@tinycloud/sdk-core 2.11.0-beta.5 → 2.11.0-beta.8

package/dist/index.d.cts

@@ -2,8 +2,8 @@ import { z } from 'zod';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
-import { m as Delegation, e as CreateDelegationParams, G as GenerateShareParams, aB as ShareLink, ba as SpaceInfo, I as ICapabilityKeyRegistry, y as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, w as DelegationRevocationReceipt } from './recipient-types.schema-CWIt63Qp.cjs';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, bJ as CapabilityKeyRegistry, bK as CapabilityKeyRegistryErrorCode, bL as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, a as DelegationError, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, R as DelegationResult, x as DelegationStatus, E as EncodedShareData, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as ReceiveOptions, $ as RegisterOwnerSharePolicyParams, a0 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a1 as SenderShareKeyStorage, a2 as SenderShareRecord, a3 as SenderShareRecordStorage, a4 as SenderShareRevocationScope, a5 as SenderShareStore, a6 as ShareAccess, a7 as ShareAccessError, a8 as ShareAccessV2, a9 as ShareAction, ab as ShareAddressedDelegationEnvelopeV2, ac as ShareAddressedDelegationEnvelopeV2Schema, ad as ShareAddressedDelegationRequestV2, ae as ShareAddressedDelegationRequestV2Schema, af as ShareAddressedDelegationResponseV2, ag as ShareAddressedDelegationResponseV2Schema, ah as ShareAddressedRecipientMatcher, ai as ShareArtifactInput, aj as ShareArtifactResult, ak as ShareArtifactV2, al as ShareCache, am as ShareCacheEntry, an as ShareCacheKey, ao as ShareCacheMetadata, ap as ShareCapabilityLike, aq as ShareConflict, ar as ShareContentMetadata, as as ShareContentSource, at as ShareDeliveryAuthorization, au as ShareDeliveryAuthorizationReceipt, av as ShareDeliveryAuthorizationRequest, aw as ShareDetachedProof, ax as ShareEnvelopeError, ay as ShareEnvelopeV2, az as ShareExpiryBounds, aA as ShareKvContentSource, aC as ShareLinkData, aD as ShareLinkLocation, aE as ShareListEntry, aF as ShareListResult, aG as ShareNativeAction, aH as ShareNativeInvokeEnvelopeV1, aI as ShareNativeInvokeErrorResult, aJ as ShareNativeInvokeInput, aK as ShareNativeInvokeResult, aL as ShareNativeInvokeSuccessResult, aM as ShareNativeResponse, aN as ShareNativeResponseSchema, aO as SharePolicy, aP as SharePolicyBinding, aQ as SharePolicySession, aR as SharePolicySessionV1, aS as SharePolicySessionWireV1, aT as ShareReadInvocationV1, aU as ShareReadResult, aV as ShareRecipientClient, aW as ShareRecipientClientOptions, aY as ShareRecipientPolicy, a_ as ShareRecipientResult, a$ as ShareRecipientTarget, b1 as ShareResource, b3 as ShareSaveOptions, b4 as ShareSchema, b5 as ShareSqlContentSource, b6 as ShareWireAction, b7 as SharingService, b8 as SharingServiceConfig, b9 as SignedDelegation, bb as SpaceOwnership, bM as StoredDelegationChain, bc as ValidateShareDeliveryAuthorizationExpected, bd as VerifyShareEnvelopeOptions, be as canonicalOwnerSharePolicy, bf as computeOwnerShareRegistrationCid, bg as computeShareCid, bN as createCapabilityKeyRegistry, bh as createDelegatedShareKey, bi as createPolicyEnforcementDelegation, bj as createShareArtifact, bk as createShareArtifactAsync, bl as createSharePolicy, bm as createSharingService, bn as decryptShareBytesAsync, bo as encodeInlineShareUrl, bp as encodeShareArtifact, bq as encodeShareUrl, br as encryptShareBytes, bs as encryptShareBytesAsync, bt as intersectShareCapabilities, bu as isV2ShareLink, bv as normalizeShareActions, bw as normalizeShareRecipientTarget, bx as normalizeShareResource, by as parseShareArtifact, bz as parseShareUrl, bA as restoreDelegatedShareKey, bB as shareCapabilityAllows, bC as shareDeliveryTrustedKid, bD as signShareEnvelope, bE as validateOwnerSharePolicyRegistration, bF as validateOwnerSharePolicyRegistrationBytes, bG as validateShareDeliveryAuthorizationBytes, bH as verifyShareCid, bI as verifyShareEnvelope } from './recipient-types.schema-CWIt63Qp.cjs';
