@tinycloud/sdk-core 2.11.0-beta.0 → 2.11.0-beta.10

package/dist/delegations/index.d.cts

@@ -1,5 +1,6 @@
-import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-B2wH53_t.cjs';
-export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationParams, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, m as Delegation, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, w as DelegationRevocationReceipt, x as DelegationStatus, E as EncodedShareData, G as GenerateShareParams, y as ISharingService, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationReceipt, T as OwnerShareAction, U as OwnerShareMatcher, V as OwnerSharePolicyRegistration, W as OwnerSharePolicyRegistrationReceipt, X as OwnerSharePolicyV2, Y as ReceiveOptions, Z as RegisterOwnerSharePolicyParams, _ as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, $ as SenderShareKeyStorage, a0 as SenderShareRecord, a1 as SenderShareRecordStorage, a2 as SenderShareRevocationScope, a3 as SenderShareStore, a4 as ShareAccess, a5 as ShareAccessError, a6 as ShareAccessV2, a7 as ShareAction, a8 as ShareActionSchema, a9 as ShareAddressedDelegationEnvelopeV2, aa as ShareAddressedDelegationEnvelopeV2Schema, ab as ShareAddressedDelegationRequestV2, ac as ShareAddressedDelegationRequestV2Schema, ad as ShareAddressedDelegationResponseV2, ae as ShareAddressedDelegationResponseV2Schema, af as ShareAddressedRecipientMatcher, ag as ShareArtifactInput, ah as ShareArtifactResult, ai as ShareArtifactV2, aj as ShareCache, ak as ShareCacheEntry, al as ShareCacheKey, am as ShareCacheMetadata, an as ShareCapabilityLike, ao as ShareConflict, ap as ShareContentMetadata, aq as ShareContentSource, ar as ShareDeliveryAuthorization, as as ShareDeliveryAuthorizationReceipt, at as ShareDeliveryAuthorizationRequest, au as ShareDetachedProof, av as ShareEnvelopeError, aw as ShareEnvelopeV2, ax as ShareExpiryBounds, ay as ShareKvContentSource, az as ShareLink, aA as ShareLinkData, aB as ShareLinkLocation, aC as ShareListEntry, aD as ShareListResult, aE as ShareNativeAction, aF as ShareNativeInvokeEnvelopeV1, aG as ShareNativeInvokeErrorResult, aH as ShareNativeInvokeInput, aI as ShareNativeInvokeResult, aJ as ShareNativeInvokeSuccessResult, aK as ShareNativeResponse, aL as ShareNativeResponseSchema, aM as SharePolicy, aN as SharePolicyBinding, aO as SharePolicySession, aP as SharePolicySessionV1, aQ as SharePolicySessionWireV1, aR as ShareReadInvocationV1, aS as ShareReadResult, aT as ShareRecipientClient, aU as ShareRecipientClientOptions, aV as ShareRecipientClientOptionsSchema, aW as ShareRecipientPolicy, aX as ShareRecipientPolicySchema, aY as ShareRecipientResult, aZ as ShareRecipientTarget, a_ as ShareRecipientTargetSchema, a$ as ShareResource, b0 as ShareResourceSchema, b1 as ShareSaveOptions, b2 as ShareSchema, b3 as ShareSqlContentSource, b4 as ShareWireAction, b5 as SharingService, b6 as SharingServiceConfig, b7 as SignedDelegation, b8 as SpaceInfo, b9 as SpaceOwnership, ba as ValidateShareDeliveryAuthorizationExpected, bb as VerifyShareEnvelopeOptions, bc as canonicalOwnerSharePolicy, bd as computeOwnerShareRegistrationCid, be as computeShareCid, bf as createDelegatedShareKey, bg as createPolicyEnforcementDelegation, bh as createShareArtifact, bi as createShareArtifactAsync, bj as createSharePolicy, bk as createSharingService, bl as decryptShareBytesAsync, bm as encodeInlineShareUrl, bn as encodeShareArtifact, bo as encodeShareUrl, bp as encryptShareBytes, bq as encryptShareBytesAsync, br as intersectShareCapabilities, bs as isV2ShareLink, bt as normalizeShareActions, bu as normalizeShareRecipientTarget, bv as normalizeShareResource, bw as parseShareArtifact, bx as parseShareUrl, by as restoreDelegatedShareKey, bz as shareCapabilityAllows, bA as shareDeliveryTrustedKid, bB as signShareEnvelope, bC as validateOwnerSharePolicyRegistration, bD as validateOwnerSharePolicyRegistrationBytes, bE as validateShareDeliveryAuthorizationBytes, bF as verifyShareCid, bG as verifyShareEnvelope } from '../recipient-types.schema-B2wH53_t.cjs';
+import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-D5pDlIqn.cjs';
+export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationParams, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, m as Delegation, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, w as DelegationRevocationReceipt, x as DelegationStatus, E as EncodedShareData, G as GenerateShareParams, y as ISharingService, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as ReceiveOptions, $ as RegisterOwnerSharePolicyParams, a0 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a1 as SenderShareKeyStorage, a2 as SenderShareRecord, a3 as SenderShareRecordStorage, a4 as SenderShareRevocationScope, a5 as SenderShareStore, a6 as ShareAccess, a7 as ShareAccessError, a8 as ShareAccessV2, a9 as ShareAction, aa as ShareActionSchema, ab as ShareAddressedDelegationEnvelopeV2, ac as ShareAddressedDelegationEnvelopeV2Schema, ad as ShareAddressedDelegationRequestV2, ae as ShareAddressedDelegationRequestV2Schema, af as ShareAddressedDelegationResponseV2, ag as ShareAddressedDelegationResponseV2Schema, ah as ShareAddressedRecipientMatcher, ai as ShareArtifactInput, aj as ShareArtifactResult, ak as ShareArtifactV2, al as ShareCache, am as ShareCacheEntry, an as ShareCacheKey, ao as ShareCacheMetadata, ap as ShareCapabilityLike, aq as ShareConflict, ar as ShareContentMetadata, as as ShareContentSource, at as ShareDeliveryAuthorization, au as ShareDeliveryAuthorizationReceipt, av as ShareDeliveryAuthorizationRequest, aw as ShareDetachedProof, ax as ShareEnvelopeError, ay as ShareEnvelopeV2, az as ShareExpiryBounds, aA as ShareKvContentSource, aB as ShareLink, aC as ShareLinkData, aD as ShareLinkLocation, aE as ShareListEntry, aF as ShareListResult, aG as ShareNativeAction, aH as ShareNativeInvokeEnvelopeV1, aI as ShareNativeInvokeErrorResult, aJ as ShareNativeInvokeInput, aK as ShareNativeInvokeResult, aL as ShareNativeInvokeSuccessResult, aM as ShareNativeResponse, aN as ShareNativeResponseSchema, aO as SharePolicy, aP as SharePolicyBinding, aQ as SharePolicySession, aR as SharePolicySessionV1, aS as SharePolicySessionWireV1, aT as ShareReadInvocationV1, aU as ShareReadResult, aV as ShareRecipientClient, aW as ShareRecipientClientOptions, aX as ShareRecipientClientOptionsSchema, aY as ShareRecipientPolicy, aZ as ShareRecipientPolicySchema, a_ as ShareRecipientResult, a$ as ShareRecipientTarget, b0 as ShareRecipientTargetSchema, b1 as ShareResource, b2 as ShareResourceSchema, b3 as ShareSaveOptions, b4 as ShareSchema, b5 as ShareSqlContentSource, b6 as ShareWireAction, b7 as SharingService, b8 as SharingServiceConfig, b9 as SignedDelegation, ba as SpaceInfo, bb as SpaceOwnership, bc as ValidateShareDeliveryAuthorizationExpected, bd as VerifyShareEnvelopeOptions, be as canonicalOwnerSharePolicy, bf as computeOwnerShareRegistrationCid, bg as computeShareCid, bh as createDelegatedShareKey, bi as createPolicyEnforcementDelegation, bj as createShareArtifact, bk as createShareArtifactAsync, bl as createSharePolicy, bm as createSharingService, bn as decryptShareBytesAsync, bo as encodeInlineShareUrl, bp as encodeShareArtifact, bq as encodeShareUrl, br as encryptShareBytes, bs as encryptShareBytesAsync, bt as intersectShareCapabilities, bu as isV2ShareLink, bv as normalizeShareActions, bw as normalizeShareRecipientTarget, bx as normalizeShareResource, by as parseShareArtifact, bz as parseShareUrl, bA as restoreDelegatedShareKey, bB as shareCapabilityAllows, bC as shareDeliveryTrustedKid, bD as signShareEnvelope, bE as validateOwnerSharePolicyRegistration, bF as validateOwnerSharePolicyRegistrationBytes, bG as validateShareDeliveryAuthorizationBytes, bH as verifyShareCid, bI as verifyShareEnvelope } from '../recipient-types.schema-D5pDlIqn.cjs';
+export { EncryptedSenderShareHistory, EncryptedShareHistoryStorage, LegacyMigrationResult, LegacyShareReader, MemoryEncryptedShareHistoryStorage, ShareAuthorizationAdapter, ShareAuthorizationDenied, ShareAuthorizationMethod, ShareAuthorizationReady, ShareAuthorizationRequired, ShareAuthorizationResult, ShareDeliveryAdapter, ShareErrorCode, ShareErrorInfo, ShareFetchOptions, ShareHistoryView, ShareInspection, ShareMetadata, ShareNotifyResult, ShareNotifyState, SharePolicyPublishAdapter, ShareReceiveError, ShareReceiveResult, ShareRevocationAdapter, ShareRevocationResult, ShareTarget, TargetPublishAdapter, TargetPublishInput, TargetPublishOutcome, VerifyBearerEnvelopeOptions, authorizationMethodForTarget, authorizeShare, claimShare, inspectShare, isLegacyShareLink, listShares, migrateShare, notifyShare, publishPolicyShare, publishTargetShare, receiveLegacyShare, receiveShare, resumeShareAuthorization, revokeShare, showShare, toShareErrorInfo, verifyBearerEnvelope } from '@tinycloud/share-sdk';
 import { z } from 'zod';
 import { ServiceSession, InvokeFunction, FetchFunction, IKVService } from '@tinycloud/sdk-services';
 

