@tinycloud/sdk-core 2.11.0-beta.1 → 2.11.0-beta.11

package/dist/delegations/index.js

@@ -1271,6 +1271,7 @@ function validateSharingServiceConfig(data) {
 
 // src/manifest.ts
 import ms from "ms";
+import { ACCOUNT_MANIFEST_PERMISSIONS } from "@tinycloud/bootstrap";
 import { resolveSecretPath, SECRET_NAME_RE } from "@tinycloud/sdk-services";
 var SERVICE_SHORT_TO_LONG = Object.freeze({
   kv: "tinycloud.kv",
@@ -2153,13 +2154,12 @@ function digest(input, options) {
 }
 var identity2 = { code: code2, name, encode: encode4, digest };
 
-// ../../node_modules/multiformats/dist/src/hashes/sha2.js
-var sha2_exports = {};
-__export(sha2_exports, {
+// ../../node_modules/multiformats/dist/src/hashes/sha2-browser.js
+var sha2_browser_exports = {};
+__export(sha2_browser_exports, {
   sha256: () => sha256,
   sha512: () => sha512
 });
-import crypto2 from "crypto";
 
 // ../../node_modules/multiformats/dist/src/hashes/hasher.js
 var DEFAULT_MIN_DIGEST_LENGTH = 20;
@@ -2209,16 +2209,19 @@ function createDigest(digest4, code3, truncate) {
   return create(code3, digest4);
 }
 
-// ../../node_modules/multiformats/dist/src/hashes/sha2.js
+// ../../node_modules/multiformats/dist/src/hashes/sha2-browser.js
+function sha(name2) {
+  return async (data) => new Uint8Array(await crypto.subtle.digest(name2, data));
+}
 var sha256 = from2({
   name: "sha2-256",
   code: 18,
-  encode: (input) => coerce(crypto2.createHash("sha256").update(input).digest())
+  encode: sha("SHA-256")
 });
 var sha512 = from2({
   name: "sha2-512",
   code: 19,
-  encode: (input) => coerce(crypto2.createHash("sha512").update(input).digest())
+  encode: sha("SHA-512")
 });
 
 // ../../node_modules/multiformats/dist/src/cid.js
@@ -2560,10 +2563,10 @@ var cidSymbol = /* @__PURE__ */ Symbol.for("@ipld/js-cid/CID");
 
 // ../../node_modules/multiformats/dist/src/basics.js
 var bases = { ...identity_exports, ...base2_exports, ...base8_exports, ...base10_exports, ...base16_exports, ...base32_exports, ...base36_exports, ...base58_exports, ...base64_exports, ...base256emoji_exports };
-var hashes = { ...sha2_exports, ...identity_exports2 };
+var hashes = { ...sha2_browser_exports, ...identity_exports2 };
 
 // src/delegations/SharingService.ts
-import { ed25519 as ed255193 } from "@noble/curves/ed25519";
+import { ed25519 as ed255194 } from "@noble/curves/ed25519";
 
 // src/delegations/ShareRecipientClient.ts
 import {
@@ -2571,8 +2574,8 @@ import {
   KVService,
   ServiceContext
 } from "@tinycloud/sdk-services";
-import { ed25519 as ed255192 } from "@noble/curves/ed25519";
-import { sha256 as sha2564 } from "@noble/hashes/sha256";
+import { ed25519 as ed255193 } from "@noble/curves/ed25519";
+import { sha256 as sha2565 } from "@noble/hashes/sha256";
 
 // src/delegations/share-envelope.ts
 import { ed25519 } from "@noble/curves/ed25519";
@@ -2733,6 +2736,10 @@ function normalizeRecipient(recipient) {
     }
     return { kind: recipient.kind, value: domain };
   }
+  if (recipient.kind === "recipientDid") {
+    if (!isCanonicalRecipientDid(recipient.value)) throw new ShareEnvelopeError("invalid-envelope", "recipient DID is invalid");
+    return { kind: recipient.kind, value: recipient.value };
+  }
   const exact = recipient.value.trim();
   const at = exact.lastIndexOf("@");
   const normalizedExact = at > 0 ? `${exact.slice(0, at)}@${exact.slice(at + 1).toLowerCase()}` : exact;
@@ -2741,6 +2748,28 @@ function normalizeRecipient(recipient) {
   }
   return { kind: recipient.kind, value: normalizedExact };
 }
+function isCanonicalRecipientDid(value) {
+  if (value.length === 0 || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value)) return false;
+  const parts = value.split(":");
+  if (parts.length < 3 || parts[0] !== "did" || !/^[a-z0-9]+$/.test(parts[1] ?? "")) return false;
+  const identifier = parts.slice(2);
+  if (identifier.some((part) => part.length === 0)) return false;
+  if (parts[1] === "web") {
+    const host = identifier[0] ?? "";
+    if (host.length > 253 || host.split(".").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-"))) return false;
+    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  }
+  if (parts[1] === "pkh") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  if (parts[1] === "key") {
+    try {
+      const bytes2 = base58btc.decode(identifier.join(":"));
+      return bytes2.length === 34 && bytes2[0] === 237 && bytes2[1] === 1;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
 function normalizeShareRecipientTarget(recipient) {
   const normalized = normalizeRecipient(recipient);
   if (normalized === void 0) throw new ShareEnvelopeError("invalid-envelope", "recipient matcher is required");
@@ -2827,9 +2856,9 @@ function verifyShareEnvelope(envelope, options = {}) {
     const recipient = normalizeRecipient(envelope.recipient);
     if (recipient !== void 0 && JSON.stringify(recipient) !== JSON.stringify(envelope.recipient)) throw new ShareEnvelopeError("invalid-envelope", "recipient is not canonical");
     if (recipient?.kind === "exactEmail" || recipient?.kind === "emailDomain") throw new ShareEnvelopeError("unsafe-plaintext", "recipient matchers are not public envelope fields");
-    if (envelope.recipientKind !== void 0 && !["exactEmail", "emailDomain", "bearer"].includes(envelope.recipientKind)) throw new ShareEnvelopeError("invalid-envelope", "recipient mode is invalid");
+    if (envelope.recipientKind !== void 0 && !["exactEmail", "emailDomain", "recipientDid", "bearer"].includes(envelope.recipientKind)) throw new ShareEnvelopeError("invalid-envelope", "recipient mode is invalid");
     if (envelope.recipientKind === "bearer" && recipient?.kind !== void 0 && recipient.kind !== "bearer") throw new ShareEnvelopeError("invalid-envelope", "recipient mode does not match recipient");
-    if ((envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain") && !envelope.encrypted) throw new ShareEnvelopeError("unsafe-plaintext", "policy shares require encryption");
+    if ((envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain" || envelope.recipientKind === "recipientDid") && !envelope.encrypted) throw new ShareEnvelopeError("unsafe-plaintext", "addressed shares require encryption");
     if (typeof envelope.spaceId !== "string" || envelope.spaceId.length === 0 || typeof envelope.content.mimeType !== "string" || envelope.content.mimeType.length === 0 || typeof envelope.content.digest !== "string" || !/^[A-Za-z0-9_-]+$/.test(envelope.content.digest)) throw new ShareEnvelopeError("invalid-envelope", "content metadata is invalid");
     const maxContentBytes = envelope.encrypted ? options.maxSealedContentBytes ?? MAX_SEALED_SHARE_CONTENT_BYTES : options.maxContentBytes ?? MAX_SHARE_CONTENT_BYTES;
     if (!Number.isInteger(envelope.content.size) || envelope.content.size < 0 || envelope.content.size > maxContentBytes) throw new ShareEnvelopeError("content-too-large", "share content exceeds the configured limit");
@@ -2968,7 +2997,7 @@ function parsePolicyMetadata(policyBytes, target, expectedExpiry) {
     assertKeys(policy, ["type", "version", "issuerDid", "recipientMatcher", "target", "delegation", "authority", "actions", "resource", "content-source", "expiresAt"], "published canonical policy material");
     if (typeof policy.issuerDid !== "string" || typeof policy.expiresAt !== "string" || policy.expiresAt !== expectedExpiry) throw new ShareEnvelopeError("invalid-envelope", "policy expiry is not bound to the envelope");
     const matcherValue = policy.recipientMatcher;
-    if (!isPlainObject(matcherValue) || matcherValue.kind !== "exactEmail" && matcherValue.kind !== "emailDomain" || typeof matcherValue.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
+    if (!isPlainObject(matcherValue) || matcherValue.kind !== "exactEmail" && matcherValue.kind !== "emailDomain" && matcherValue.kind !== "recipientDid" || typeof matcherValue.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
     const matcher2 = normalizeRecipient(matcherValue);
     if (matcher2 === void 0 || matcher2.kind === "bearer") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
     if (!isPlainObject(policy.target)) throw new ShareEnvelopeError("invalid-envelope", "policy target is invalid");
@@ -3055,7 +3084,7 @@ function parseCanonicalPublishedV2(value, options) {
   if (!Number.isFinite(expiry) || expiry <= (options.now ?? /* @__PURE__ */ new Date()).getTime() || new Date(expiry).toISOString() !== value.expiry) throw new ShareEnvelopeError("expired", "published share envelope has expired");
   if (typeof delegation.cid !== "string" || typeof delegation.issuerDid !== "string" || typeof delegation.audience !== "string" || typeof delegation.expiresAt !== "string" || Date.parse(delegation.expiresAt) > expiry) throw new ShareEnvelopeError("invalid-envelope", "published v2 delegation is invalid");
   const matcher = value.recipientMatcher;
-  if (!isPlainObject(matcher) || matcher.kind !== "exactEmail" && matcher.kind !== "emailDomain" || typeof matcher.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
+  if (!isPlainObject(matcher) || matcher.kind !== "exactEmail" && matcher.kind !== "emailDomain" && matcher.kind !== "recipientDid" || typeof matcher.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
   const normalizedMatcher = normalizeRecipient(matcher);
   if (normalizedMatcher === void 0 || normalizedMatcher.kind === "bearer") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
   if (!Array.isArray(value.actions)) throw new ShareEnvelopeError("invalid-envelope", "published v2 actions are invalid");
@@ -3496,10 +3525,11 @@ var ShareConflict = class extends Error {
   }
 };
 var ShareAccessError = class extends Error {
-  constructor(code3, message) {
+  constructor(code3, message, details) {
     super(message ?? "shared access could not be completed");
     this.name = "ShareAccessError";
     this.code = code3;
+    this.details = details;
   }
 };
 
