;
+            return action(profile, { salt, key, legacyKey: keys.legacyKey });
+          }, writing ? { timeoutMs: PROFILE_COMMIT_LOCK_TIMEOUT_MS } : void 0);
+        } finally {
+          clearTimeout(warning);
+        }
+      } catch (error) {
+        if (error === saltChanged || error === identityChanged) continue;
+        if (observedProfiles.has(profile) && typeof error === "object" && error !== null && "code" in error && error.code === "PROFILE_NOT_FOUND") {
+          throw new ShareHistoryRetryError(profile);
+        }
+        throw error;
+      }
+    }
+    throw new ShareHistoryRetryError(profile);
+  });
   return {
     async put(record) {
-      return serial(async () => {
-        const state = await read4();
-        const values = [...state.values];
+      return locked(async (profile, ready) => {
+        const values = await read4(profile, ready);
         const index = values.findIndex((value) => value.shareId === record.shareId);
         if (index >= 0) values[index] = record;
         else values.push(record);
-        await write(values, state.salt);
-      });
+        await write(profile, values, ready);
+      }, true);
+    },
+    async update(shareId, change) {
+      return locked(async (profile, ready) => {
+        const values = await read4(profile, ready);
+        const index = values.findIndex((record) => record.shareId === shareId);
+        if (index < 0) return void 0;
+        const updated = await change(values[index]);
+        values[index] = updated;
+        await write(profile, values, ready);
+        return updated;
+      }, true);
     },
     async list() {
-      return serial(async () => (await read4()).values);
+      return locked((profile, ready) => read4(profile, ready));
     },
     async get(shareId) {
-      return serial(async () => (await read4()).values.find((record) => record.shareId === shareId));
+      return locked(async (profile, ready) => (await read4(profile, ready)).find((record) => record.shareId === shareId));
     },
     async delete(shareId) {
-      return serial(async () => {
-        const state = await read4();
-        await write(state.values.filter((record) => record.shareId !== shareId), state.salt);
-      });
+      return locked(async (profile, ready) => {
+        await write(profile, (await read4(profile, ready)).filter((record) => record.shareId !== shareId), ready);
+      }, true);
     }
   };
 }
 function createShareAuthorityAdapters(input = {}) {
   const origin = input.origin ?? DEFAULT_SHARE_ORIGIN;
   const fetchFn = input.fetchFn ?? globalThis.fetch;
+  let selectedProfile;
+  const profileName = () => selectedProfile ??= input.profileName?.() ?? selectedProfileName();
   const canonicalOrigin2 = (value, label) => {
     if (typeof value !== "string") throw new Error(`share ${label} is unavailable`);
     const parsed = new URL(value);
@@ -17237,7 +17539,7 @@ function createShareAuthorityAdapters(input = {}) {
   let nodePromise;
   let activeProfileName2;
   const authenticatedNode = async () => nodePromise ??= (async () => {
-    const profile = await (input.profileName?.() ?? selectedProfileName());
+    const profile = await profileName();
     activeProfileName2 = profile;
     const context = await ProfileManager.resolveContext({ profile, ...input.nodeOrigin === void 0 ? {} : { host: input.nodeOrigin } });
     const { ensureAuthenticated: ensureAuthenticated2 } = await Promise.resolve().then(() => (init_sdk(), sdk_exports));
@@ -17256,6 +17558,38 @@ function createShareAuthorityAdapters(input = {}) {
       throw error;
     }
   })();
+  const assertDomainDeliveryForOrigin = async (nodeOrigin, operation) => {
+    let response;
+    try {
+      response = await fetchFn(`${nodeOrigin}/info`, { signal: AbortSignal.timeout(5e3) });
+    } catch {
+      throw new SharePublishAuthorityError({ kind: "node-info-unavailable" });
+    }
+    if (!response.ok) throw new SharePublishAuthorityError({ kind: "node-info-unavailable" });
+    let body;
+    try {
+      body = await response.text();
+    } catch {
+      throw new SharePublishAuthorityError({ kind: "node-info-unavailable" });
+    }
+    let info;
+    try {
+      info = JSON.parse(body);
+    } catch {
+      info = void 0;