package/dist/delegations/index.d.ts

@@ -1,5 +1,6 @@
-import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-B2wH53_t.js';
-export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationParams, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, m as Delegation, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, w as DelegationRevocationReceipt, x as DelegationStatus, E as EncodedShareData, G as GenerateShareParams, y as ISharingService, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationReceipt, T as OwnerShareAction, U as OwnerShareMatcher, V as OwnerSharePolicyRegistration, W as OwnerSharePolicyRegistrationReceipt, X as OwnerSharePolicyV2, Y as ReceiveOptions, Z as RegisterOwnerSharePolicyParams, _ as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, $ as SenderShareKeyStorage, a0 as SenderShareRecord, a1 as SenderShareRecordStorage, a2 as SenderShareRevocationScope, a3 as SenderShareStore, a4 as ShareAccess, a5 as ShareAccessError, a6 as ShareAccessV2, a7 as ShareAction, a8 as ShareActionSchema, a9 as ShareAddressedDelegationEnvelopeV2, aa as ShareAddressedDelegationEnvelopeV2Schema, ab as ShareAddressedDelegationRequestV2, ac as ShareAddressedDelegationRequestV2Schema, ad as ShareAddressedDelegationResponseV2, ae as ShareAddressedDelegationResponseV2Schema, af as ShareAddressedRecipientMatcher, ag as ShareArtifactInput, ah as ShareArtifactResult, ai as ShareArtifactV2, aj as ShareCache, ak as ShareCacheEntry, al as ShareCacheKey, am as ShareCacheMetadata, an as ShareCapabilityLike, ao as ShareConflict, ap as ShareContentMetadata, aq as ShareContentSource, ar as ShareDeliveryAuthorization, as as ShareDeliveryAuthorizationReceipt, at as ShareDeliveryAuthorizationRequest, au as ShareDetachedProof, av as ShareEnvelopeError, aw as ShareEnvelopeV2, ax as ShareExpiryBounds, ay as ShareKvContentSource, az as ShareLink, aA as ShareLinkData, aB as ShareLinkLocation, aC as ShareListEntry, aD as ShareListResult, aE as ShareNativeAction, aF as ShareNativeInvokeEnvelopeV1, aG as ShareNativeInvokeErrorResult, aH as ShareNativeInvokeInput, aI as ShareNativeInvokeResult, aJ as ShareNativeInvokeSuccessResult, aK as ShareNativeResponse, aL as ShareNativeResponseSchema, aM as SharePolicy, aN as SharePolicyBinding, aO as SharePolicySession, aP as SharePolicySessionV1, aQ as SharePolicySessionWireV1, aR as ShareReadInvocationV1, aS as ShareReadResult, aT as ShareRecipientClient, aU as ShareRecipientClientOptions, aV as ShareRecipientClientOptionsSchema, aW as ShareRecipientPolicy, aX as ShareRecipientPolicySchema, aY as ShareRecipientResult, aZ as ShareRecipientTarget, a_ as ShareRecipientTargetSchema, a$ as ShareResource, b0 as ShareResourceSchema, b1 as ShareSaveOptions, b2 as ShareSchema, b3 as ShareSqlContentSource, b4 as ShareWireAction, b5 as SharingService, b6 as SharingServiceConfig, b7 as SignedDelegation, b8 as SpaceInfo, b9 as SpaceOwnership, ba as ValidateShareDeliveryAuthorizationExpected, bb as VerifyShareEnvelopeOptions, bc as canonicalOwnerSharePolicy, bd as computeOwnerShareRegistrationCid, be as computeShareCid, bf as createDelegatedShareKey, bg as createPolicyEnforcementDelegation, bh as createShareArtifact, bi as createShareArtifactAsync, bj as createSharePolicy, bk as createSharingService, bl as decryptShareBytesAsync, bm as encodeInlineShareUrl, bn as encodeShareArtifact, bo as encodeShareUrl, bp as encryptShareBytes, bq as encryptShareBytesAsync, br as intersectShareCapabilities, bs as isV2ShareLink, bt as normalizeShareActions, bu as normalizeShareRecipientTarget, bv as normalizeShareResource, bw as parseShareArtifact, bx as parseShareUrl, by as restoreDelegatedShareKey, bz as shareCapabilityAllows, bA as shareDeliveryTrustedKid, bB as signShareEnvelope, bC as validateOwnerSharePolicyRegistration, bD as validateOwnerSharePolicyRegistrationBytes, bE as validateShareDeliveryAuthorizationBytes, bF as verifyShareCid, bG as verifyShareEnvelope } from '../recipient-types.schema-B2wH53_t.js';
+import { I as ICapabilityKeyRegistry, D as DelegationManager, R as Result, a as DelegationError } from '../recipient-types.schema-D5pDlIqn.js';