@@ -3508,6 +3538,7 @@ import { z as z3 } from "zod";
 var ShareRecipientTargetSchema = z3.discriminatedUnion("kind", [
   z3.object({ kind: z3.literal("exactEmail"), value: z3.string().min(1) }).strict(),
   z3.object({ kind: z3.literal("emailDomain"), value: z3.string().min(1) }).strict(),
+  z3.object({ kind: z3.literal("recipientDid"), value: z3.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),
   z3.object({ kind: z3.literal("bearer") }).strict()
 ]);
 var ShareResourceSchema = z3.discriminatedUnion("kind", [
@@ -3551,7 +3582,8 @@ var ShareContentSourceSchema = z3.discriminatedUnion("kind", [
 ]);
 var ShareAddressedRecipientSchema = z3.discriminatedUnion("kind", [
   z3.object({ kind: z3.literal("exactEmail"), value: z3.string().min(1) }).strict(),
-  z3.object({ kind: z3.literal("emailDomain"), value: z3.string().min(1) }).strict()
+  z3.object({ kind: z3.literal("emailDomain"), value: z3.string().min(1) }).strict(),
+  z3.object({ kind: z3.literal("recipientDid"), value: z3.string().regex(/^did:[a-z0-9]+:.+$/) }).strict()
 ]);
 var ShareAddressedDelegationRequestV2Schema = z3.object({
   version: z3.literal(2),
@@ -3634,6 +3666,506 @@ var ShareNativeResponseSchema = z3.discriminatedUnion("action", [
   }).strict()
 ]);
 