+import { m as Delegation, e as CreateDelegationParams, G as GenerateShareParams, aB as ShareLink, ba as SpaceInfo, I as ICapabilityKeyRegistry, y as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, w as DelegationRevocationReceipt } from './recipient-types.schema-D5pDlIqn.cjs';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, bJ as CapabilityKeyRegistry, bK as CapabilityKeyRegistryErrorCode, bL as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, a as DelegationError, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, R as DelegationResult, x as DelegationStatus, E as EncodedShareData, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as ReceiveOptions, $ as RegisterOwnerSharePolicyParams, a0 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a1 as SenderShareKeyStorage, a2 as SenderShareRecord, a3 as SenderShareRecordStorage, a4 as SenderShareRevocationScope, a5 as SenderShareStore, a6 as ShareAccess, a7 as ShareAccessError, a8 as ShareAccessV2, a9 as ShareAction, ab as ShareAddressedDelegationEnvelopeV2, ac as ShareAddressedDelegationEnvelopeV2Schema, ad as ShareAddressedDelegationRequestV2, ae as ShareAddressedDelegationRequestV2Schema, af as ShareAddressedDelegationResponseV2, ag as ShareAddressedDelegationResponseV2Schema, ah as ShareAddressedRecipientMatcher, ai as ShareArtifactInput, aj as ShareArtifactResult, ak as ShareArtifactV2, al as ShareCache, am as ShareCacheEntry, an as ShareCacheKey, ao as ShareCacheMetadata, ap as ShareCapabilityLike, aq as ShareConflict, ar as ShareContentMetadata, as as ShareContentSource, at as ShareDeliveryAuthorization, au as ShareDeliveryAuthorizationReceipt, av as ShareDeliveryAuthorizationRequest, aw as ShareDetachedProof, ax as ShareEnvelopeError, ay as ShareEnvelopeV2, az as ShareExpiryBounds, aA as ShareKvContentSource, aC as ShareLinkData, aD as ShareLinkLocation, aE as ShareListEntry, aF as ShareListResult, aG as ShareNativeAction, aH as ShareNativeInvokeEnvelopeV1, aI as ShareNativeInvokeErrorResult, aJ as ShareNativeInvokeInput, aK as ShareNativeInvokeResult, aL as ShareNativeInvokeSuccessResult, aM as ShareNativeResponse, aN as ShareNativeResponseSchema, aO as SharePolicy, aP as SharePolicyBinding, aQ as SharePolicySession, aR as SharePolicySessionV1, aS as SharePolicySessionWireV1, aT as ShareReadInvocationV1, aU as ShareReadResult, aV as ShareRecipientClient, aW as ShareRecipientClientOptions, aY as ShareRecipientPolicy, a_ as ShareRecipientResult, a$ as ShareRecipientTarget, b1 as ShareResource, b3 as ShareSaveOptions, b4 as ShareSchema, b5 as ShareSqlContentSource, b6 as ShareWireAction, b7 as SharingService, b8 as SharingServiceConfig, b9 as SignedDelegation, bb as SpaceOwnership, bM as StoredDelegationChain, bc as ValidateShareDeliveryAuthorizationExpected, bd as VerifyShareEnvelopeOptions, be as canonicalOwnerSharePolicy, bf as computeOwnerShareRegistrationCid, bg as computeShareCid, bN as createCapabilityKeyRegistry, bh as createDelegatedShareKey, bi as createPolicyEnforcementDelegation, bj as createShareArtifact, bk as createShareArtifactAsync, bl as createSharePolicy, bm as createSharingService, bn as decryptShareBytesAsync, bo as encodeInlineShareUrl, bp as encodeShareArtifact, bq as encodeShareUrl, br as encryptShareBytes, bs as encryptShareBytesAsync, bt as intersectShareCapabilities, bu as isV2ShareLink, bv as normalizeShareActions, bw as normalizeShareRecipientTarget, bx as normalizeShareResource, by as parseShareArtifact, bz as parseShareUrl, bA as restoreDelegatedShareKey, bB as shareCapabilityAllows, bC as shareDeliveryTrustedKid, bD as signShareEnvelope, bE as validateOwnerSharePolicyRegistration, bF as validateOwnerSharePolicyRegistrationBytes, bG as validateShareDeliveryAuthorizationBytes, bH as verifyShareCid, bI as verifyShareEnvelope } from './recipient-types.schema-D5pDlIqn.cjs';