+export { A as AccountDelegationPage, b as AccountDelegationQueryOptions, c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, e as CreateDelegationParams, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, m as Delegation, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, w as DelegationRevocationReceipt, x as DelegationStatus, E as EncodedShareData, G as GenerateShareParams, y as ISharingService, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as ReceiveOptions, $ as RegisterOwnerSharePolicyParams, a0 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a1 as SenderShareKeyStorage, a2 as SenderShareRecord, a3 as SenderShareRecordStorage, a4 as SenderShareRevocationScope, a5 as SenderShareStore, a6 as ShareAccess, a7 as ShareAccessError, a8 as ShareAccessV2, a9 as ShareAction, aa as ShareActionSchema, ab as ShareAddressedDelegationEnvelopeV2, ac as ShareAddressedDelegationEnvelopeV2Schema, ad as ShareAddressedDelegationRequestV2, ae as ShareAddressedDelegationRequestV2Schema, af as ShareAddressedDelegationResponseV2, ag as ShareAddressedDelegationResponseV2Schema, ah as ShareAddressedRecipientMatcher, ai as ShareArtifactInput, aj as ShareArtifactResult, ak as ShareArtifactV2, al as ShareCache, am as ShareCacheEntry, an as ShareCacheKey, ao as ShareCacheMetadata, ap as ShareCapabilityLike, aq as ShareConflict, ar as ShareContentMetadata, as as ShareContentSource, at as ShareDeliveryAuthorization, au as ShareDeliveryAuthorizationReceipt, av as ShareDeliveryAuthorizationRequest, aw as ShareDetachedProof, ax as ShareEnvelopeError, ay as ShareEnvelopeV2, az as ShareExpiryBounds, aA as ShareKvContentSource, aB as ShareLink, aC as ShareLinkData, aD as ShareLinkLocation, aE as ShareListEntry, aF as ShareListResult, aG as ShareNativeAction, aH as ShareNativeInvokeEnvelopeV1, aI as ShareNativeInvokeErrorResult, aJ as ShareNativeInvokeInput, aK as ShareNativeInvokeResult, aL as ShareNativeInvokeSuccessResult, aM as ShareNativeResponse, aN as ShareNativeResponseSchema, aO as SharePolicy, aP as SharePolicyBinding, aQ as SharePolicySession, aR as SharePolicySessionV1, aS as SharePolicySessionWireV1, aT as ShareReadInvocationV1, aU as ShareReadResult, aV as ShareRecipientClient, aW as ShareRecipientClientOptions, aX as ShareRecipientClientOptionsSchema, aY as ShareRecipientPolicy, aZ as ShareRecipientPolicySchema, a_ as ShareRecipientResult, a$ as ShareRecipientTarget, b0 as ShareRecipientTargetSchema, b1 as ShareResource, b2 as ShareResourceSchema, b3 as ShareSaveOptions, b4 as ShareSchema, b5 as ShareSqlContentSource, b6 as ShareWireAction, b7 as SharingService, b8 as SharingServiceConfig, b9 as SignedDelegation, ba as SpaceInfo, bb as SpaceOwnership, bc as ValidateShareDeliveryAuthorizationExpected, bd as VerifyShareEnvelopeOptions, be as canonicalOwnerSharePolicy, bf as computeOwnerShareRegistrationCid, bg as computeShareCid, bh as createDelegatedShareKey, bi as createPolicyEnforcementDelegation, bj as createShareArtifact, bk as createShareArtifactAsync, bl as createSharePolicy, bm as createSharingService, bn as decryptShareBytesAsync, bo as encodeInlineShareUrl, bp as encodeShareArtifact, bq as encodeShareUrl, br as encryptShareBytes, bs as encryptShareBytesAsync, bt as intersectShareCapabilities, bu as isV2ShareLink, bv as normalizeShareActions, bw as normalizeShareRecipientTarget, bx as normalizeShareResource, by as parseShareArtifact, bz as parseShareUrl, bA as restoreDelegatedShareKey, bB as shareCapabilityAllows, bC as shareDeliveryTrustedKid, bD as signShareEnvelope, bE as validateOwnerSharePolicyRegistration, bF as validateOwnerSharePolicyRegistrationBytes, bG as validateShareDeliveryAuthorizationBytes, bH as verifyShareCid, bI as verifyShareEnvelope } from '../recipient-types.schema-D5pDlIqn.js';
+export { EncryptedSenderShareHistory, EncryptedShareHistoryStorage, LegacyMigrationResult, LegacyShareReader, MemoryEncryptedShareHistoryStorage, ShareAuthorizationAdapter, ShareAuthorizationDenied, ShareAuthorizationMethod, ShareAuthorizationReady, ShareAuthorizationRequired, ShareAuthorizationResult, ShareDeliveryAdapter, ShareErrorCode, ShareErrorInfo, ShareFetchOptions, ShareHistoryView, ShareInspection, ShareMetadata, ShareNotifyResult, ShareNotifyState, SharePolicyPublishAdapter, ShareReceiveError, ShareReceiveResult, ShareRevocationAdapter, ShareRevocationResult, ShareTarget, TargetPublishAdapter, TargetPublishInput, TargetPublishOutcome, VerifyBearerEnvelopeOptions, authorizationMethodForTarget, authorizeShare, claimShare, inspectShare, isLegacyShareLink, listShares, migrateShare, notifyShare, publishPolicyShare, publishTargetShare, receiveLegacyShare, receiveShare, resumeShareAuthorization, revokeShare, showShare, toShareErrorInfo, verifyBearerEnvelope } from '@tinycloud/share-sdk';
 import { z } from 'zod';
 import { ServiceSession, InvokeFunction, FetchFunction, IKVService } from '@tinycloud/sdk-services';
 