+// src/delegations/portable.ts
+import { z as z5 } from "zod";
+
+// src/policy/unified.ts
+import { sha256 as sha2564 } from "@noble/hashes/sha256";
+import { blake3 as blake32 } from "@noble/hashes/blake3";
+import { ed25519 as ed255192 } from "@noble/curves/ed25519";
+import { z as z4 } from "zod";
+
+// src/policy/errors.ts
+var SignedObjectProfileError = class extends Error {
+  constructor(code3, message) {
+    super(message);
+    this.name = "SignedObjectProfileError";
+    this.code = code3;
+  }
+};
+var SignedObjectCanonicalizationError = class extends SignedObjectProfileError {
+  constructor(message) {
+    super("canonicalization-mismatch", message);
+    this.name = "SignedObjectCanonicalizationError";
+  }
+};
+
+// src/policy/jcs.ts
+var objectHasOwn = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
+  Object.prototype.hasOwnProperty
+);
+function jcsCanonicalize(input) {
+  return serialize(normalizeJson(input, "$"));
+}
+function normalizeJson(input, path = "$") {
+  if (input === null) {
+    return null;
+  }
+  switch (typeof input) {
+    case "boolean":
+      return input;
+    case "number":
+      if (!Number.isFinite(input)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path} must be a finite JSON number`
+        );
+      }
+      return input;
+    case "string":
+      assertUnicodeScalarString(input, path);
+      return input;
+    case "object":
+      return normalizeJsonObjectOrArray(input, path);
+    case "bigint":
+    case "function":
+    case "symbol":
+    case "undefined":
+    default:
+      throw new SignedObjectCanonicalizationError(
+        `${path} is not a JSON value`
+      );
+  }
+}
+function serialize(value) {
+  if (value === null) {
+    return "null";
+  }
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "number": {
+      const encoded = JSON.stringify(value);
+      if (encoded === void 0) {
+        throw new SignedObjectCanonicalizationError(
+          "number could not be serialized as JSON"
+        );
+      }
+      return encoded;
+    }
+    case "string":
+      return JSON.stringify(value);
+    case "object":
+      if (Array.isArray(value)) {
+        return `[${value.map((item) => serialize(item)).join(",")}]`;
+      }
+      return serializeObject(value);
+    default:
+      throw new SignedObjectCanonicalizationError(
+        `unsupported JSON value type ${typeof value}`
+      );
+  }
+}
+function normalizeJsonObjectOrArray(input, path) {
+  assertNoSymbolKeys(input, path);
+  if (Array.isArray(input)) {
+    for (const key of Object.getOwnPropertyNames(input)) {
+      if (key === "length") {
+        continue;
+      }
+      if (!isArrayIndexKey(key, input.length)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}.${key} is not allowed on a JSON array`
+        );
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(input, key);
+      if (descriptor?.enumerable !== true) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}[${key}] must be an enumerable JSON array item`
+        );
+      }
+      if (!("value" in descriptor)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}[${key}] must be a JSON data property`
+        );
+      }
+    }
+    const output2 = [];
+    for (let index = 0; index < input.length; index++) {
+      if (!objectHasOwn(input, index)) {
+        throw new SignedObjectCanonicalizationError(
+          `${path}[${index}] must not be a sparse array hole`
+        );
+      }
+      output2.push(normalizeJson(input[index], `${path}[${index}]`));
+    }
+    return output2;
+  }
+  const proto = Object.getPrototypeOf(input);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new SignedObjectCanonicalizationError(
+      `${path} must be a plain JSON object`
+    );
+  }
+  const output = /* @__PURE__ */ Object.create(null);
+  for (const key of Object.getOwnPropertyNames(input)) {
+    assertUnicodeScalarString(key, `${path} key`);
+    if (key === "__proto__" || key === "constructor") {
+      throw new SignedObjectCanonicalizationError(
+        `${path}.${key} is not allowed`
+      );
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(input, key);
+    if (descriptor?.enumerable !== true) {
+      throw new SignedObjectCanonicalizationError(
+        `${path}.${key} must be an enumerable JSON object property`
+      );
+    }
+    if (!("value" in descriptor)) {
+      throw new SignedObjectCanonicalizationError(
+        `${path}.${key} must be a JSON data property`
+      );
+    }
+    const value = descriptor.value;
+    output[key] = normalizeJson(value, `${path}.${key}`);
+  }
+  return output;
+}
+function assertNoSymbolKeys(input, path) {
+  if (Object.getOwnPropertySymbols(input).length > 0) {
+    throw new SignedObjectCanonicalizationError(
+      `${path} must not have symbol properties`
+    );
+  }
+}
+function isArrayIndexKey(key, length2) {
+  if (!/^(0|[1-9]\d*)$/.test(key)) {
+    return false;
+  }
+  const index = Number(key);
+  return Number.isSafeInteger(index) && index >= 0 && index < length2;
+}
+function serializeObject(value) {
+  const keys = Object.keys(value).sort(compareUtf16CodeUnits);
+  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);
+  return `{${parts.join(",")}}`;
+}
+function compareUtf16CodeUnits(a, b) {
+  const max = Math.min(a.length, b.length);
+  for (let index = 0; index < max; index++) {
+    const leftCodeUnit = a.charCodeAt(index);
+    const rightCodeUnit = b.charCodeAt(index);
+    if (leftCodeUnit !== rightCodeUnit) {
+      return leftCodeUnit - rightCodeUnit;
+    }
+  }
+  return a.length - b.length;
+}
+function assertUnicodeScalarString(value, path) {
+  for (let index = 0; index < value.length; index++) {
+    const code3 = value.charCodeAt(index);
+    if (code3 >= 55296 && code3 <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (Number.isNaN(next) || next < 56320 || next > 57343) {
+        throw new SignedObjectCanonicalizationError(
+          `${path} contains a lone high surrogate`
+        );
+      }
+      index++;
+      continue;
+    }
+    if (code3 >= 56320 && code3 <= 57343) {
+      throw new SignedObjectCanonicalizationError(
+        `${path} contains a lone low surrogate`
+      );
+    }
+  }
+}
+
+// src/policy/unified.ts
+var POLICY_SESSION_UCAN_V1_PROFILE = "policy-session-ucan/v1";
+var POLICY_SESSION_FACT_KEYS = [
+  "profile",
+  "ownerDid",
+  "policyId",
+  "policyDigestHex",
+  "policyCid",
+  "policyDelegationCid",
+  "enforcementDelegationCid",
+  "contentSourceDigestHex",
+  "capabilityCeilingHashHex",
+  "nativeProjectionHashHex",
+  "enforcerDid",
+  "nodeAudience",
+  "recipientDid",
+  "challengeId",
+  "claimDigestHex",
+  "claimJti",
+  "vpDigestHex",
+  "credentialEvidenceDigestHex",
+  "decisionContextDigestHex",
+  "issuanceAuditDigestHex",
+  "remainingRedelegationDepth"
+];
+var CompactHeaderSchema = z4.object({
+  alg: z4.literal("EdDSA"),
+  jwk: z4.object({ alg: z4.literal("EdDSA"), crv: z4.literal("Ed25519"), kty: z4.literal("OKP"), x: z4.string().min(1) }).strict(),
+  typ: z4.literal("JWT"),
+  ucv: z4.literal("0.10.0")
+}).strict();
+var CompactPayloadSchema = z4.object({
+  att: z4.record(z4.record(z4.array(z4.unknown()).min(1))),
+  aud: z4.string().min(1),
+  exp: z4.number().int(),
+  fct: z4.array(z4.record(z4.unknown())).length(1),
+  iss: z4.string().min(1),
+  nbf: z4.number().int(),
+  nnc: z4.string().min(1),
+  prf: z4.array(z4.string().min(1))
+}).strict();
+function createCompactPolicyInvocation(input) {
+  const session = parsePolicySessionUcan(input.sessionAuthorization);
+  if (session.cid !== input.sessionCid || session.aud !== input.recipientDid)
+    throw new Error("policy session does not bind the recipient signer");
+  const principal = input.recipientDid.split("#", 1)[0];
+  const didMaterial = base58btc.decode(principal.slice("did:key:".length));
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("policy invocation signer must be did:key Ed25519");
+  const publicKey = ed255192.getPublicKey(input.privateKey);
+  if (!equalBytes2(publicKey, didMaterial.slice(2)))
+    throw new Error("policy invocation private key does not bind recipient DID");
+  const now = input.now ?? Math.floor(Date.now() / 1e3);
+  const exp = Math.min(now + 60, session.exp);
+  if (exp <= now) throw new Error("policy session has expired");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: { [input.resource]: { [input.action]: [input.caveat ?? {}] } },
+    aud: input.audienceDid,
+    exp,
+    fct: [input.facts ?? { type: "tinycloud.policy.invocation/v1", policyCid: session.fact.policyCid, sessionCid: session.cid }],
+    iss: input.recipientDid.includes("#") ? input.recipientDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: now,
+    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    prf: [session.cid]
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signingInput = new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`);
+  const signature = ed255192.sign(signingInput, input.privateKey);
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+function createCompactPolicyDescendant(input) {
+  const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);
+  if (parent.payload.aud !== input.issuerDid) throw new Error("policy descendant issuer is not the parent audience");
+  const parentFact = parent.payload.fct[0];
+  const depth = parentFact.remainingRedelegationDepth;
+  if (!Number.isInteger(depth) || depth <= 0) throw new Error("policy descendant depth is exhausted");