 export { ACCOUNT_INDEX_SCHEMA, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, a as Policy, P as PolicyEngineRecord, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, S as SignedObjectSigner, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, U as UnsignedPolicyEngineRecord, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from './signed-object-IMAm5a32.cjs';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.cjs';

package/dist/index.d.ts

@@ -2,8 +2,8 @@ import { z } from 'zod';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
-import { m as Delegation, e as CreateDelegationParams, G as GenerateShareParams, aB as ShareLink, ba as SpaceInfo, I as ICapabilityKeyRegistry, y as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, w as DelegationRevocationReceipt } from './recipient-types.schema-CWIt63Qp.js';
-export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, bJ as CapabilityKeyRegistry, bK as CapabilityKeyRegistryErrorCode, bL as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, a as DelegationError, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, R as DelegationResult, x as DelegationStatus, E as EncodedShareData, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as ReceiveOptions, $ as RegisterOwnerSharePolicyParams, a0 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a1 as SenderShareKeyStorage, a2 as SenderShareRecord, a3 as SenderShareRecordStorage, a4 as SenderShareRevocationScope, a5 as SenderShareStore, a6 as ShareAccess, a7 as ShareAccessError, a8 as ShareAccessV2, a9 as ShareAction, ab as ShareAddressedDelegationEnvelopeV2, ac as ShareAddressedDelegationEnvelopeV2Schema, ad as ShareAddressedDelegationRequestV2, ae as ShareAddressedDelegationRequestV2Schema, af as ShareAddressedDelegationResponseV2, ag as ShareAddressedDelegationResponseV2Schema, ah as ShareAddressedRecipientMatcher, ai as ShareArtifactInput, aj as ShareArtifactResult, ak as ShareArtifactV2, al as ShareCache, am as ShareCacheEntry, an as ShareCacheKey, ao as ShareCacheMetadata, ap as ShareCapabilityLike, aq as ShareConflict, ar as ShareContentMetadata, as as ShareContentSource, at as ShareDeliveryAuthorization, au as ShareDeliveryAuthorizationReceipt, av as ShareDeliveryAuthorizationRequest, aw as ShareDetachedProof, ax as ShareEnvelopeError, ay as ShareEnvelopeV2, az as ShareExpiryBounds, aA as ShareKvContentSource, aC as ShareLinkData, aD as ShareLinkLocation, aE as ShareListEntry, aF as ShareListResult, aG as ShareNativeAction, aH as ShareNativeInvokeEnvelopeV1, aI as ShareNativeInvokeErrorResult, aJ as ShareNativeInvokeInput, aK as ShareNativeInvokeResult, aL as ShareNativeInvokeSuccessResult, aM as ShareNativeResponse, aN as ShareNativeResponseSchema, aO as SharePolicy, aP as SharePolicyBinding, aQ as SharePolicySession, aR as SharePolicySessionV1, aS as SharePolicySessionWireV1, aT as ShareReadInvocationV1, aU as ShareReadResult, aV as ShareRecipientClient, aW as ShareRecipientClientOptions, aY as ShareRecipientPolicy, a_ as ShareRecipientResult, a$ as ShareRecipientTarget, b1 as ShareResource, b3 as ShareSaveOptions, b4 as ShareSchema, b5 as ShareSqlContentSource, b6 as ShareWireAction, b7 as SharingService, b8 as SharingServiceConfig, b9 as SignedDelegation, bb as SpaceOwnership, bM as StoredDelegationChain, bc as ValidateShareDeliveryAuthorizationExpected, bd as VerifyShareEnvelopeOptions, be