package/dist/delegations/index.js

@@ -2153,13 +2153,12 @@ function digest(input, options) {
 }
 var identity2 = { code: code2, name, encode: encode4, digest };
 
-// ../../node_modules/multiformats/dist/src/hashes/sha2.js
-var sha2_exports = {};
-__export(sha2_exports, {
+// ../../node_modules/multiformats/dist/src/hashes/sha2-browser.js
+var sha2_browser_exports = {};
+__export(sha2_browser_exports, {
   sha256: () => sha256,
   sha512: () => sha512
 });
-import crypto2 from "crypto";
 
 // ../../node_modules/multiformats/dist/src/hashes/hasher.js
 var DEFAULT_MIN_DIGEST_LENGTH = 20;
@@ -2209,16 +2208,19 @@ function createDigest(digest4, code3, truncate) {
   return create(code3, digest4);
 }
 
-// ../../node_modules/multiformats/dist/src/hashes/sha2.js
+// ../../node_modules/multiformats/dist/src/hashes/sha2-browser.js
+function sha(name2) {
+  return async (data) => new Uint8Array(await crypto.subtle.digest(name2, data));
+}
 var sha256 = from2({
   name: "sha2-256",
   code: 18,
-  encode: (input) => coerce(crypto2.createHash("sha256").update(input).digest())
+  encode: sha("SHA-256")
 });
 var sha512 = from2({
   name: "sha2-512",
   code: 19,
-  encode: (input) => coerce(crypto2.createHash("sha512").update(input).digest())
+  encode: sha("SHA-512")
 });
 
 // ../../node_modules/multiformats/dist/src/cid.js
@@ -2560,7 +2562,7 @@ var cidSymbol = /* @__PURE__ */ Symbol.for("@ipld/js-cid/CID");
 
 // ../../node_modules/multiformats/dist/src/basics.js
 var bases = { ...identity_exports, ...base2_exports, ...base8_exports, ...base10_exports, ...base16_exports, ...base32_exports, ...base36_exports, ...base58_exports, ...base64_exports, ...base256emoji_exports };
-var hashes = { ...sha2_exports, ...identity_exports2 };
+var hashes = { ...sha2_browser_exports, ...identity_exports2 };
 