+  if (!compactAttenuationContains(parent.payload.att, input.attenuation))
+    throw new Error("policy descendant exceeds the parent attenuation");
+  const principal = input.issuerDid.split("#", 1)[0];
+  const didMaterial = base58btc.decode(principal.slice("did:key:".length));
+  const publicKey = ed255192.getPublicKey(input.privateKey);
+  if (didMaterial.length !== 34 || !equalBytes2(publicKey, didMaterial.slice(2))) throw new Error("policy descendant signer does not bind issuer DID");
+  const now = Math.max(input.now ?? Math.floor(Date.now() / 1e3), parent.payload.nbf + 1);
+  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);
+  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: input.attenuation,
+    aud: input.audienceDid,
+    exp,
+    fct: [{ ...parentFact, remainingRedelegationDepth: depth - 1 }],
+    iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: now,
+    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    prf: [parent.cid]
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signature = ed255192.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`), input.privateKey);
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+function compactAttenuationContains(parent, child) {
+  const selector = (value) => {
+    if (value.length !== 1 || !isRecordValue(value[0])) return void 0;
+    const caveat = value[0];
+    if (Object.keys(caveat).length !== 3 || caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || typeof caveat.value !== "string") return void 0;
+    return { kind: caveat.kind, value: caveat.value };
+  };
+  const equal = (left, right) => jcsCanonicalize(left) === jcsCanonicalize(right);
+  return Object.entries(child).every(
+    ([childResource, childActions]) => Object.entries(childActions).every(
+      ([action, childCaveats]) => Object.entries(parent).some(([parentResource, parentActions]) => {
+        const parentCaveats = parentActions[action];
+        if (parentCaveats === void 0) return false;
+        if (parentResource === childResource && equal(parentCaveats, childCaveats)) return true;
+        const parentSelector = selector(parentCaveats);
+        const childSelector = selector(childCaveats);
+        return parentSelector?.kind === "prefix" && childSelector !== void 0 && parentSelector.value === parentResource && childSelector.value === childResource && (childResource === parentResource || childResource.startsWith(`${parentResource}/`));
+      })
+    )
+  );
+}
+function isRecordValue(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseCompactUcanAuthorization(input, expectedCid) {
+  if (typeof input !== "string" || /\s/.test(input))
+    throw new Error("Authorization must be compact UCAN bytes");
+  const segments = input.split(".");
+  if (segments.length !== 3 || segments.some((segment) => segment.length === 0))
+    throw new Error("Authorization must have three compact segments");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  const headerBytes = decodeBase64Url(headerSegment);
+  const payloadBytes = decodeBase64Url(payloadSegment);
+  const signature = decodeBase64Url(signatureSegment);
+  const headerValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(headerBytes));
+  const payloadValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(payloadBytes));
+  if (jcsCanonicalize(headerValue) !== new TextDecoder().decode(headerBytes) || jcsCanonicalize(payloadValue) !== new TextDecoder().decode(payloadBytes))
+    throw new Error("compact UCAN segments are not canonical JCS");
+  const header = CompactHeaderSchema.parse(headerValue);
+  const payload = CompactPayloadSchema.parse(payloadValue);
+  if (payload.nbf >= payload.exp) throw new Error("compact UCAN validity is empty");
+  const principal = payload.iss.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("compact UCAN issuer must be did:key Ed25519");
+  const publicKey = didMaterial.slice(2);
+  if (!equalBytes2(publicKey, decodeBase64Url(header.jwk.x)))
+    throw new Error("compact UCAN JWK does not bind issuer");
+  if (!ed255192.verify(signature, new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), publicKey))
+    throw new Error("compact UCAN signature is invalid");
+  const cid2 = CID.createV1(85, create(30, blake32(new TextEncoder().encode(input)))).toString();
+  if (expectedCid !== void 0 && cid2 !== expectedCid)
+    throw new Error("compact UCAN CID does not match exact Authorization bytes");
+  return { authorization: input, cid: cid2, header, payload };
+}
+function parsePolicySessionUcan(authorization, expectedProofs) {
+  const parsed = parseCompactUcanAuthorization(authorization);
+  const fact = parsed.payload.fct[0];
+  if (parsed.payload.prf.length !== 2 || parsed.payload.prf[0] === parsed.payload.prf[1])
+    throw new Error("policy session UCAN requires two distinct ordered proofs");
+  if (expectedProofs !== void 0 && (parsed.payload.prf[0] !== expectedProofs[0] || parsed.payload.prf[1] !== expectedProofs[1]))
+    throw new Error("policy session UCAN ordered proofs do not match");
+  const factKeys = Object.keys(fact);
+  if (factKeys.length !== POLICY_SESSION_FACT_KEYS.length || factKeys.some((key) => !POLICY_SESSION_FACT_KEYS.includes(key)) || POLICY_SESSION_FACT_KEYS.some((key) => !(key in fact)))
+    throw new Error("policy session UCAN fact is incomplete");
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.enforcerDid || parsed.payload.aud !== fact.recipientDid)
+    throw new Error("policy session UCAN fact is invalid");
+  return {
+    authorization,
+    cid: parsed.cid,
+    iss: parsed.payload.iss,
+    aud: parsed.payload.aud,
+    prf: parsed.payload.prf,
+    att: parsed.payload.att,
+    nbf: parsed.payload.nbf,
+    exp: parsed.payload.exp,
+    nnc: parsed.payload.nnc,
+    fact
+  };
+}
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)
+    throw new Error("value is not canonical base64url");
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = typeof Buffer !== "undefined" ? Buffer.from(normalized, "base64").toString("binary") : atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
+  const bytes2 = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  const encoded = typeof Buffer !== "undefined" ? Buffer.from(bytes2).toString("base64url") : btoa(String.fromCharCode(...bytes2)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  if (encoded !== value) throw new Error("value is not canonical base64url");
+  return bytes2;
+}
+function encodeBase64Url(value) {
+  return typeof Buffer !== "undefined" ? Buffer.from(value).toString("base64url") : btoa(String.fromCharCode(...value)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function equalBytes2(left, right) {
+  return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+
+// src/delegations/portable.ts
+var ResourceSchema = z5.object({
+  service: z5.string().min(1),
+  space: z5.string().min(1),
+  path: z5.string(),
+  actions: z5.array(z5.string().min(1)).min(1),
+  caveats: z5.array(z5.record(z5.unknown())).optional()
+}).strict();
+var PortableDelegationSchema = z5.object({
+  cid: z5.string().min(1),
+  delegationHeader: z5.object({ Authorization: z5.string().min(1) }).strict(),
+  ownerAddress: z5.string().min(1),
+  chainId: z5.number().int().nonnegative(),
+  host: z5.string().url().optional(),
+  spaceId: z5.string().min(1),
+  path: z5.string(),
+  actions: z5.array(z5.string().min(1)).min(1),
+  caveats: z5.array(z5.record(z5.unknown())).optional(),
+  expiry: z5.coerce.date(),
+  delegateDID: z5.string().min(1),
+  delegatorDID: z5.string().min(1).optional(),
+  parentCid: z5.string().min(1).optional(),
+  disableSubDelegation: z5.boolean().optional(),
+  resources: z5.array(ResourceSchema).min(1).optional()
+}).strict();
+function parsePortableDelegation(input) {
+  const parsed = PortableDelegationSchema.parse(input);
+  if (parsed.resources !== void 0 && parsed.resources.length === 0)
+    throw new Error("portable delegation resources must not be empty");
+  return parsed;
+}
+function serializePortableDelegation(delegation) {
+  return JSON.stringify({
+    ...delegation,
+    expiry: delegation.expiry.toISOString()
+  });
+}
+async function importPortableDelegation(fetchFn, host, delegation) {
+  const parsed = parsePortableDelegation(delegation);
+  const response = await fetchFn(`${host.replace(/\/+$/, "")}/delegate`, {
+    method: "POST",
+    headers: { Authorization: parsed.delegationHeader.Authorization }
+  });
+  if (!response.ok)
+    throw new Error(`node rejected delegation import (${response.status})`);
+  const body = await response.json().catch(() => ({}));
+  if (body === null || typeof body !== "object" || Array.isArray(body))
+    return {};
+  return body;
+}
+async function delegatePortablePolicySession(input) {
+  const parent = parsePortableDelegation(input.parent);
+  const descendant = createCompactPolicyDescendant({
+    parentAuthorization: parent.delegationHeader.Authorization.replace(/^Bearer\s+/i, ""),
+    parentCid: parent.cid,
+    issuerDid: parent.delegateDID,
+    audienceDid: input.delegateDID,
+    attenuation: input.attenuation,
+    privateKey: input.issuerPrivateKey,
+    ...input.now === void 0 ? {} : { now: input.now },
+    ...input.expiresAt === void 0 ? {} : { expiresAt: input.expiresAt },
+    ...input.nonce === void 0 ? {} : { nonce: input.nonce }
+  });
+  const resources = Object.entries(descendant.payload.att).map(([resource, abilities]) => {