as canonicalOwnerSharePolicy, bf as computeOwnerShareRegistrationCid, bg as computeShareCid, bN as createCapabilityKeyRegistry, bh as createDelegatedShareKey, bi as createPolicyEnforcementDelegation, bj as createShareArtifact, bk as createShareArtifactAsync, bl as createSharePolicy, bm as createSharingService, bn as decryptShareBytesAsync, bo as encodeInlineShareUrl, bp as encodeShareArtifact, bq as encodeShareUrl, br as encryptShareBytes, bs as encryptShareBytesAsync, bt as intersectShareCapabilities, bu as isV2ShareLink, bv as normalizeShareActions, bw as normalizeShareRecipientTarget, bx as normalizeShareResource, by as parseShareArtifact, bz as parseShareUrl, bA as restoreDelegatedShareKey, bB as shareCapabilityAllows, bC as shareDeliveryTrustedKid, bD as signShareEnvelope, bE as validateOwnerSharePolicyRegistration, bF as validateOwnerSharePolicyRegistrationBytes, bG as validateShareDeliveryAuthorizationBytes, bH as verifyShareCid, bI as verifyShareEnvelope } from './recipient-types.schema-CWIt63Qp.js';
+import { m as Delegation, e as CreateDelegationParams, G as GenerateShareParams, aB as ShareLink, ba as SpaceInfo, I as ICapabilityKeyRegistry, y as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, w as DelegationRevocationReceipt } from './recipient-types.schema-D5pDlIqn.js';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, bJ as CapabilityKeyRegistry, bK as CapabilityKeyRegistryErrorCode, bL as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, a as DelegationError, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, R as DelegationResult, x as DelegationStatus, E as EncodedShareData, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationPermission, T as OwnerDelegationReceipt, U as OwnerShareAction, V as OwnerShareDecryption, W as OwnerShareMatcher, X as OwnerSharePolicyRegistration, Y as OwnerSharePolicyRegistrationReceipt, Z as OwnerSharePolicyV2, _ as ReceiveOptions, $ as RegisterOwnerSharePolicyParams, a0 as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, a1 as SenderShareKeyStorage, a2 as SenderShareRecord, a3 as SenderShareRecordStorage, a4 as SenderShareRevocationScope, a5 as SenderShareStore, a6 as ShareAccess, a7 as ShareAccessError, a8 as ShareAccessV2, a9 as ShareAction, ab as ShareAddressedDelegationEnvelopeV2, ac as ShareAddressedDelegationEnvelopeV2Schema, ad as ShareAddressedDelegationRequestV2, ae as ShareAddressedDelegationRequestV2Schema, af as ShareAddressedDelegationResponseV2, ag as ShareAddressedDelegationResponseV2Schema, ah as ShareAddressedRecipientMatcher, ai as ShareArtifactInput, aj as ShareArtifactResult, ak as ShareArtifactV2, al as ShareCache, am as ShareCacheEntry, an as ShareCacheKey, ao as ShareCacheMetadata, ap as ShareCapabilityLike, aq as ShareConflict, ar as ShareContentMetadata, as as ShareContentSource, at as ShareDeliveryAuthorization, au as ShareDeliveryAuthorizationReceipt, av as ShareDeliveryAuthorizationRequest, aw as ShareDetachedProof, ax as ShareEnvelopeError, ay as ShareEnvelopeV2, az as ShareExpiryBounds, aA as ShareKvContentSource, aC as ShareLinkData, aD as ShareLinkLocation, aE as ShareListEntry, aF as ShareListResult, aG as ShareNativeAction, aH as ShareNativeInvokeEnvelopeV1, aI as ShareNativeInvokeErrorResult, aJ as ShareNativeInvokeInput, aK as ShareNativeInvokeResult, aL as ShareNativeInvokeSuccessResult, aM as ShareNativeResponse, aN as ShareNativeResponseSchema, aO as SharePolicy, aP as SharePolicyBinding, aQ as SharePolicySession, aR as SharePolicySessionV1, aS as SharePolicySessionWireV1, aT as ShareReadInvocationV1, aU as ShareReadResult, aV as ShareRecipientClient, aW as ShareRecipientClientOptions, aY as ShareRecipientPolicy, a_ as ShareRecipientResult, a$ as