 // src/delegations/SharingService.ts
 import { ed25519 as ed255193 } from "@noble/curves/ed25519";
@@ -2733,6 +2735,10 @@ function normalizeRecipient(recipient) {
     }
     return { kind: recipient.kind, value: domain };
   }
+  if (recipient.kind === "recipientDid") {
+    if (!isCanonicalRecipientDid(recipient.value)) throw new ShareEnvelopeError("invalid-envelope", "recipient DID is invalid");
+    return { kind: recipient.kind, value: recipient.value };
+  }
   const exact = recipient.value.trim();
   const at = exact.lastIndexOf("@");
   const normalizedExact = at > 0 ? `${exact.slice(0, at)}@${exact.slice(at + 1).toLowerCase()}` : exact;
@@ -2741,6 +2747,28 @@ function normalizeRecipient(recipient) {
   }
   return { kind: recipient.kind, value: normalizedExact };
 }
+function isCanonicalRecipientDid(value) {
+  if (value.length === 0 || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value)) return false;
+  const parts = value.split(":");
+  if (parts.length < 3 || parts[0] !== "did" || !/^[a-z0-9]+$/.test(parts[1] ?? "")) return false;
+  const identifier = parts.slice(2);
+  if (identifier.some((part) => part.length === 0)) return false;
+  if (parts[1] === "web") {
+    const host = identifier[0] ?? "";
+    if (host.length > 253 || host.split(".").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-"))) return false;
+    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  }
+  if (parts[1] === "pkh") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  if (parts[1] === "key") {
+    try {
+      const bytes2 = base58btc.decode(identifier.join(":"));
+      return bytes2.length === 34 && bytes2[0] === 237 && bytes2[1] === 1;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
 function normalizeShareRecipientTarget(recipient) {
   const normalized = normalizeRecipient(recipient);
   if (normalized === void 0) throw new ShareEnvelopeError("invalid-envelope", "recipient matcher is required");
@@ -2827,9 +2855,9 @@ function verifyShareEnvelope(envelope, options = {}) {
     const recipient = normalizeRecipient(envelope.recipient);
     if (recipient !== void 0 && JSON.stringify(recipient) !== JSON.stringify(envelope.recipient)) throw new ShareEnvelopeError("invalid-envelope", "recipient is not canonical");
     if (recipient?.kind === "exactEmail" || recipient?.kind === "emailDomain") throw new ShareEnvelopeError("unsafe-plaintext", "recipient matchers are not public envelope fields");
-    if (envelope.recipientKind !== void 0 && !["exactEmail", "emailDomain", "bearer"].includes(envelope.recipientKind)) throw new ShareEnvelopeError("invalid-envelope", "recipient mode is invalid");
+    if (envelope.recipientKind !== void 0 && !["exactEmail", "emailDomain", "recipientDid", "bearer"].includes(envelope.recipientKind)) throw new ShareEnvelopeError("invalid-envelope", "recipient mode is invalid");
     if (envelope.recipientKind === "bearer" && recipient?.kind !== void 0 && recipient.kind !== "bearer") throw new ShareEnvelopeError("invalid-envelope", "recipient mode does not match recipient");
-    if ((envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain") && !envelope.encrypted) throw new ShareEnvelopeError("unsafe-plaintext", "policy shares require encryption");
+    if ((envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain" || envelope.recipientKind === "recipientDid") && !envelope.encrypted) throw new ShareEnvelopeError("unsafe-plaintext", "addressed shares require encryption");
     if (typeof envelope.spaceId !== "string" || envelope.spaceId.length === 0 || typeof envelope.content.mimeType !== "string" || envelope.content.mimeType.length === 0 || typeof envelope.content.digest !== "string" || !/^[A-Za-z0-9_-]+$/.test(envelope.content.digest)) throw new ShareEnvelopeError("invalid-envelope", "content metadata is invalid");
     const maxContentBytes = envelope.encrypted ? options.maxSealedContentBytes ?? MAX_SEALED_SHARE_CONTENT_BYTES : options.maxContentBytes ?? MAX_SHARE_CONTENT_BYTES;
     if (!Number.isInteger(envelope.content.size) || envelope.content.size < 0 || envelope.content.size > maxContentBytes) throw new ShareEnvelopeError("content-too-large", "share content exceeds the configured limit");
@@ -2968,7 +2996,7 @@ function parsePolicyMetadata(policyBytes, target, expectedExpiry) {
     assertKeys(policy, ["type", "version", "issuerDid", "recipientMatcher", "target", "delegation", "authority", "actions", "resource", "content-source", "expiresAt"], "published canonical policy material");
     if (typeof policy.issuerDid !== "string" || typeof policy.expiresAt !== "string" || policy.expiresAt !== expectedExpiry) throw new ShareEnvelopeError("invalid-envelope", "policy expiry is not bound to the envelope");
     const matcherValue = policy.recipientMatcher;
-    if (!isPlainObject(matcherValue) || matcherValue.kind !== "exactEmail" && matcherValue.kind !== "emailDomain" || typeof matcherValue.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
+    if (!isPlainObject(matcherValue) || matcherValue.kind !== "exactEmail" && matcherValue.kind !== "emailDomain" && matcherValue.kind !== "recipientDid" || typeof matcherValue.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
     const matcher2 = normalizeRecipient(matcherValue);
     if (matcher2 === void 0 || matcher2.kind === "bearer") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
     if (!isPlainObject(policy.target)) throw new ShareEnvelopeError("invalid-envelope", "policy target is invalid");
@@ -3055,7 +3083,7 @@ function parseCanonicalPublishedV2(value, options) {
   if (!Number.isFinite(expiry) || expiry <= (options.now ?? /* @__PURE__ */ new Date()).getTime() || new Date(expiry).toISOString() !== value.expiry) throw new ShareEnvelopeError("expired", "published share envelope has expired");
   if (typeof delegation.cid !== "string" || typeof delegation.issuerDid !== "string" || typeof delegation.audience !== "string" || typeof delegation.expiresAt !== "string" || Date.parse(delegation.expiresAt) > expiry) throw new ShareEnvelopeError("invalid-envelope", "published v2 delegation is invalid");
   const matcher = value.recipientMatcher;
-  if (!isPlainObject(matcher) || matcher.kind !== "exactEmail" && matcher.kind !== "emailDomain" || typeof matcher.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
+  if (!isPlainObject(matcher) || matcher.kind !== "exactEmail" && matcher.kind !== "emailDomain" && matcher.kind !== "recipientDid" || typeof matcher.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
   const normalizedMatcher = normalizeRecipient(matcher);
   if (normalizedMatcher === void 0 || normalizedMatcher.kind === "bearer") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
   if (!Array.isArray(value.actions)) throw new ShareEnvelopeError("invalid-envelope", "published v2 actions are invalid");
@@ -3496,10 +3524,11 @@ var ShareConflict = class extends Error {
   }
 };
 var ShareAccessError = class extends Error {
-  constructor(code3, message) {
+  constructor(code3, message, details) {
     super(message ?? "shared access could not be completed");
     this.name = "ShareAccessError";
     this.code = code3;
+    this.details = details;
   }
 };
 