+    const actions = Object.keys(abilities);
+    if (resource.startsWith("urn:tinycloud:encryption:")) {
+      return { service: "encryption", space: "encryption", path: resource, actions };
+    }
+    const match = /^tinycloud:\/\/([^/]+)\/kv\/(.+)$/.exec(resource);
+    if (match === null) throw new Error("policy descendant resource is invalid");
+    const caveats = Object.values(abilities).flat().filter((value) => value !== null && typeof value === "object" && !Array.isArray(value));
+    return { service: "kv", space: match[1], path: match[2], actions, ...caveats.length === 0 ? {} : { caveats } };
+  });
+  const primary = resources.find((resource) => resource.service === "kv") ?? resources[0];
+  if (primary === void 0) throw new Error("policy descendant attenuation is empty");
+  const portable = {
+    cid: descendant.cid,
+    delegationHeader: { Authorization: descendant.authorization },
+    ownerAddress: parent.ownerAddress,
+    chainId: parent.chainId,
+    host: input.host,
+    spaceId: primary.space,
+    path: primary.path,
+    actions: primary.actions,
+    expiry: new Date(descendant.payload.exp * 1e3),
+    delegateDID: input.delegateDID,
+    delegatorDID: parent.delegateDID,
+    parentCid: parent.cid,
+    disableSubDelegation: descendant.payload.fct[0]?.remainingRedelegationDepth === 0,
+    resources
+  };
+  await importPortableDelegation(input.fetch, input.host, portable);
+  return portable;
+}
+
 // src/delegations/ShareRecipientClient.ts
 var DEFAULT_MAX_ARTIFACT_BYTES2 = MAX_SHARE_ARTIFACT_BYTES;
 var DEFAULT_MAX_CONTENT_BYTES = MAX_SHARE_CONTENT_BYTES;
@@ -3709,7 +4241,7 @@ function randomJti() {
   return bytesToBase64Url2(bytes2);
 }
 function digestCanonical(value) {
-  return bytesToBase64Url2(sha2564(new TextEncoder().encode(canonicalJsonForProof(value))));
+  return bytesToBase64Url2(sha2565(new TextEncoder().encode(canonicalJsonForProof(value))));
 }
 function actionWire(action) {
   return action === "get" ? "tinycloud.kv/get" : action === "metadata" ? "tinycloud.kv/metadata" : action === "list" ? "tinycloud.kv/list" : "tinycloud.kv/put";
@@ -3806,15 +4338,46 @@ var ShareRecipientClient = class {
       const { envelope } = resolved.artifact;
       const { location } = resolved;
       const bearer = isBearerEnvelope(envelope);
-      const policy = envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain";
+      const policy = envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain" || envelope.authorizationTargetKind === "recipientDid";
       const legacyBearer = !policy && envelope.recipientKind === void 0;
-      if (envelope.authorizationTargetKind === "recipientDid") throw new ShareAccessError("SHARE_RECIPIENT_DID_UNSUPPORTED");
+      let recipientDidSession;
+      if (envelope.authorizationTargetKind === "recipientDid") {
+        if (this.options.establishRecipientDidSession === void 0) throw new ShareAccessError("SHARE_DEVICE_AUTH_REQUIRED", "an OpenKey device authorization is required");
+        const authorization = await this.options.establishRecipientDidSession({ envelope, recipientDid: envelope.recipient?.kind === "recipientDid" ? envelope.recipient.value : "" });
+        if ("state" in authorization) {
+          if (authorization.state === "authorization-required") throw new ShareAccessError("SHARE_DEVICE_AUTH_REQUIRED", "an OpenKey device authorization is required", authorization);
+          throw new ShareAccessError("SHARE_DENIED", "recipient DID authorization was denied", authorization);
+        }
+        recipientDidSession = authorization;
+      }
       if (policy && this.options.bearerSession !== void 0) throw new ShareAccessError("SHARE_POLICY_BEARER_MISMATCH");
       if (bearer && this.options.presentation !== void 0) throw new ShareAccessError("SHARE_BEARER_PRESENTATION_MISMATCH");
-      const session = bearer || legacyBearer ? this.options.bearerSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
-      const kv = bearer || legacyBearer ? session === void 0 ? void 0 : this.createKV(envelope.origin, session) : void 0;
+      const session = bearer || legacyBearer ? this.options.bearerSession : recipientDidSession ? recipientDidSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
       const policySession = policy ? session : void 0;
       if (policySession !== void 0) this.assertProvidedPolicySession(policySession, envelope);
+      const portableDelegation = policySession === void 0 ? void 0 : this.policySessionDelegation(policySession, envelope.origin);
+      const portableInvoke = portableDelegation === void 0 ? void 0 : this.policyInvocationSigner(portableDelegation);
+      if (portableDelegation !== void 0) {
+        if (this.options.importDelegation === void 0) {
+          await importPortableDelegation(this.fetchFn, envelope.origin, portableDelegation);
+        } else {
+          const imported = await this.options.importDelegation(portableDelegation);
+          if (imported !== void 0) {
+            const normalized = parsePortableDelegation(imported);
+            if (normalized.delegationHeader.Authorization !== portableDelegation.delegationHeader.Authorization) {
+              throw new ShareAccessError("SHARE_SESSION_INVALID", "delegation importer changed authorization bytes");
+            }
+          }
+        }
+      }
+      const ordinarySession = portableDelegation === void 0 ? void 0 : {
+        delegationHeader: portableDelegation.delegationHeader,
+        delegationCid: portableDelegation.cid,
+        spaceId: this.policySessionProjection(portableDelegation).spaceId,
+        verificationMethod: portableDelegation.delegateDID,
+        jwk: this.options.bearerSession?.jwk ?? {}
+      };
+      const kv = bearer || legacyBearer || ordinarySession !== void 0 ? session === void 0 && ordinarySession === void 0 ? void 0 : this.createKV(envelope.origin, ordinarySession ?? session, portableInvoke) : void 0;
       const advertisedCapability = { spaceId: envelope.spaceId, resource: envelope.resource, actions: envelope.actions };
       const capability = policySession?.capability === void 0 ? advertisedCapability : intersectShareCapabilities(advertisedCapability, policySession.capability);
       if (capability === void 0) throw new ShareAccessError("SHARE_CAPABILITY_EMPTY");
@@ -3839,6 +4402,11 @@ var ShareRecipientClient = class {
           const scope = normalizePath(input.path ?? envelope.resource.path);
           this.assertAllowed(capability, "list", scope);
           if (kv === void 0 && policySession === void 0) throw new ShareAccessError("SHARE_SESSION_REQUIRED");
+          if (portableDelegation !== void 0 && kv !== void 0) {
+            const result2 = await kv.list({ path: scope, limit: input.limit, cursor: input.cursor });
+            if (!result2.ok) throw result2.error;
+            return { keys: result2.data.keys, truncated: result2.data.truncated, nextCursor: result2.data.nextCursor };
+          }
           if (policySession !== void 0) return this.nativeList(envelope, policySession, scope, input.limit, input.cursor);
           const result = await kv.list({ path: scope, limit: input.limit, cursor: input.cursor });
           if (!result.ok) throw result.error;
@@ -3852,6 +4420,14 @@ var ShareRecipientClient = class {
           const resolvedPath = normalizePath(path);
           this.assertAllowed(capability, "save", resolvedPath);
           if (kv === void 0 && policySession === void 0) throw new ShareAccessError("SHARE_SESSION_REQUIRED");
+          if (portableDelegation !== void 0 && kv !== void 0) {
+            const result2 = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
+            if (!result2.ok) {
+              if (result2.error.code === ErrorCodes.KV_PRECONDITION_FAILED || result2.error.code === ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
+              throw result2.error;
+            }
+            return { etag: result2.data.headers.etag };
+          }
           if (policySession !== void 0) return this.nativeSave(envelope, policySession, resolvedPath, bytes2, input);
           const result = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
           if (!result.ok) {
@@ -3867,22 +4443,79 @@ var ShareRecipientClient = class {
       const metadata = async (path = envelope.resource.kind === "exact" ? envelope.resource.path : "") => {
         const resolvedPath = normalizePath(path);
         this.assertAllowed(capability, "metadata", resolvedPath);
+        if (portableDelegation !== void 0 && kv !== void 0) {
+          const result2 = await kv.head(resolvedPath);
+          if (!result2.ok) throw result2.error;
+          return { metadata: { "content-type": result2.data.headers.contentType ?? "application/octet-stream", "content-length": String(result2.data.headers.contentLength ?? ""), ...result2.data.headers.lastModified === void 0 ? {} : { "last-modified": result2.data.headers.lastModified } }, etag: result2.data.headers.etag, contentType: result2.data.headers.contentType, size: result2.data.headers.contentLength };
+        }
         if (policySession !== void 0) return this.nativeMetadata(envelope, policySession, resolvedPath);
         if (kv === void 0) throw new ShareAccessError("SHARE_SESSION_REQUIRED");
         const result = await kv.head(resolvedPath);
         if (!result.ok) throw result.error;