ShareRecipientTarget, b1 as ShareResource, b3 as ShareSaveOptions, b4 as ShareSchema, b5 as ShareSqlContentSource, b6 as ShareWireAction, b7 as SharingService, b8 as SharingServiceConfig, b9 as SignedDelegation, bb as SpaceOwnership, bM as StoredDelegationChain, bc as ValidateShareDeliveryAuthorizationExpected, bd as VerifyShareEnvelopeOptions, be as canonicalOwnerSharePolicy, bf as computeOwnerShareRegistrationCid, bg as computeShareCid, bN as createCapabilityKeyRegistry, bh as createDelegatedShareKey, bi as createPolicyEnforcementDelegation, bj as createShareArtifact, bk as createShareArtifactAsync, bl as createSharePolicy, bm as createSharingService, bn as decryptShareBytesAsync, bo as encodeInlineShareUrl, bp as encodeShareArtifact, bq as encodeShareUrl, br as encryptShareBytes, bs as encryptShareBytesAsync, bt as intersectShareCapabilities, bu as isV2ShareLink, bv as normalizeShareActions, bw as normalizeShareRecipientTarget, bx as normalizeShareResource, by as parseShareArtifact, bz as parseShareUrl, bA as restoreDelegatedShareKey, bB as shareCapabilityAllows, bC as shareDeliveryTrustedKid, bD as signShareEnvelope, bE as validateOwnerSharePolicyRegistration, bF as validateOwnerSharePolicyRegistrationBytes, bG as validateShareDeliveryAuthorizationBytes, bH as verifyShareCid, bI as verifyShareEnvelope } from './recipient-types.schema-D5pDlIqn.js';
 export { ACCOUNT_INDEX_SCHEMA, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, a as Policy, P as PolicyEngineRecord, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, S as SignedObjectSigner, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, U as UnsignedPolicyEngineRecord, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from './signed-object-C6mWbTbB.js';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';

package/dist/index.js

@@ -6658,6 +6658,10 @@ function normalizeRecipient(recipient) {
     }
     return { kind: recipient.kind, value: domain };
   }
+  if (recipient.kind === "recipientDid") {
+    if (!isCanonicalRecipientDid(recipient.value)) throw new ShareEnvelopeError("invalid-envelope", "recipient DID is invalid");
+    return { kind: recipient.kind, value: recipient.value };
+  }
   const exact = recipient.value.trim();
   const at = exact.lastIndexOf("@");
   const normalizedExact = at > 0 ? `${exact.slice(0, at)}@${exact.slice(at + 1).toLowerCase()}` : exact;
@@ -6666,6 +6670,28 @@ function normalizeRecipient(recipient) {
   }
   return { kind: recipient.kind, value: normalizedExact };
 }
+function isCanonicalRecipientDid(value) {
+  if (value.length === 0 || value.length > 2048 || /[\u0000-\u0020\u007f]/.test(value)) return false;
+  const parts = value.split(":");
+  if (parts.length < 3 || parts[0] !== "did" || !/^[a-z0-9]+$/.test(parts[1] ?? "")) return false;
+  const identifier = parts.slice(2);
+  if (identifier.some((part) => part.length === 0)) return false;
+  if (parts[1] === "web") {
+    const host = identifier[0] ?? "";
+    if (host.length > 253 || host.split(".").some((label) => !label || label.length > 63 || !/^[A-Za-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-"))) return false;
+    return identifier.slice(1).every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  }
+  if (parts[1] === "pkh") return identifier.length >= 3 && identifier.every((part) => /^[A-Za-z0-9._%-]+$/.test(part));
+  if (parts[1] === "key") {
+    try {
+      const bytes2 = base58btc.decode(identifier.join(":"));
+      return bytes2.length === 34 && bytes2[0] === 237 && bytes2[1] === 1;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
 function normalizeShareRecipientTarget(recipient) {
   const normalized = normalizeRecipient(recipient);