@@ -3508,6 +3537,7 @@ import { z as z3 } from "zod";
 var ShareRecipientTargetSchema = z3.discriminatedUnion("kind", [
   z3.object({ kind: z3.literal("exactEmail"), value: z3.string().min(1) }).strict(),
   z3.object({ kind: z3.literal("emailDomain"), value: z3.string().min(1) }).strict(),
+  z3.object({ kind: z3.literal("recipientDid"), value: z3.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),
   z3.object({ kind: z3.literal("bearer") }).strict()
 ]);
 var ShareResourceSchema = z3.discriminatedUnion("kind", [
@@ -3551,7 +3581,8 @@ var ShareContentSourceSchema = z3.discriminatedUnion("kind", [
 ]);
 var ShareAddressedRecipientSchema = z3.discriminatedUnion("kind", [
   z3.object({ kind: z3.literal("exactEmail"), value: z3.string().min(1) }).strict(),
-  z3.object({ kind: z3.literal("emailDomain"), value: z3.string().min(1) }).strict()
+  z3.object({ kind: z3.literal("emailDomain"), value: z3.string().min(1) }).strict(),
+  z3.object({ kind: z3.literal("recipientDid"), value: z3.string().regex(/^did:[a-z0-9]+:.+$/) }).strict()
 ]);
 var ShareAddressedDelegationRequestV2Schema = z3.object({
   version: z3.literal(2),
@@ -3806,12 +3837,21 @@ var ShareRecipientClient = class {
       const { envelope } = resolved.artifact;
       const { location } = resolved;
       const bearer = isBearerEnvelope(envelope);
-      const policy = envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain";
+      const policy = envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain" || envelope.authorizationTargetKind === "recipientDid";
       const legacyBearer = !policy && envelope.recipientKind === void 0;
-      if (envelope.authorizationTargetKind === "recipientDid") throw new ShareAccessError("SHARE_RECIPIENT_DID_UNSUPPORTED");
+      let recipientDidSession;
+      if (envelope.authorizationTargetKind === "recipientDid") {
+        if (this.options.establishRecipientDidSession === void 0) throw new ShareAccessError("SHARE_DEVICE_AUTH_REQUIRED", "an OpenKey device authorization is required");
+        const authorization = await this.options.establishRecipientDidSession({ envelope, recipientDid: envelope.recipient?.kind === "recipientDid" ? envelope.recipient.value : "" });
+        if ("state" in authorization) {
+          if (authorization.state === "authorization-required") throw new ShareAccessError("SHARE_DEVICE_AUTH_REQUIRED", "an OpenKey device authorization is required", authorization);
+          throw new ShareAccessError("SHARE_DENIED", "recipient DID authorization was denied", authorization);
+        }
+        recipientDidSession = authorization;
+      }
       if (policy && this.options.bearerSession !== void 0) throw new ShareAccessError("SHARE_POLICY_BEARER_MISMATCH");
       if (bearer && this.options.presentation !== void 0) throw new ShareAccessError("SHARE_BEARER_PRESENTATION_MISMATCH");
-      const session = bearer || legacyBearer ? this.options.bearerSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
+      const session = bearer || legacyBearer ? this.options.bearerSession : recipientDidSession ? recipientDidSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
       const kv = bearer || legacyBearer ? session === void 0 ? void 0 : this.createKV(envelope.origin, session) : void 0;
       const policySession = policy ? session : void 0;
       if (policySession !== void 0) this.assertProvidedPolicySession(policySession, envelope);
@@ -5710,15 +5750,11 @@ function verifySignedChild(result, expected, computeCid) {
 
 // src/delegations/owner-policy.ts
 import { ed25519 as ed255195 } from "@noble/curves/ed25519";
-import { sha256 as sha2567 } from "@noble/hashes/sha256";
+import { sha256 as sha2566 } from "@noble/hashes/sha256";
 
 // src/policy/signed-object.ts
 import { ed25519 as ed255194 } from "@noble/curves/ed25519";
-import { bytesToHex as bytesToHex2, sha256 as sha2566, verifyMessage } from "viem";
-
-// src/policy/capability.ts
-import { CAPABILITY_REGISTRY } from "@tinycloud/bootstrap";
-import { bytesToHex, sha256 as sha2565 } from "viem";
+import { bytesToHex, sha256 as sha2565, verifyMessage } from "viem";
 
 // src/policy/errors.ts
 var SignedObjectProfileError = class extends Error {
@@ -5916,33 +5952,11 @@ function assertUnicodeScalarString(value, path) {
   }
 }
 