         return { metadata: { "content-type": result.data.headers.contentType ?? "application/octet-stream", "content-length": String(result.data.headers.contentLength ?? ""), ...result.data.headers.lastModified === void 0 ? {} : { "last-modified": result.data.headers.lastModified } }, etag: result.data.headers.etag, contentType: result.data.headers.contentType, size: result.data.headers.contentLength };
       };
-      return { kind: "share-v2", envelope, location: { ...location, key: void 0 }, resource: envelope.resource, actions: envelope.actions, expiresAt: new Date(envelope.expiresAt), kv, get, listChildren, save, metadata };
+      return { kind: "share-v2", envelope, location: { ...location, key: void 0 }, resource: envelope.resource, actions: envelope.actions, expiresAt: new Date(envelope.expiresAt), kv, portableDelegation, get, listChildren, save, metadata };
     } catch (error) {
       throw asError(error);
     }
   }
-  createKV(origin, session) {
+  policySessionDelegation(session, origin) {
+    if (session.runtimeDelegation === void 0) return void 0;
+    const delegation = parsePortableDelegation(session.runtimeDelegation);
+    if (delegation.host !== void 0 && delegation.host.replace(/\/+$/, "") !== origin.replace(/\/+$/, "")) throw new ShareAccessError("SHARE_ORIGIN_MISMATCH", "delegation host does not match the trusted share origin");
+    return delegation;
+  }
+  policyInvocationSigner(delegation) {
+    const privateKey = this.options.policySessionPrivateKey;
+    if (privateKey === void 0) throw new ShareAccessError("SHARE_SESSION_SIGNER_REQUIRED");
+    const session = parsePolicySessionUcan(delegation.delegationHeader.Authorization);
+    if (session.cid !== delegation.cid || session.aud !== delegation.delegateDID)
+      throw new ShareAccessError("SHARE_SESSION_INVALID");
+    return (_serviceSession, service, path, action, facts) => {
+      const serviceName = service.replace(/^tinycloud\./, "");
+      const cleanPath = path.replace(/^\//, "").replace(/\/$/, "");
+      const authority = Object.entries(session.att).find(([parentResource, abilities]) => {
+        if (!(action in abilities)) return false;
+        if (serviceName === "encryption") return parentResource.startsWith("urn:tinycloud:encryption:") && parentResource === cleanPath;
+        const match = /^tinycloud:\/\/[^/]+\/kv\/(.+)$/.exec(parentResource);
+        if (match === null) return false;
+        const parentPath = match[1];
+        const caveats = abilities[action] ?? [];
+        const prefix = caveats.some((value) => isRecord(value) && value.kind === "prefix");
+        return cleanPath === parentPath || prefix && cleanPath.startsWith(`${parentPath}/`);
+      });
+      if (authority === void 0) throw new ShareAccessError("SHARE_OUT_OF_SCOPE");
+      const resource = serviceName === "encryption" ? authority[0] : `${authority[0].slice(0, authority[0].indexOf("/kv/") + 4)}${cleanPath}`;
+      const caveat = serviceName === "encryption" ? {} : { type: "xyz.tinycloud.resource/selector", kind: "exact", value: resource };
+      const invocation = createCompactPolicyInvocation({
+        sessionAuthorization: delegation.delegationHeader.Authorization,
+        sessionCid: delegation.cid,
+        recipientDid: delegation.delegateDID,
+        audienceDid: String(session.fact.nodeAudience),
+        resource,
+        action,
+        caveat,
+        ...facts?.length === 1 ? { facts: facts[0] } : {},
+        privateKey,
+        now: Math.floor(this.now().getTime() / 1e3)
+      });
+      return { Authorization: invocation.authorization };
+    };
+  }
+  policySessionProjection(delegation) {
+    const session = parsePolicySessionUcan(delegation.delegationHeader.Authorization);
+    if (session.cid !== delegation.cid || session.aud !== delegation.delegateDID) throw new ShareAccessError("SHARE_SESSION_INVALID");
+    const kvResource = Object.keys(session.att).find((resource) => /^tinycloud:\/\/[^/]+\/kv\/.+$/.test(resource));
+    const match = kvResource === void 0 ? void 0 : /^tinycloud:\/\/([^/]+)\/kv\/(.+)$/.exec(kvResource);
+    if (match === void 0 || match === null) throw new ShareAccessError("SHARE_SESSION_INVALID");
+    return { spaceId: match[1] };
+  }
+  createKV(origin, session, invokeOverride) {
+    const invoke = invokeOverride ?? this.options.invoke ?? nativeInvoke;
     if (this.options.createKVService !== void 0) {
-      return this.options.createKVService({ hosts: [origin], session, invoke: this.options.invoke ?? nativeInvoke, fetch: this.fetchFn });
+      return this.options.createKVService({ hosts: [origin], session, invoke, fetch: this.fetchFn });
     }
-    const context = new ServiceContext({ hosts: [origin], session, invoke: this.options.invoke ?? nativeInvoke, fetch: this.fetchFn });
+    const context = new ServiceContext({ hosts: [origin], session, invoke, fetch: this.fetchFn });
     const service = new KVService({ prefix: "" });
     context.registerService("kv", service);
     service.initialize(context);
@@ -3925,7 +4558,7 @@ var ShareRecipientClient = class {
     if (bytes2.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError("SHARE_TOO_LARGE");
     const contentType = input.contentType ?? envelope.content.mimeType;
     if (contentType !== envelope.content.mimeType && !/^text\/(?:plain|markdown)(?:;|$)/i.test(contentType)) throw new ShareAccessError("SHARE_CONTENT_TYPE_INVALID");
-    const result = await this.invokeNative({ envelope, session, action: "put", resource: path, body: bytes2, bodyDigest: bytesToBase64Url2(sha2564(bytes2)), contentType, ifMatch: input.etag, mediaType: "application/vnd.tinycloud.share+json" });
+    const result = await this.invokeNative({ envelope, session, action: "put", resource: path, body: bytes2, bodyDigest: bytesToBase64Url2(sha2565(bytes2)), contentType, ifMatch: input.etag, mediaType: "application/vnd.tinycloud.share+json" });
     if (result.status === 412 || result.status === 409) throw new ShareConflict(path, result.headers?.etag);
     if (result.status === 401 || result.status === 403) throw new ShareAccessError("SHARE_DENIED");
     if (result.status < 200 || result.status >= 300) throw new ShareAccessError("SHARE_WRITE_FAILED");
@@ -4047,7 +4680,7 @@ var ShareRecipientClient = class {
     };
     const signed = this.options.signNativeInvoke === void 0 ? void 0 : await this.options.signNativeInvoke({ envelope: input.envelope, session: input.session, request: body });
     const transport = this.options.invoke !== void 0 || session.authorization !== void 0 || session.delegationHeader !== void 0 ? this.defaultNativeHeaders(session, input.action, input.resource, body) : void 0;
-    const response = await this.fetchFn(v2 ? `${base3}/share/v2/invoke` : `${base3}/invoke`, {
+    const response = await this.fetchFn(`${base3}/invoke`, {
       method: "POST",
       headers: { ...headersRecord(transport), ...headersRecord(signed), "content-type": input.mediaType, accept: input.mediaType },
       body: JSON.stringify(body),
@@ -4171,7 +4804,7 @@ var ShareRecipientClient = class {
     }]);
   }
   digestMatches(value, bytes2) {
-    const digest4 = bytesToBase64Url2(sha2564(bytes2));
+    const digest4 = bytesToBase64Url2(sha2565(bytes2));
     return value === digest4 || value === `sha-256=:${digest4}:`;
   }
   assertNativeRequestBounds(envelope, session, operation, path, limit, cursor) {
@@ -4389,7 +5022,7 @@ var ShareRecipientClient = class {
         nodeAudience: binding.nodeAudience,
         ...isV2 ? {
           enforcerDid: challenge.enforcerDid,
-          credentialDigest: typeof presentation.credentialDigest === "string" ? presentation.credentialDigest : bytesToBase64Url2(sha2564(new TextEncoder().encode(credential)))
+          credentialDigest: typeof presentation.credentialDigest === "string" ? presentation.credentialDigest : bytesToBase64Url2(sha2565(new TextEncoder().encode(credential)))
         } : {},
         action,
         ...binding.actions === void 0 ? {} : { actions: [...binding.actions] },
@@ -4455,7 +5088,7 @@ var ShareRecipientClient = class {
     }
     if (isJwsProof && detached.kid !== `${signerDid}#${encoded}` || isEd25519Proof && detached.signerDid !== signerDid || signature.length !== 64) throw new ShareAccessError("SHARE_SESSION_INVALID", "Node proof binding is invalid");
     const bytes2 = new TextEncoder().encode(`${domain}${canonicalJsonForProof(message)}`);
-    if (!ed255192.verify(signature, bytes2, key)) throw new ShareAccessError("SHARE_SESSION_INVALID", "Node proof signature is invalid");
+    if (!ed255193.verify(signature, bytes2, key)) throw new ShareAccessError("SHARE_SESSION_INVALID", "Node proof signature is invalid");
   }
   assertChallengeRequestBinding(request, challenge) {
     const source = isRecord(request.body) ? request.body : request;
@@ -5659,7 +6292,7 @@ function shareKeyMatchesDid(key, didUrl) {
     if (!publicKey) return false;
     const jwkBytes = decodeBase64UrlBytes(key.x);
     const privateKey = decodeBase64UrlBytes(key.d);
-    const derivedPublicKey = ed255193.getPublicKey(privateKey);
+    const derivedPublicKey = ed255194.getPublicKey(privateKey);
     return privateKey.length === 32 && publicKey.length === jwkBytes.length && publicKey.every((byte, index) => byte === jwkBytes[index]) && derivedPublicKey.length === jwkBytes.length && derivedPublicKey.every((byte, index) => byte === jwkBytes[index]);
   } catch {
     return false;
@@ -5709,240 +6342,16 @@ function verifySignedChild(result, expected, computeCid) {
 }
 