   if (normalized === void 0) throw new ShareEnvelopeError("invalid-envelope", "recipient matcher is required");
@@ -6752,9 +6778,9 @@ function verifyShareEnvelope(envelope, options2 = {}) {
     const recipient = normalizeRecipient(envelope.recipient);
     if (recipient !== void 0 && JSON.stringify(recipient) !== JSON.stringify(envelope.recipient)) throw new ShareEnvelopeError("invalid-envelope", "recipient is not canonical");
     if (recipient?.kind === "exactEmail" || recipient?.kind === "emailDomain") throw new ShareEnvelopeError("unsafe-plaintext", "recipient matchers are not public envelope fields");
-    if (envelope.recipientKind !== void 0 && !["exactEmail", "emailDomain", "bearer"].includes(envelope.recipientKind)) throw new ShareEnvelopeError("invalid-envelope", "recipient mode is invalid");
+    if (envelope.recipientKind !== void 0 && !["exactEmail", "emailDomain", "recipientDid", "bearer"].includes(envelope.recipientKind)) throw new ShareEnvelopeError("invalid-envelope", "recipient mode is invalid");
     if (envelope.recipientKind === "bearer" && recipient?.kind !== void 0 && recipient.kind !== "bearer") throw new ShareEnvelopeError("invalid-envelope", "recipient mode does not match recipient");
-    if ((envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain") && !envelope.encrypted) throw new ShareEnvelopeError("unsafe-plaintext", "policy shares require encryption");
+    if ((envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain" || envelope.recipientKind === "recipientDid") && !envelope.encrypted) throw new ShareEnvelopeError("unsafe-plaintext", "addressed shares require encryption");
     if (typeof envelope.spaceId !== "string" || envelope.spaceId.length === 0 || typeof envelope.content.mimeType !== "string" || envelope.content.mimeType.length === 0 || typeof envelope.content.digest !== "string" || !/^[A-Za-z0-9_-]+$/.test(envelope.content.digest)) throw new ShareEnvelopeError("invalid-envelope", "content metadata is invalid");
     const maxContentBytes = envelope.encrypted ? options2.maxSealedContentBytes ?? MAX_SEALED_SHARE_CONTENT_BYTES : options2.maxContentBytes ?? MAX_SHARE_CONTENT_BYTES;
     if (!Number.isInteger(envelope.content.size) || envelope.content.size < 0 || envelope.content.size > maxContentBytes) throw new ShareEnvelopeError("content-too-large", "share content exceeds the configured limit");
@@ -6893,7 +6919,7 @@ function parsePolicyMetadata(policyBytes, target, expectedExpiry) {
     assertKeys(policy, ["type", "version", "issuerDid", "recipientMatcher", "target", "delegation", "authority", "actions", "resource", "content-source", "expiresAt"], "published canonical policy material");
     if (typeof policy.issuerDid !== "string" || typeof policy.expiresAt !== "string" || policy.expiresAt !== expectedExpiry) throw new ShareEnvelopeError("invalid-envelope", "policy expiry is not bound to the envelope");
     const matcherValue = policy.recipientMatcher;
-    if (!isPlainObject(matcherValue) || matcherValue.kind !== "exactEmail" && matcherValue.kind !== "emailDomain" || typeof matcherValue.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
+    if (!isPlainObject(matcherValue) || matcherValue.kind !== "exactEmail" && matcherValue.kind !== "emailDomain" && matcherValue.kind !== "recipientDid" || typeof matcherValue.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
     const matcher2 = normalizeRecipient(matcherValue);
     if (matcher2 === void 0 || matcher2.kind === "bearer") throw new ShareEnvelopeError("invalid-envelope", "policy matcher is invalid");
     if (!isPlainObject(policy.target)) throw new ShareEnvelopeError("invalid-envelope", "policy target is invalid");
@@ -6980,7 +7006,7 @@ function parseCanonicalPublishedV2(value, options2) {