-// src/policy/capability.ts
+// src/policy/signed-object.ts
 var textEncoder2 = new TextEncoder();
 var objectHasOwn2 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
   Object.prototype.hasOwnProperty
 );
-var CEILING_SERVICES = /* @__PURE__ */ new Set(["tinycloud.kv", "tinycloud.sql", "tinycloud.vfs"]);
-var GRANTABLE_ACTIONS = /* @__PURE__ */ new Map();
-for (const entry of CAPABILITY_REGISTRY) {
-  if (!CEILING_SERVICES.has(entry.service)) {
-    continue;
-  }
-  if (entry.aliasOf !== void 0 || entry.implies !== void 0 || entry.urn.endsWith("/*")) {
-    continue;
-  }
-  const existing = GRANTABLE_ACTIONS.get(entry.service);
-  if (existing === void 0) {
-    GRANTABLE_ACTIONS.set(entry.service, /* @__PURE__ */ new Set([entry.urn]));
-    continue;
-  }
-  existing.add(entry.urn);
-}
-
-// src/policy/signed-object.ts
-var textEncoder3 = new TextEncoder();
-var objectHasOwn3 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
-  Object.prototype.hasOwnProperty
-);
 function canonicalizeSignedObjectUnsigned(input) {
   return jcsCanonicalize(input);
 }
@@ -5974,10 +5988,10 @@ function fromB64(value) {
   throw new Error("base64url decoding is unavailable");
 }
 function cid(bytesValue) {
-  return CID.createV1(code, create(sha256.code, sha2567(bytesValue))).toString(base32.encoder);
+  return CID.createV1(code, create(sha256.code, sha2566(bytesValue))).toString(base32.encoder);
 }
 function digest3(bytesValue) {
-  return b64(sha2567(bytesValue));
+  return b64(sha2566(bytesValue));
 }
 function didKeyFromEd25519PublicKey(publicKey) {
   if (publicKey.length !== 32) throw new Error("share key public key must be 32 bytes");
@@ -6104,6 +6118,10 @@ async function createPolicyEnforcementDelegation(input) {
     spaceId: input.spaceId,
     path: input.path,
     actions: [...input.actions],
+    ...input.decryption === void 0 ? {} : {
+      decryptionNetworkId: input.decryption.networkId,
+      decryptionAction: input.decryption.action
+    },
     contentSourceDigest: input.contentSourceDigest,
     expiresAt: input.expiresAt
   };
@@ -6123,7 +6141,9 @@ function computeOwnerShareRegistrationCid(registration) {
 function validateOwnerSharePolicyRegistration(value, expected) {
   if (cid(expected.policy.bytes) !== expected.policy.cid) throw new Error("submitted owner-share policy bytes do not match its CID");
   const root = assertObject(value, ["registration", "proof"], "owner-share registration response");
-  const registration = assertObject(root.registration, ["registrationCid", "policyCid", "ownerDelegationCid", "enforcementDelegationCid", "ownerDid", "shareKeyDid", "enforcerDid", "shareId", "recipientMatcher", "target", "resource", "actions", "contentSource", "contentSourceDigest", "registeredAt", "expiresAt"], "owner-share registration");
+  const rawRegistration = root.registration;
+  const hasDecryption = typeof rawRegistration === "object" && rawRegistration !== null && Object.prototype.hasOwnProperty.call(rawRegistration, "decryption");
+  const registration = assertObject(root.registration, ["registrationCid", "policyCid", "ownerDelegationCid", "enforcementDelegationCid", "ownerDid", "shareKeyDid", "enforcerDid", "shareId", "recipientMatcher", "target", "resource", "actions", ...hasDecryption ? ["decryption"] : [], "contentSource", "contentSourceDigest", "registeredAt", "expiresAt"], "owner-share registration");
   const proof = assertObject(root.proof, ["alg", "kid", "signature"], "owner-share registration proof");
   if (registration.policyCid !== expected.policy.cid || registration.ownerDelegationCid !== expected.ownerDelegation.delegationCid || registration.enforcementDelegationCid !== expected.enforcementDelegation.cid || registration.contentSourceDigest !== expected.contentSourceDigest) throw new Error("owner-share registration is not bound to the submitted chain");
   let policyValue;
@@ -6139,7 +6159,9 @@ function validateOwnerSharePolicyRegistration(value, expected) {
   const registrationTarget = registration.target;
   const registrationResource = registration.resource;
   const enforcementFacts = expected.enforcementDelegation.facts;
-  if (typeof target?.origin !== "string" || typeof target.nodeAudience !== "string" || typeof target.enforcerDid !== "string" || typeof target.spaceId !== "string" || typeof resource?.kind !== "string" || !["exact", "prefix"].includes(resource.kind) || typeof resource?.path !== "string" || !Array.isArray(policy.actions) || policy.ownerDid !== registration.ownerDid || policy.shareKeyDid !== registration.shareKeyDid || policy.shareId !== registration.shareId || canonicalizeSignedObjectUnsigned(policy.recipientMatcher) !== canonicalizeSignedObjectUnsigned(registration.recipientMatcher) || target.origin !== registrationTarget.origin || target.nodeAudience !== registrationTarget.nodeAudience || target.enforcerDid !== registration.enforcerDid || target.spaceId !== registrationTarget.spaceId || resource.kind !== registrationResource.kind || resource.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(policy.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || canonicalizeSignedObjectUnsigned(policy.contentSource) !== canonicalizeSignedObjectUnsigned(registration.contentSource) || policy.expiresAt !== registration.expiresAt || policy.contentSourceDigest !== registration.contentSourceDigest || enforcementFacts.ownerDelegationCid !== registration.ownerDelegationCid || enforcementFacts.policyCid !== registration.policyCid || enforcementFacts.shareKeyDid !== registration.shareKeyDid || enforcementFacts.enforcerDid !== registration.enforcerDid || enforcementFacts.nodeAudience !== registrationTarget.nodeAudience || enforcementFacts.spaceId !== registrationTarget.spaceId || enforcementFacts.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(enforcementFacts.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || enforcementFacts.expiresAt !== registration.expiresAt) throw new Error("owner-share registration is not bound to the canonical policy");