 // src/delegations/owner-policy.ts
-import { ed25519 as ed255195 } from "@noble/curves/ed25519";
+import { ed25519 as ed255196 } from "@noble/curves/ed25519";
 import { sha256 as sha2567 } from "@noble/hashes/sha256";
 
 // src/policy/signed-object.ts
-import { ed25519 as ed255194 } from "@noble/curves/ed25519";
-import { bytesToHex as bytesToHex2, sha256 as sha2566, verifyMessage } from "viem";
-
-// src/policy/capability.ts
-import { CAPABILITY_REGISTRY } from "@tinycloud/bootstrap";
-import { bytesToHex, sha256 as sha2565 } from "viem";
-
-// src/policy/errors.ts
-var SignedObjectProfileError = class extends Error {
-  constructor(code3, message) {
-    super(message);
-    this.name = "SignedObjectProfileError";
-    this.code = code3;
-  }
-};
-var SignedObjectCanonicalizationError = class extends SignedObjectProfileError {
-  constructor(message) {
-    super("canonicalization-mismatch", message);
-    this.name = "SignedObjectCanonicalizationError";
-  }
-};
-
-// src/policy/jcs.ts
-var objectHasOwn = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
-  Object.prototype.hasOwnProperty
-);
-function jcsCanonicalize(input) {
-  return serialize(normalizeJson(input, "$"));
-}
-function normalizeJson(input, path = "$") {
-  if (input === null) {
-    return null;
-  }
-  switch (typeof input) {
-    case "boolean":
-      return input;
-    case "number":
-      if (!Number.isFinite(input)) {
-        throw new SignedObjectCanonicalizationError(
-          `${path} must be a finite JSON number`
-        );
-      }
-      return input;
-    case "string":
-      assertUnicodeScalarString(input, path);
-      return input;
-    case "object":
-      return normalizeJsonObjectOrArray(input, path);
-    case "bigint":
-    case "function":
-    case "symbol":
-    case "undefined":
-    default:
-      throw new SignedObjectCanonicalizationError(
-        `${path} is not a JSON value`
-      );
-  }
-}
-function serialize(value) {
-  if (value === null) {
-    return "null";
-  }
-  switch (typeof value) {
-    case "boolean":
-      return value ? "true" : "false";
-    case "number": {
-      const encoded = JSON.stringify(value);
-      if (encoded === void 0) {
-        throw new SignedObjectCanonicalizationError(
-          "number could not be serialized as JSON"
-        );
-      }
-      return encoded;
-    }
-    case "string":
-      return JSON.stringify(value);
-    case "object":
-      if (Array.isArray(value)) {
-        return `[${value.map((item) => serialize(item)).join(",")}]`;
-      }
-      return serializeObject(value);
-    default:
-      throw new SignedObjectCanonicalizationError(
-        `unsupported JSON value type ${typeof value}`
-      );
-  }
-}
-function normalizeJsonObjectOrArray(input, path) {
-  assertNoSymbolKeys(input, path);
-  if (Array.isArray(input)) {
-    for (const key of Object.getOwnPropertyNames(input)) {
-      if (key === "length") {
-        continue;
-      }
-      if (!isArrayIndexKey(key, input.length)) {
-        throw new SignedObjectCanonicalizationError(
-          `${path}.${key} is not allowed on a JSON array`
-        );
-      }
-      const descriptor = Object.getOwnPropertyDescriptor(input, key);
-      if (descriptor?.enumerable !== true) {
-        throw new SignedObjectCanonicalizationError(
-          `${path}[${key}] must be an enumerable JSON array item`
-        );
-      }
-      if (!("value" in descriptor)) {
-        throw new SignedObjectCanonicalizationError(
-          `${path}[${key}] must be a JSON data property`
-        );
-      }
-    }
-    const output2 = [];
-    for (let index = 0; index < input.length; index++) {
-      if (!objectHasOwn(input, index)) {
-        throw new SignedObjectCanonicalizationError(
-          `${path}[${index}] must not be a sparse array hole`
-        );
-      }
-      output2.push(normalizeJson(input[index], `${path}[${index}]`));
-    }
-    return output2;
-  }
-  const proto = Object.getPrototypeOf(input);
-  if (proto !== Object.prototype && proto !== null) {
-    throw new SignedObjectCanonicalizationError(
-      `${path} must be a plain JSON object`
-    );
-  }
-  const output = /* @__PURE__ */ Object.create(null);
-  for (const key of Object.getOwnPropertyNames(input)) {
-    assertUnicodeScalarString(key, `${path} key`);
-    if (key === "__proto__" || key === "constructor") {
-      throw new SignedObjectCanonicalizationError(
-        `${path}.${key} is not allowed`
-      );
-    }
-    const descriptor = Object.getOwnPropertyDescriptor(input, key);
-    if (descriptor?.enumerable !== true) {
-      throw new SignedObjectCanonicalizationError(
-        `${path}.${key} must be an enumerable JSON object property`
-      );
-    }
-    if (!("value" in descriptor)) {
-      throw new SignedObjectCanonicalizationError(
-        `${path}.${key} must be a JSON data property`
-      );
-    }
-    const value = descriptor.value;
-    output[key] = normalizeJson(value, `${path}.${key}`);
-  }
-  return output;
-}
-function assertNoSymbolKeys(input, path) {
-  if (Object.getOwnPropertySymbols(input).length > 0) {
-    throw new SignedObjectCanonicalizationError(
-      `${path} must not have symbol properties`
-    );
-  }
-}
-function isArrayIndexKey(key, length2) {
-  if (!/^(0|[1-9]\d*)$/.test(key)) {
-    return false;
-  }
-  const index = Number(key);
-  return Number.isSafeInteger(index) && index >= 0 && index < length2;
-}
-function serializeObject(value) {
-  const keys = Object.keys(value).sort(compareUtf16CodeUnits);
-  const parts = keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`);
-  return `{${parts.join(",")}}`;
-}
-function compareUtf16CodeUnits(a, b) {
-  const max = Math.min(a.length, b.length);
-  for (let index = 0; index < max; index++) {
-    const leftCodeUnit = a.charCodeAt(index);
-    const rightCodeUnit = b.charCodeAt(index);
-    if (leftCodeUnit !== rightCodeUnit) {
-      return leftCodeUnit - rightCodeUnit;
-    }
-  }
-  return a.length - b.length;
-}
-function assertUnicodeScalarString(value, path) {
-  for (let index = 0; index < value.length; index++) {
-    const code3 = value.charCodeAt(index);
-    if (code3 >= 55296 && code3 <= 56319) {
-      const next = value.charCodeAt(index + 1);
-      if (Number.isNaN(next) || next < 56320 || next > 57343) {
-        throw new SignedObjectCanonicalizationError(
-          `${path} contains a lone high surrogate`
-        );
-      }
-      index++;
-      continue;
-    }
-    if (code3 >= 56320 && code3 <= 57343) {
-      throw new SignedObjectCanonicalizationError(
-        `${path} contains a lone low surrogate`
-      );
-    }
-  }
-}
-
-// src/policy/capability.ts
+import { ed25519 as ed255195 } from "@noble/curves/ed25519";
+import { bytesToHex, sha256 as sha2566, verifyMessage } from "viem";
 var textEncoder2 = new TextEncoder();
 var objectHasOwn2 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
   Object.prototype.hasOwnProperty
 );
-var CEILING_SERVICES = /* @__PURE__ */ new Set(["tinycloud.kv", "tinycloud.sql", "tinycloud.vfs"]);
-var GRANTABLE_ACTIONS = /* @__PURE__ */ new Map();
-for (const entry of CAPABILITY_REGISTRY) {
-  if (!CEILING_SERVICES.has(entry.service)) {
-    continue;
-  }
-  if (entry.aliasOf !== void 0 || entry.implies !== void 0 || entry.urn.endsWith("/*")) {
-    continue;
-  }
-  const existing = GRANTABLE_ACTIONS.get(entry.service);
-  if (existing === void 0) {
-    GRANTABLE_ACTIONS.set(entry.service, /* @__PURE__ */ new Set([entry.urn]));
-    continue;
-  }
-  existing.add(entry.urn);
-}
-
-// src/policy/signed-object.ts
-var textEncoder3 = new TextEncoder();
-var objectHasOwn3 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
-  Object.prototype.hasOwnProperty
-);
 function canonicalizeSignedObjectUnsigned(input) {
   return jcsCanonicalize(input);
 }
@@ -6162,7 +6571,7 @@ function validateOwnerSharePolicyRegistration(value, expected) {
   const publicKey = encodedKid.length === 34 ? encodedKid.slice(2) : encodedKid;
   const signatureBytes = fromB64(proof.signature);
   const signedBytes = new TextEncoder().encode(`${OWNER_SHARE_REGISTRATION_DOMAIN}${canonicalizeSignedObjectUnsigned(registrationCore)}`);
-  if (signatureBytes.length !== 64 || !ed255195.verify(signatureBytes, signedBytes, publicKey)) throw new Error("owner-share registration proof signature is invalid");
+  if (signatureBytes.length !== 64 || !ed255196.verify(signatureBytes, signedBytes, publicKey)) throw new Error("owner-share registration proof signature is invalid");
   return { registration, proof };
 }
 function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
@@ -6176,7 +6585,7 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
 }
 