   if (!Number.isFinite(expiry) || expiry <= (options2.now ?? /* @__PURE__ */ new Date()).getTime() || new Date(expiry).toISOString() !== value.expiry) throw new ShareEnvelopeError("expired", "published share envelope has expired");
   if (typeof delegation.cid !== "string" || typeof delegation.issuerDid !== "string" || typeof delegation.audience !== "string" || typeof delegation.expiresAt !== "string" || Date.parse(delegation.expiresAt) > expiry) throw new ShareEnvelopeError("invalid-envelope", "published v2 delegation is invalid");
   const matcher = value.recipientMatcher;
-  if (!isPlainObject(matcher) || matcher.kind !== "exactEmail" && matcher.kind !== "emailDomain" || typeof matcher.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
+  if (!isPlainObject(matcher) || matcher.kind !== "exactEmail" && matcher.kind !== "emailDomain" && matcher.kind !== "recipientDid" || typeof matcher.value !== "string") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
   const normalizedMatcher = normalizeRecipient(matcher);
   if (normalizedMatcher === void 0 || normalizedMatcher.kind === "bearer") throw new ShareEnvelopeError("invalid-envelope", "published v2 recipient matcher is invalid");
   if (!Array.isArray(value.actions)) throw new ShareEnvelopeError("invalid-envelope", "published v2 actions are invalid");
@@ -7421,10 +7447,11 @@ var ShareConflict = class extends Error {
   }
 };
 var ShareAccessError = class extends Error {
-  constructor(code3, message) {
+  constructor(code3, message, details) {
     super(message ?? "shared access could not be completed");
     this.name = "ShareAccessError";
     this.code = code3;
+    this.details = details;
   }
 };
 
@@ -7433,6 +7460,7 @@ import { z as z5 } from "zod";
 var ShareRecipientTargetSchema = z5.discriminatedUnion("kind", [
   z5.object({ kind: z5.literal("exactEmail"), value: z5.string().min(1) }).strict(),
   z5.object({ kind: z5.literal("emailDomain"), value: z5.string().min(1) }).strict(),
+  z5.object({ kind: z5.literal("recipientDid"), value: z5.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),
   z5.object({ kind: z5.literal("bearer") }).strict()
 ]);
 var ShareResourceSchema = z5.discriminatedUnion("kind", [
@@ -7476,7 +7504,8 @@ var ShareContentSourceSchema = z5.discriminatedUnion("kind", [
 ]);
 var ShareAddressedRecipientSchema = z5.discriminatedUnion("kind", [
   z5.object({ kind: z5.literal("exactEmail"), value: z5.string().min(1) }).strict(),
-  z5.object({ kind: z5.literal("emailDomain"), value: z5.string().min(1) }).strict()
+  z5.object({ kind: z5.literal("emailDomain"), value: z5.string().min(1) }).strict(),
+  z5.object({ kind: z5.literal("recipientDid"), value: z5.string().regex(/^did:[a-z0-9]+:.+$/) }).strict()
 ]);
 var ShareAddressedDelegationRequestV2Schema = z5.object({
   version: z5.literal(2),
@@ -7731,12 +7760,21 @@ var ShareRecipientClient = class {
       const { envelope } = resolved.artifact;
       const { location } = resolved;
       const bearer = isBearerEnvelope(envelope);
-      const policy = envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain";
+      const policy = envelope.recipientKind === "exactEmail" || envelope.recipientKind === "emailDomain" || envelope.authorizationTargetKind === "recipientDid";
       const legacyBearer = !policy && envelope.recipientKind === void 0;
-      if (envelope.authorizationTargetKind === "recipientDid") throw new ShareAccessError("SHARE_RECIPIENT_DID_UNSUPPORTED");
+      let recipientDidSession;
+      if (envelope.authorizationTargetKind === "recipientDid") {
+        if (this.options.establishRecipientDidSession === void 0) throw new ShareAccessError("SHARE_DEVICE_AUTH_REQUIRED", "an OpenKey device authorization is required");