+    }
+    const version2 = typeof info === "object" && info !== null && "version" in info ? info.version : void 0;
+    if (!supportsDomainDelivery(version2)) {
+      throw new SharePublishAuthorityError({
+        kind: "invalid-request",
+        reason: `domain notifications require tinycloud-node ${MIN_DOMAIN_DELIVERY_VERSION} or later; node reports version ${displayedNodeVersion(version2)}. Upgrade the node before inviting; ${operation === "publish" ? "nothing was shared and no invitation was sent" : "no invitation was sent"}`
+      });
+    }
+  };
+  const assertDomainDelivery = async () => {
+    const node = await authenticatedNode();
+    await assertDomainDeliveryForOrigin((await node.activeNodeIdentity()).origin, "notify");
+  };
   const targetAdapter = { async publish(targetInput) {
     if (input.publishTarget !== void 0) return input.publishTarget(targetInput);
     const [config, node] = await Promise.all([publicConfig(), authenticatedNode()]);
@@ -17306,6 +17640,9 @@ function createShareAuthorityAdapters(input = {}) {
       });
     }
     const activeNode = await node.activeNodeIdentity();
+    if (targetInput.notify === true && targetInput.target.kind === "emailDomain") {
+      await assertDomainDeliveryForOrigin(activeNode.origin, "publish");
+    }
     const shareId = crypto.randomUUID().replaceAll("-", "");
     const files = targetInput.files === void 0 || targetInput.files.length === 0 ? [{ bytes: targetInput.source, filename: targetInput.filename, mediaType: targetInput.mediaType }] : targetInput.files;
     const resourceKind = targetInput.resourceKind ?? "exact";
@@ -17470,12 +17807,10 @@ function createShareAuthorityAdapters(input = {}) {
   const delivery = { deliver: input.deliver ?? (async (request) => {
     const record = request.record;
     if (record === void 0 || record.link === void 0 || record.deliveryMaterial === void 0 || request.idempotencyKey === void 0) throw new Error("share delivery history is incomplete");
+    const expiry = shareDeliveryWindowExpiresAt(record);
+    if (expiry <= Date.now()) throw new ShareNotifyError("share delivery authorization window has expired", "delivery-window-expired");
+    const authorizationExpiresAt = new Date(expiry).toISOString();
     const [config, node] = await Promise.all([publicConfig(), authenticatedNode()]);
-    const authorizationExpiresAt = new Date(Math.min(
-      Date.parse(record.expiresAt),
-      Date.parse(record.registeredAt) + 5 * 60 * 1e3
-    )).toISOString();
-    if (Date.parse(authorizationExpiresAt) <= Date.now()) throw new Error("share delivery authorization retry window has expired");
     const receipt = await node.authorizeShareDeliveryV3({
       envelope: record.deliveryMaterial.envelope,
       sealedEnvelope: record.deliveryMaterial.sealedEnvelope,
@@ -17536,14 +17871,16 @@ function createShareAuthorityAdapters(input = {}) {
   };
   return {
     targetAdapter,
-    records: input.profileName === void 0 ? createEncryptedSessionHistory() : createEncryptedProfileHistory(input.profileName, async (bytes) => {
-      const profileName = await input.profileName();
-      const context = await ProfileManager.resolveContext({ profile: profileName });
+    records: input.profileName === void 0 ? createEncryptedSessionHistory() : createEncryptedProfileHistory(profileName, async (bytes, profile) => {
+      const context = await ProfileManager.resolveContext({ profile });
+      if (context.profile !== profile) throw new ShareHistoryRetryError(profile);
       const { ensureAuthenticated: ensureAuthenticated2 } = await Promise.resolve().then(() => (init_sdk(), sdk_exports));
-      return (await ensureAuthenticated2(context)).signSessionBytes(bytes);
+      const signer = await ensureAuthenticated2(context);
+      return signer.signSessionBytes(bytes);
     }),
     delivery,
     revocation,
+    assertDomainDelivery,
     nativeReader
   };
 }
@@ -17602,6 +17939,7 @@ configureShareCommandServices({
   targetAdapter: shareAuthority.targetAdapter,
   records: shareAuthority.records,
   delivery: shareAuthority.delivery,
+  assertDomainDelivery: shareAuthority.assertDomainDelivery,
   revocation: shareAuthority.revocation,
   nativeReader: shareAuthority.nativeReader
 });