 // src/delegations/share-delivery.ts
-import { ed25519 as ed255196 } from "@noble/curves/ed25519";
+import { ed25519 as ed255197 } from "@noble/curves/ed25519";
 var SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
 function isCanonicalHttpsOrigin(value) {
   let url;
@@ -6249,7 +6658,7 @@ function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
   const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
   const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
   const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.jti || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
+  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
     throw new Error("share delivery authorization is not bound to the submitted request");
   }
   if (typeof authorization.issuedAt !== "string" || Date.parse(authorization.issuedAt) > Date.now() + 6e4) throw new Error("share delivery authorization issuedAt is invalid");
@@ -6264,7 +6673,7 @@ function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
   if (publicKey.length !== 32) throw new Error("share delivery authorization proof key is invalid");
   const signatureBytes = fromB642(proof.signature);
   const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
-  if (signatureBytes.length !== 64 || !ed255196.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
+  if (signatureBytes.length !== 64 || !ed255197.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
   return { authorization, proof };
 }
 function shareDeliveryTrustedKid(publicKey) {
@@ -6383,14 +6792,42 @@ var SenderShareStore = class {
     await this.keys.delete(shareId);
   }
 };
+
+// src/delegations/index.ts
+import {
+  authorizeShare,
+  authorizationMethodForTarget,
+  notifyShare,
+  revokeShare,
+  listShares,
+  showShare,
+  publishTargetShare,
+  publishPolicyShare,
+  claimShare,
+  resumeShareAuthorization,
+  isLegacyShareLink,
+  receiveLegacyShare,
+  migrateShare,
+  MemoryEncryptedShareHistoryStorage,
+  EncryptedSenderShareHistory
+} from "@tinycloud/share-sdk";
+import {
+  inspectShare,
+  receiveShare,
+  ShareReceiveError,
+  toShareErrorInfo,
+  verifyBearerEnvelope
+} from "@tinycloud/share-sdk";
 export {
   DelegationErrorCodes,
   DelegationManager,
   EncodedShareDataSchema,
+  EncryptedSenderShareHistory,
   MAX_CONTENT_BYTES,
   MAX_SEALED_SHARE_CONTENT_BYTES,
   MAX_SHARE_ARTIFACT_BYTES,
   MAX_SHARE_CONTENT_BYTES,
+  MemoryEncryptedShareHistoryStorage,
   MemorySenderShareKeyStorage,
   MemorySenderShareRecordStorage,
   MemoryShareCache,
@@ -6405,6 +6842,7 @@ export {
   ShareConflict,
   ShareEnvelopeError,
   ShareNativeResponseSchema,
+  ShareReceiveError,
   ShareRecipientClient,
   ShareRecipientClientOptionsSchema,
   ShareRecipientPolicySchema,
@@ -6412,7 +6850,10 @@ export {
   ShareResourceSchema,
   SharingService,
   SharingServiceConfigSchema,
+  authorizationMethodForTarget,
+  authorizeShare,
   canonicalOwnerSharePolicy,
+  claimShare,
   computeOwnerShareRegistrationCid,
   computeShareCid,
   createDelegatedShareKey,
@@ -6422,28 +6863,46 @@ export {
   createSharePolicy,
   createSharingService,
   decryptShareBytesAsync,
+  delegatePortablePolicySession,
   encodeInlineShareUrl,
   encodeShareArtifact,
   encodeShareUrl,
   encryptShareBytes,
   encryptShareBytesAsync,
+  importPortableDelegation,
+  inspectShare,
   intersectShareCapabilities,
+  isLegacyShareLink,
   isV2ShareLink,
+  listShares,
+  migrateShare,
   normalizeShareActions,
   normalizeShareRecipientTarget,
   normalizeShareResource,
+  notifyShare,
+  parsePortableDelegation,
   parseShareArtifact,
   parseShareUrl,
+  publishPolicyShare,
+  publishTargetShare,
+  receiveLegacyShare,
+  receiveShare,
   restoreDelegatedShareKey,
+  resumeShareAuthorization,
+  revokeShare,
+  serializePortableDelegation,
   shareCapabilityAllows,
   shareDeliveryTrustedKid,
+  showShare,
   signShareEnvelope,
+  toShareErrorInfo,
   validateEncodedShareData,
   validateOwnerSharePolicyRegistration,
   validateOwnerSharePolicyRegistrationBytes,
   validateReceiveOptions,
   validateShareDeliveryAuthorizationBytes,
   validateSharingServiceConfig,
+  verifyBearerEnvelope,
   verifyShareCid,
   verifyShareEnvelope
 };