+        const authorization = await this.options.establishRecipientDidSession({ envelope, recipientDid: envelope.recipient?.kind === "recipientDid" ? envelope.recipient.value : "" });
+        if ("state" in authorization) {
+          if (authorization.state === "authorization-required") throw new ShareAccessError("SHARE_DEVICE_AUTH_REQUIRED", "an OpenKey device authorization is required", authorization);
+          throw new ShareAccessError("SHARE_DENIED", "recipient DID authorization was denied", authorization);
+        }
+        recipientDidSession = authorization;
+      }
       if (policy && this.options.bearerSession !== void 0) throw new ShareAccessError("SHARE_POLICY_BEARER_MISMATCH");
       if (bearer && this.options.presentation !== void 0) throw new ShareAccessError("SHARE_BEARER_PRESENTATION_MISMATCH");
-      const session = bearer || legacyBearer ? this.options.bearerSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
+      const session = bearer || legacyBearer ? this.options.bearerSession : recipientDidSession ? recipientDidSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
       const kv = bearer || legacyBearer ? session === void 0 ? void 0 : this.createKV(envelope.origin, session) : void 0;
       const policySession = policy ? session : void 0;
       if (policySession !== void 0) this.assertProvidedPolicySession(policySession, envelope);
@@ -9937,7 +9975,7 @@ function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
   const authorization = assertObject2(root.authorization, AUTHORIZATION_KEYS, "share delivery authorization");
   const proof = assertObject2(root.proof, ["alg", "kid", "signature"], "share delivery authorization proof");
   const request = expected.request;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.jti || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
+  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 2 || authorization.dataAuthority !== false || authorization.jti !== request.jti || authorization.shareCid !== request.shareCid || authorization.shareId !== request.shareId || authorization.registrationCid !== request.registrationCid || authorization.delegationCid !== request.delegationCid || authorization.enforcementDelegationCid !== request.enforcementDelegationCid || authorization.envelopeCid !== request.envelopeCid || authorization.policyCid !== request.policyCid || authorization.deliveryEmail !== request.recipientEmail || authorization.shareUrl !== request.shareUrl || authorization.documentName !== request.documentName || authorization.requestBodyDigest !== request.requestBodyDigest || authorization.expiresAt !== request.expiresAt || authorization.idempotencyKey !== request.idempotencyKey || authorization.reportAbuseToken !== request.jti || authorization.authorityMaterialHandle !== request.registrationCid) {
     throw new Error("share delivery authorization is not bound to the submitted request");
   }
   if (typeof authorization.issuedAt !== "string" || Date.parse(authorization.issuedAt) > Date.now() + 6e4) throw new Error("share delivery authorization issuedAt is invalid");
@@ -10072,6 +10110,32 @@ var SenderShareStore = class {
   }
 };
 
+// src/delegations/index.ts
+import {
+  authorizeShare,
+  authorizationMethodForTarget,
+  notifyShare,
+  revokeShare,
+  listShares,
+  showShare,
+  publishTargetShare,
+  publishPolicyShare,
+  claimShare,
+  resumeShareAuthorization,
+  isLegacyShareLink,
+  receiveLegacyShare,
+  migrateShare,
+  MemoryEncryptedShareHistoryStorage,
+  EncryptedSenderShareHistory
+} from "@tinycloud/share-sdk";
+import {
+  inspectShare,
+  receiveShare,
+  ShareReceiveError,
+  toShareErrorInfo,
+  verifyBearerEnvelope
+} from "@tinycloud/share-sdk";
+
 // src/networkId.ts
 import {
   buildNetworkId,