+  const decryption = policy.decryption;
+  const decryptionMatches = decryption === void 0 ? registration.decryption === void 0 : registration.decryption !== void 0 && canonicalizeSignedObjectUnsigned(decryption) === canonicalizeSignedObjectUnsigned(registration.decryption);
+  if (typeof target?.origin !== "string" || typeof target.nodeAudience !== "string" || typeof target.enforcerDid !== "string" || typeof target.spaceId !== "string" || typeof resource?.kind !== "string" || !["exact", "prefix"].includes(resource.kind) || typeof resource?.path !== "string" || !Array.isArray(policy.actions) || policy.ownerDid !== registration.ownerDid || policy.shareKeyDid !== registration.shareKeyDid || policy.shareId !== registration.shareId || canonicalizeSignedObjectUnsigned(policy.recipientMatcher) !== canonicalizeSignedObjectUnsigned(registration.recipientMatcher) || target.origin !== registrationTarget.origin || target.nodeAudience !== registrationTarget.nodeAudience || target.enforcerDid !== registration.enforcerDid || target.spaceId !== registrationTarget.spaceId || resource.kind !== registrationResource.kind || resource.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(policy.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || !decryptionMatches || canonicalizeSignedObjectUnsigned(policy.contentSource) !== canonicalizeSignedObjectUnsigned(registration.contentSource) || policy.expiresAt !== registration.expiresAt || policy.contentSourceDigest !== registration.contentSourceDigest || enforcementFacts.ownerDelegationCid !== registration.ownerDelegationCid || enforcementFacts.policyCid !== registration.policyCid || enforcementFacts.shareKeyDid !== registration.shareKeyDid || enforcementFacts.enforcerDid !== registration.enforcerDid || enforcementFacts.nodeAudience !== registrationTarget.nodeAudience || enforcementFacts.spaceId !== registrationTarget.spaceId || enforcementFacts.path !== registrationResource.path || canonicalizeSignedObjectUnsigned(enforcementFacts.actions) !== canonicalizeSignedObjectUnsigned(registration.actions) || enforcementFacts.decryptionNetworkId !== decryption?.networkId || enforcementFacts.decryptionAction !== decryption?.action || enforcementFacts.expiresAt !== registration.expiresAt) throw new Error("owner-share registration is not bound to the canonical policy");
   if (typeof registration.registrationCid !== "string" || typeof registration.expiresAt !== "string" || typeof registration.registeredAt !== "string") throw new Error("owner-share registration timestamps are invalid");
   if (new Date(registration.expiresAt).toISOString() !== registration.expiresAt || Date.parse(registration.expiresAt) <= Date.now()) throw new Error("owner-share registration is expired or non-canonical");
   const { registrationCid: _registrationCid, ...registrationCore } = registration;
@@ -6241,7 +6263,7 @@ function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
   const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
   const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
   const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.jti || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
+  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
     throw new Error("share delivery authorization is not bound to the submitted request");
   }
   if (typeof authorization.issuedAt !== "string" || Date.parse(authorization.issuedAt) > Date.now() + 6e4) throw new Error("share delivery authorization issuedAt is invalid");
@@ -6375,14 +6397,42 @@ var SenderShareStore = class {
     await this.keys.delete(shareId);
   }
 };
+
+// src/delegations/index.ts
+import {
+  authorizeShare,
+  authorizationMethodForTarget,
+  notifyShare,
+  revokeShare,
+  listShares,
+  showShare,
+  publishTargetShare,
+  publishPolicyShare,
+  claimShare,
+  resumeShareAuthorization,
+  isLegacyShareLink,
+  receiveLegacyShare,
+  migrateShare,
+  MemoryEncryptedShareHistoryStorage,
+  EncryptedSenderShareHistory
+} from "@tinycloud/share-sdk";
+import {
+  inspectShare,
+  receiveShare,
+  ShareReceiveError,
+  toShareErrorInfo,
+  verifyBearerEnvelope
+} from "@tinycloud/share-sdk";
 export {
   DelegationErrorCodes,
   DelegationManager,
   EncodedShareDataSchema,
+  EncryptedSenderShareHistory,
   MAX_CONTENT_BYTES,
   MAX_SEALED_SHARE_CONTENT_BYTES,
   MAX_SHARE_ARTIFACT_BYTES,
   MAX_SHARE_CONTENT_BYTES,
+  MemoryEncryptedShareHistoryStorage,
   MemorySenderShareKeyStorage,
   MemorySenderShareRecordStorage,
   MemoryShareCache,
@@ -6397,6 +6447,7 @@ export {
   ShareConflict,
   ShareEnvelopeError,
   ShareNativeResponseSchema,
+  ShareReceiveError,
   ShareRecipientClient,
   ShareRecipientClientOptionsSchema,
   ShareRecipientPolicySchema,
@@ -6404,7 +6455,10 @@ export {
   ShareResourceSchema,
   SharingService,
   SharingServiceConfigSchema,
+  authorizationMethodForTarget,
+  authorizeShare,
   canonicalOwnerSharePolicy,
+  claimShare,
   computeOwnerShareRegistrationCid,
   computeShareCid,
   createDelegatedShareKey,
@@ -6419,23 +6473,37 @@ export {
   encodeShareUrl,
   encryptShareBytes,
   encryptShareBytesAsync,
+  inspectShare,
   intersectShareCapabilities,
+  isLegacyShareLink,
   isV2ShareLink,
+  listShares,
+  migrateShare,
   normalizeShareActions,
   normalizeShareRecipientTarget,
   normalizeShareResource,
+  notifyShare,
   parseShareArtifact,
   parseShareUrl,
+  publishPolicyShare,
+  publishTargetShare,
+  receiveLegacyShare,
+  receiveShare,
   restoreDelegatedShareKey,
+  resumeShareAuthorization,
+  revokeShare,
   shareCapabilityAllows,
   shareDeliveryTrustedKid,
+  showShare,
   signShareEnvelope,
+  toShareErrorInfo,
   validateEncodedShareData,
   validateOwnerSharePolicyRegistration,
   validateOwnerSharePolicyRegistrationBytes,
   validateReceiveOptions,
   validateShareDeliveryAuthorizationBytes,
   validateSharingServiceConfig,
+  verifyBearerEnvelope,
   verifyShareCid,
   verifyShareEnvelope
 };